@structured-id/ui-core 1.2.0 → 1.3.0

package/src/generated/sid/v1/authn/flows.ts

@@ -342,10 +342,6 @@ export interface StepType {
      * @generated from protobuf field: string category = 4
      */
     category: string; // "authenticator", "identity", "verification"
-    /**
-     * @generated from protobuf field: string tier = 5
-     */
-    tier: string; // "ce" or "ee"
     /**
      * @generated from protobuf field: bool configurable = 6
      */
@@ -1944,7 +1940,6 @@ class StepType$Type extends MessageType<StepType> {
             { no: 2, name: "display_name", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
             { no: 3, name: "description", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
             { no: 4, name: "category", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 5, name: "tier", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
             { no: 6, name: "configurable", kind: "scalar", T: 8 /*ScalarType.BOOL*/ }
         ]);
     }
@@ -1954,7 +1949,6 @@ class StepType$Type extends MessageType<StepType> {
         message.displayName = "";
         message.description = "";
         message.category = "";
-        message.tier = "";
         message.configurable = false;
         if (value !== undefined)
             reflectionMergePartial<StepType>(this, message, value);
@@ -1977,9 +1971,6 @@ class StepType$Type extends MessageType<StepType> {
                 case /* string category */ 4:
                     message.category = reader.string();
                     break;
-                case /* string tier */ 5:
-                    message.tier = reader.string();
-                    break;
                 case /* bool configurable */ 6:
                     message.configurable = reader.bool();
                     break;
@@ -2007,9 +1998,6 @@ class StepType$Type extends MessageType<StepType> {
         /* string category = 4; */
         if (message.category !== "")
             writer.tag(4, WireType.LengthDelimited).string(message.category);
-        /* string tier = 5; */
-        if (message.tier !== "")
-            writer.tag(5, WireType.LengthDelimited).string(message.tier);
         /* bool configurable = 6; */
         if (message.configurable !== false)
             writer.tag(6, WireType.Varint).bool(message.configurable);

package/src/generated/sid/v1/authn/issuer.client.ts

@@ -0,0 +1,489 @@
+// @generated by protobuf-ts 2.11.1 with parameter client_generic,generate_dependencies
+// @generated from protobuf file "sid/v1/authn/issuer.proto" (package "sid.v1.authn", syntax proto3)
+// tslint:disable
+import { OidcIssuerService } from "./issuer";
+import type { ProtectedResourceTarget } from "./issuer";
+import type { GetProtectedResourceRequest } from "./issuer";
+import type { OidcIssuer } from "./issuer";
+import type { GetOidcIssuerRequest } from "./issuer";
+import type { RpcTransport } from "@protobuf-ts/runtime-rpc";
+import type { ServiceInfo } from "@protobuf-ts/runtime-rpc";
+import { OidcProviderService } from "./issuer";
+import type { RegistrationRequest } from "./issuer";
+import type { EndSessionRequest } from "./issuer";
+import type { ProtocolRequest } from "./issuer";
+import type { HttpBody } from "../../../google/api/httpbody";
+import type { OAuth2AuthorizeRequest } from "./auth";
+import type { UserInfo } from "./issuer";
+import type { JsonWebKeySet } from "./issuer";
+import { stackIntercept } from "@protobuf-ts/runtime-rpc";
+import type { ProviderMetadata } from "./issuer";
+import type { IssuerHandleRequest } from "./issuer";
+import type { UnaryCall } from "@protobuf-ts/runtime-rpc";
+import type { RpcOptions } from "@protobuf-ts/runtime-rpc";
+/**
+ * OidcProviderService publishes one issuer's metadata and signing keys to its
+ * relying parties. Every document belongs to the issuer the handle names; an
+ * unknown handle is NOT_FOUND with ErrorInfo reason OIDC_ISSUER_NOT_FOUND and
+ * never falls back to another issuer. There is no issuer-less document.
+ *
+ * @generated from protobuf service sid.v1.authn.OidcProviderService
+ */
+export interface IOidcProviderServiceClient {
+    /**
+     * The issuer's metadata (OpenID Connect Discovery 1.0 §3–4, RFC 8414 §2–3).
+     * One document answers both discovery algorithms: the OIDC location under
+     * the issuer path and the RFC 8414 well-known location with the issuer path
+     * appended.
