@structured-id/ui-core 1.2.0 → 1.3.0

package/src/generated/sid/v1/authn/issuer.ts

@@ -0,0 +1,1600 @@
+// @generated by protobuf-ts 2.11.1 with parameter client_generic,generate_dependencies
+// @generated from protobuf file "sid/v1/authn/issuer.proto" (package "sid.v1.authn", syntax proto3)
+// tslint:disable
+import { OAuth2AuthorizeRequest } from "./auth";
+import { ServiceType } from "@protobuf-ts/runtime-rpc";
+import type { BinaryWriteOptions } from "@protobuf-ts/runtime";