+     *
+     * @generated from protobuf rpc: GetProviderMetadata
+     */
+    getProviderMetadata(input: IssuerHandleRequest, options?: RpcOptions): UnaryCall<IssuerHandleRequest, ProviderMetadata>;
+    /**
+     * The issuer's JSON Web Key Set (RFC 7517 §5): the public keys that verify
+     * its tokens. The response metadata carries `cache-control` for HTTP caches.
+     *
+     * @generated from protobuf rpc: GetJwks
+     */
+    getJwks(input: IssuerHandleRequest, options?: RpcOptions): UnaryCall<IssuerHandleRequest, JsonWebKeySet>;
+    /**
+     * UserInfo (OIDC Core 1.0 §5.3) over GET. The access token travels in the
+     * `authorization` metadata, `Bearer` (RFC 6750 §2.1) or `DPoP` with a proof
+     * in the `dpop` metadata (RFC 9449 §7.1); only tokens this issuer signed are
+     * accepted. A refused token is UNAUTHENTICATED with a `www-authenticate`
+     * response metadata challenge (RFC 6750 §3, RFC 9449 §7.1). GET and POST
+     * are separate RPCs because a DPoP proof names the request method.
+     *
+     * @generated from protobuf rpc: GetUserInfo
+     */
+    getUserInfo(input: IssuerHandleRequest, options?: RpcOptions): UnaryCall<IssuerHandleRequest, UserInfo>;
+    /**
+     * UserInfo over POST (OIDC Core 1.0 §5.3.1); the same answer as GetUserInfo.
+     *
+     * @generated from protobuf rpc: PostUserInfo
+     */
+    postUserInfo(input: IssuerHandleRequest, options?: RpcOptions): UnaryCall<IssuerHandleRequest, UserInfo>;
+    /**
+     * The browser authorization endpoint (RFC 6749 §3.1) over GET, the query
+     * parameters bound to the request fields. The answer is an HTTP redirect
+     * (`x-http-code` 303 and `location` response metadata, RFC 9700 §4.11): to
+     * the client's registered redirect URI with `code` or `error`, `state` and
+     * `iss` (RFC 9207 §2), or, when the user must sign in first, to the sign-in
+     * page with this request to return to. A request whose client or exact
+     * redirect URI is not established is answered with a page and never
+     * redirected (RFC 6749 §4.1.2.1). The signed-in user's token, when a
+     * gateway holds one, travels in the `authorization` metadata.
+     *
+     * @generated from protobuf rpc: GetAuthorize
+     */
+    getAuthorize(input: OAuth2AuthorizeRequest, options?: RpcOptions): UnaryCall<OAuth2AuthorizeRequest, HttpBody>;
+    /**
+     * The authorization endpoint over POST with a form body (OIDC Core 1.0
+     * §3.1.2.1); the same answer as GetAuthorize. Parameters it does not know
+     * are ignored (RFC 6749 §3.1).
+     *
+     * @generated from protobuf rpc: PostAuthorize
+     */
+    postAuthorize(input: ProtocolRequest, options?: RpcOptions): UnaryCall<ProtocolRequest, HttpBody>;
+    /**
+     * RP-Initiated Logout (OIDC RP-Initiated Logout 1.0 §2) over GET. The
+     * browser's IdP session is read from its `__Host-sid_session` cookie
+     * (`cookie` metadata). A valid `id_token_hint` of this issuer ends the
+     * application session it names; when that session reuses the browser's
+     * IdP session, single sign-on ends too and the answer clears the cookie.
+     * Otherwise ending the browser's IdP session needs the user's confirmation
+     * (§2): the answer is a page with a form that confirms it by POST. A
+     * `post_logout_redirect_uri` is followed only for a valid `id_token_hint`
+     * whose client registered exactly that URI (§3): the answer is then a 303
+     * to it with `state`, or, while the browser's IdP session remains, the
+     * confirmation page, which returns there after either choice. Otherwise the
+     * answer is a page.
+     *
+     * @generated from protobuf rpc: GetEndSession
+     */
+    getEndSession(input: EndSessionRequest, options?: RpcOptions): UnaryCall<EndSessionRequest, HttpBody>;
+    /**
+     * RP-Initiated Logout over POST with a form body: the same parameters as
+     * GetEndSession, plus `confirmation`, the one-time value of the
+     * confirmation page's form, which ends the browser's IdP session it was
+     * issued for and returns to the post-logout redirect URI that page was
+     * shown for, if any.
+     *
+     * @generated from protobuf rpc: PostEndSession
+     */
+    postEndSession(input: ProtocolRequest, options?: RpcOptions): UnaryCall<ProtocolRequest, HttpBody>;
+    // The endpoints below are the HTTP form of AuthService's OAuth RPCs, with
+    // the same logic: the request body is the `application/x-www-form-urlencoded`
+    // form the RFC defines, the answer is the RFC's JSON with its HTTP status in
+    // the `x-http-code` response metadata and its headers (`cache-control`,
+    // `pragma`, `www-authenticate`) as response metadata. A refusal is an OK
+    // gRPC call carrying the RFC error body; typed gRPC clients use AuthService.
+    // HTTP Basic client authentication travels in the `authorization` metadata,
+    // a DPoP proof in `dpop`.
+
+    /**
+     * Token endpoint (RFC 6749 §3.2): every grant, including the device_code
+     * grant (RFC 8628 §3.4). Success is RFC 6749 §5.1 JSON with
+     * `cache-control: no-store`; a refusal is RFC 6749 §5.2 or RFC 8628 §3.5
+     * JSON, 401 with a `www-authenticate` challenge for `invalid_client` when
+     * the client used HTTP Basic, 400 otherwise.
+     *
+     * @generated from protobuf rpc: Token
+     */
+    token(input: ProtocolRequest, options?: RpcOptions): UnaryCall<ProtocolRequest, HttpBody>;
+    /**
+     * Token introspection (RFC 7662 §2): RFC 7662 §2.2 JSON, `{"active":false}`
+     * for any token this issuer does not vouch for.
+     *
+     * @generated from protobuf rpc: Introspect
+     */
+    introspect(input: ProtocolRequest, options?: RpcOptions): UnaryCall<ProtocolRequest, HttpBody>;
+    /**
+     * Token revocation (RFC 7009 §2): 200 with an empty body, also for a token
+     * that is unknown or already revoked (RFC 7009 §2.2).
+     *
+     * @generated from protobuf rpc: Revoke
+     */
+    revoke(input: ProtocolRequest, options?: RpcOptions): UnaryCall<ProtocolRequest, HttpBody>;
+    /**
+     * Device authorization (RFC 8628 §3.1): RFC 8628 §3.2 JSON; a refusal is
+     * RFC 6749 §5.2 JSON as at the token endpoint.
+     *
+     * @generated from protobuf rpc: DeviceAuthorization
+     */
+    deviceAuthorization(input: ProtocolRequest, options?: RpcOptions): UnaryCall<ProtocolRequest, HttpBody>;
+    // The registration endpoints below are the HTTP form of ProjectService's
+    // dynamic registration RPCs, with the same logic. Bodies are
+    // `application/json` client metadata (RFC 7591 §2); the initial access
+    // token or registration access token travels as a bearer token in the
+    // `authorization` metadata. A refusal is an OK gRPC call carrying the RFC
+    // error body with its HTTP status in `x-http-code`.
+
+    /**
+     * Client registration (RFC 7591 §3.1). Success is 201 with every
+     * registered metadata value, the credentials and the management location
+     * (RFC 7591 §3.2.1, RFC 7592 §3); invalid metadata is 400 with
+     * `invalid_client_metadata` or `invalid_redirect_uri` (RFC 7591 §3.2.2); a
+     * missing or invalid initial access token is 401 (RFC 6750 §3.1).
+     *
+     * @generated from protobuf rpc: Register
+     */
+    register(input: ProtocolRequest, options?: RpcOptions): UnaryCall<ProtocolRequest, HttpBody>;
+    /**
+     * Read a registration (RFC 7592 §2.1): the client's current metadata as at
+     * registration, without its secret. An invalid registration access token,
+     * or a client this issuer does not have, is 401 (RFC 7592 §2.1).
+     *
+     * @generated from protobuf rpc: ReadRegistration
+     */
+    readRegistration(input: RegistrationRequest, options?: RpcOptions): UnaryCall<RegistrationRequest, HttpBody>;
+    /**
+     * Update a registration (RFC 7592 §2.2): the body replaces the client's
+     * metadata and is validated as a registration; a refused update changes
+     * nothing.
+     *
+     * @generated from protobuf rpc: UpdateRegistration
+     */
+    updateRegistration(input: RegistrationRequest, options?: RpcOptions): UnaryCall<RegistrationRequest, HttpBody>;
+    /**
+     * Delete a registration (RFC 7592 §2.3): 204 with no body.
+     *
+     * @generated from protobuf rpc: DeleteRegistration
+     */
+    deleteRegistration(input: RegistrationRequest, options?: RpcOptions): UnaryCall<RegistrationRequest, HttpBody>;
+}
+/**
+ * OidcProviderService publishes one issuer's metadata and signing keys to its
+ * relying parties. Every document belongs to the issuer the handle names; an
+ * unknown handle is NOT_FOUND with ErrorInfo reason OIDC_ISSUER_NOT_FOUND and
+ * never falls back to another issuer. There is no issuer-less document.
+ *
+ * @generated from protobuf service sid.v1.authn.OidcProviderService
+ */
+export class OidcProviderServiceClient implements IOidcProviderServiceClient, ServiceInfo {
+    typeName = OidcProviderService.typeName;
+    methods = OidcProviderService.methods;
+    options = OidcProviderService.options;
+    constructor(private readonly _transport: RpcTransport) {
+    }
+    /**
+     * The issuer's metadata (OpenID Connect Discovery 1.0 §3–4, RFC 8414 §2–3).
+     * One document answers both discovery algorithms: the OIDC location under
+     * the issuer path and the RFC 8414 well-known location with the issuer path
+     * appended.
+     *
+     * @generated from protobuf rpc: GetProviderMetadata
+     */
+    getProviderMetadata(input: IssuerHandleRequest, options?: RpcOptions): UnaryCall<IssuerHandleRequest, ProviderMetadata> {
+        const method = this.methods[0], opt = this._transport.mergeOptions(options);
+        return stackIntercept<IssuerHandleRequest, ProviderMetadata>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * The issuer's JSON Web Key Set (RFC 7517 §5): the public keys that verify
+     * its tokens. The response metadata carries `cache-control` for HTTP caches.
+     *
+     * @generated from protobuf rpc: GetJwks
+     */
+    getJwks(input: IssuerHandleRequest, options?: RpcOptions): UnaryCall<IssuerHandleRequest, JsonWebKeySet> {
+        const method = this.methods[1], opt = this._transport.mergeOptions(options);
+        return stackIntercept<IssuerHandleRequest, JsonWebKeySet>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * UserInfo (OIDC Core 1.0 §5.3) over GET. The access token travels in the
+     * `authorization` metadata, `Bearer` (RFC 6750 §2.1) or `DPoP` with a proof
+     * in the `dpop` metadata (RFC 9449 §7.1); only tokens this issuer signed are
+     * accepted. A refused token is UNAUTHENTICATED with a `www-authenticate`
+     * response metadata challenge (RFC 6750 §3, RFC 9449 §7.1). GET and POST
+     * are separate RPCs because a DPoP proof names the request method.
+     *
+     * @generated from protobuf rpc: GetUserInfo
+     */
+    getUserInfo(input: IssuerHandleRequest, options?: RpcOptions): UnaryCall<IssuerHandleRequest, UserInfo> {
+        const method = this.methods[2], opt = this._transport.mergeOptions(options);
+        return stackIntercept<IssuerHandleRequest, UserInfo>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * UserInfo over POST (OIDC Core 1.0 §5.3.1); the same answer as GetUserInfo.
+     *
+     * @generated from protobuf rpc: PostUserInfo
+     */
+    postUserInfo(input: IssuerHandleRequest, options?: RpcOptions): UnaryCall<IssuerHandleRequest, UserInfo> {
+        const method = this.methods[3], opt = this._transport.mergeOptions(options);
+        return stackIntercept<IssuerHandleRequest, UserInfo>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * The browser authorization endpoint (RFC 6749 §3.1) over GET, the query
+     * parameters bound to the request fields. The answer is an HTTP redirect
+     * (`x-http-code` 303 and `location` response metadata, RFC 9700 §4.11): to
+     * the client's registered redirect URI with `code` or `error`, `state` and
+     * `iss` (RFC 9207 §2), or, when the user must sign in first, to the sign-in
+     * page with this request to return to. A request whose client or exact
+     * redirect URI is not established is answered with a page and never
+     * redirected (RFC 6749 §4.1.2.1). The signed-in user's token, when a
+     * gateway holds one, travels in the `authorization` metadata.
+     *
+     * @generated from protobuf rpc: GetAuthorize
+     */
+    getAuthorize(input: OAuth2AuthorizeRequest, options?: RpcOptions): UnaryCall<OAuth2AuthorizeRequest, HttpBody> {
+        const method = this.methods[4], opt = this._transport.mergeOptions(options);
+        return stackIntercept<OAuth2AuthorizeRequest, HttpBody>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * The authorization endpoint over POST with a form body (OIDC Core 1.0
+     * §3.1.2.1); the same answer as GetAuthorize. Parameters it does not know
+     * are ignored (RFC 6749 §3.1).
+     *
+     * @generated from protobuf rpc: PostAuthorize
+     */
+    postAuthorize(input: ProtocolRequest, options?: RpcOptions): UnaryCall<ProtocolRequest, HttpBody> {
+        const method = this.methods[5], opt = this._transport.mergeOptions(options);
+        return stackIntercept<ProtocolRequest, HttpBody>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * RP-Initiated Logout (OIDC RP-Initiated Logout 1.0 §2) over GET. The
+     * browser's IdP session is read from its `__Host-sid_session` cookie
+     * (`cookie` metadata). A valid `id_token_hint` of this issuer ends the
+     * application session it names; when that session reuses the browser's
+     * IdP session, single sign-on ends too and the answer clears the cookie.
+     * Otherwise ending the browser's IdP session needs the user's confirmation
+     * (§2): the answer is a page with a form that confirms it by POST. A
+     * `post_logout_redirect_uri` is followed only for a valid `id_token_hint`
+     * whose client registered exactly that URI (§3): the answer is then a 303
+     * to it with `state`, or, while the browser's IdP session remains, the
+     * confirmation page, which returns there after either choice. Otherwise the
+     * answer is a page.
+     *
+     * @generated from protobuf rpc: GetEndSession
+     */
+    getEndSession(input: EndSessionRequest, options?: RpcOptions): UnaryCall<EndSessionRequest, HttpBody> {
+        const method = this.methods[6], opt = this._transport.mergeOptions(options);
+        return stackIntercept<EndSessionRequest, HttpBody>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * RP-Initiated Logout over POST with a form body: the same parameters as
+     * GetEndSession, plus `confirmation`, the one-time value of the
+     * confirmation page's form, which ends the browser's IdP session it was
+     * issued for and returns to the post-logout redirect URI that page was
+     * shown for, if any.
+     *
+     * @generated from protobuf rpc: PostEndSession
+     */
+    postEndSession(input: ProtocolRequest, options?: RpcOptions): UnaryCall<ProtocolRequest, HttpBody> {
+        const method = this.methods[7], opt = this._transport.mergeOptions(options);
+        return stackIntercept<ProtocolRequest, HttpBody>("unary", this._transport, method, opt, input);
+    }
+    // The endpoints below are the HTTP form of AuthService's OAuth RPCs, with
+    // the same logic: the request body is the `application/x-www-form-urlencoded`
+    // form the RFC defines, the answer is the RFC's JSON with its HTTP status in
+    // the `x-http-code` response metadata and its headers (`cache-control`,
+    // `pragma`, `www-authenticate`) as response metadata. A refusal is an OK
+    // gRPC call carrying the RFC error body; typed gRPC clients use AuthService.
+    // HTTP Basic client authentication travels in the `authorization` metadata,
+    // a DPoP proof in `dpop`.
+
+    /**
+     * Token endpoint (RFC 6749 §3.2): every grant, including the device_code
+     * grant (RFC 8628 §3.4). Success is RFC 6749 §5.1 JSON with
+     * `cache-control: no-store`; a refusal is RFC 6749 §5.2 or RFC 8628 §3.5
+     * JSON, 401 with a `www-authenticate` challenge for `invalid_client` when
+     * the client used HTTP Basic, 400 otherwise.
+     *
+     * @generated from protobuf rpc: Token
+     */
+    token(input: ProtocolRequest, options?: RpcOptions): UnaryCall<ProtocolRequest, HttpBody> {
+        const method = this.methods[8], opt = this._transport.mergeOptions(options);
+        return stackIntercept<ProtocolRequest, HttpBody>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * Token introspection (RFC 7662 §2): RFC 7662 §2.2 JSON, `{"active":false}`
+     * for any token this issuer does not vouch for.
+     *
+     * @generated from protobuf rpc: Introspect
+     */
+    introspect(input: ProtocolRequest, options?: RpcOptions): UnaryCall<ProtocolRequest, HttpBody> {
+        const method = this.methods[9], opt = this._transport.mergeOptions(options);
+        return stackIntercept<ProtocolRequest, HttpBody>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * Token revocation (RFC 7009 §2): 200 with an empty body, also for a token
+     * that is unknown or already revoked (RFC 7009 §2.2).
+     *
+     * @generated from protobuf rpc: Revoke
+     */
+    revoke(input: ProtocolRequest, options?: RpcOptions): UnaryCall<ProtocolRequest, HttpBody> {
+        const method = this.methods[10], opt = this._transport.mergeOptions(options);
+        return stackIntercept<ProtocolRequest, HttpBody>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * Device authorization (RFC 8628 §3.1): RFC 8628 §3.2 JSON; a refusal is
+     * RFC 6749 §5.2 JSON as at the token endpoint.
+     *
+     * @generated from protobuf rpc: DeviceAuthorization
+     */
+    deviceAuthorization(input: ProtocolRequest, options?: RpcOptions): UnaryCall<ProtocolRequest, HttpBody> {
+        const method = this.methods[11], opt = this._transport.mergeOptions(options);
+        return stackIntercept<ProtocolRequest, HttpBody>("unary", this._transport, method, opt, input);
+    }
+    // The registration endpoints below are the HTTP form of ProjectService's
+    // dynamic registration RPCs, with the same logic. Bodies are
+    // `application/json` client metadata (RFC 7591 §2); the initial access
+    // token or registration access token travels as a bearer token in the
+    // `authorization` metadata. A refusal is an OK gRPC call carrying the RFC
+    // error body with its HTTP status in `x-http-code`.
+
+    /**
+     * Client registration (RFC 7591 §3.1). Success is 201 with every
+     * registered metadata value, the credentials and the management location
+     * (RFC 7591 §3.2.1, RFC 7592 §3); invalid metadata is 400 with
+     * `invalid_client_metadata` or `invalid_redirect_uri` (RFC 7591 §3.2.2); a
+     * missing or invalid initial access token is 401 (RFC 6750 §3.1).
+     *
+     * @generated from protobuf rpc: Register
+     */
+    register(input: ProtocolRequest, options?: RpcOptions): UnaryCall<ProtocolRequest, HttpBody> {
+        const method = this.methods[12], opt = this._transport.mergeOptions(options);
+        return stackIntercept<ProtocolRequest, HttpBody>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * Read a registration (RFC 7592 §2.1): the client's current metadata as at
+     * registration, without its secret. An invalid registration access token,
+     * or a client this issuer does not have, is 401 (RFC 7592 §2.1).
+     *
+     * @generated from protobuf rpc: ReadRegistration
+     */
+    readRegistration(input: RegistrationRequest, options?: RpcOptions): UnaryCall<RegistrationRequest, HttpBody> {
+        const method = this.methods[13], opt = this._transport.mergeOptions(options);
+        return stackIntercept<RegistrationRequest, HttpBody>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * Update a registration (RFC 7592 §2.2): the body replaces the client's
+     * metadata and is validated as a registration; a refused update changes
+     * nothing.
+     *
+     * @generated from protobuf rpc: UpdateRegistration
+     */
+    updateRegistration(input: RegistrationRequest, options?: RpcOptions): UnaryCall<RegistrationRequest, HttpBody> {
+        const method = this.methods[14], opt = this._transport.mergeOptions(options);
+        return stackIntercept<RegistrationRequest, HttpBody>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * Delete a registration (RFC 7592 §2.3): 204 with no body.
+     *
+     * @generated from protobuf rpc: DeleteRegistration
+     */
+    deleteRegistration(input: RegistrationRequest, options?: RpcOptions): UnaryCall<RegistrationRequest, HttpBody> {
+        const method = this.methods[15], opt = this._transport.mergeOptions(options);
+        return stackIntercept<RegistrationRequest, HttpBody>("unary", this._transport, method, opt, input);
+    }
+}
+/**
+ * OidcIssuerService lets services that verify an issuer's tokens resolve the
+ * issuer and its keys by handle, and the registered resource a token must be
+ * issued for.
+ *
+ * Internal only, no HTTP annotation: relying parties use OidcProviderService.
+ *
+ * @generated from protobuf service sid.v1.authn.OidcIssuerService
+ */
+export interface IOidcIssuerServiceClient {
+    /**
+     * Look up an issuer by handle. An unknown handle is NOT_FOUND with
+     * ErrorInfo reason OIDC_ISSUER_NOT_FOUND and a ResourceInfo naming the
+     * handle; the caller refuses the request and never falls back to another
+     * issuer.
+     *
+     * @generated from protobuf rpc: GetOidcIssuer
+     */
+    getOidcIssuer(input: GetOidcIssuerRequest, options?: RpcOptions): UnaryCall<GetOidcIssuerRequest, OidcIssuer>;
+    /**
+     * Resolve the protected resource a route of the ingress configuration names
+     * before a token is accepted for it. The resource must be registered under
+     * this issuer: an unknown issuer or indicator is NOT_FOUND with ErrorInfo
+     * reason RESOURCE_NOT_FOUND and a ResourceInfo naming the indicator. The
+     * caller refuses the route and never falls back to another target.
+     *
+     * @generated from protobuf rpc: GetProtectedResource
+     */
+    getProtectedResource(input: GetProtectedResourceRequest, options?: RpcOptions): UnaryCall<GetProtectedResourceRequest, ProtectedResourceTarget>;
+}
+/**
+ * OidcIssuerService lets services that verify an issuer's tokens resolve the
+ * issuer and its keys by handle, and the registered resource a token must be
+ * issued for.
+ *
+ * Internal only, no HTTP annotation: relying parties use OidcProviderService.
+ *
+ * @generated from protobuf service sid.v1.authn.OidcIssuerService
+ */
+export class OidcIssuerServiceClient implements IOidcIssuerServiceClient, ServiceInfo {
+    typeName = OidcIssuerService.typeName;
+    methods = OidcIssuerService.methods;
+    options = OidcIssuerService.options;
+    constructor(private readonly _transport: RpcTransport) {
+    }
+    /**
+     * Look up an issuer by handle. An unknown handle is NOT_FOUND with
+     * ErrorInfo reason OIDC_ISSUER_NOT_FOUND and a ResourceInfo naming the
+     * handle; the caller refuses the request and never falls back to another
+     * issuer.
+     *
+     * @generated from protobuf rpc: GetOidcIssuer
+     */
+    getOidcIssuer(input: GetOidcIssuerRequest, options?: RpcOptions): UnaryCall<GetOidcIssuerRequest, OidcIssuer> {
+        const method = this.methods[0], opt = this._transport.mergeOptions(options);
+        return stackIntercept<GetOidcIssuerRequest, OidcIssuer>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * Resolve the protected resource a route of the ingress configuration names
+     * before a token is accepted for it. The resource must be registered under
+     * this issuer: an unknown issuer or indicator is NOT_FOUND with ErrorInfo
+     * reason RESOURCE_NOT_FOUND and a ResourceInfo naming the indicator. The
+     * caller refuses the route and never falls back to another target.
+     *
+     * @generated from protobuf rpc: GetProtectedResource
+     */
+    getProtectedResource(input: GetProtectedResourceRequest, options?: RpcOptions): UnaryCall<GetProtectedResourceRequest, ProtectedResourceTarget> {
+        const method = this.methods[1], opt = this._transport.mergeOptions(options);
+        return stackIntercept<GetProtectedResourceRequest, ProtectedResourceTarget>("unary", this._transport, method, opt, input);
+    }
+}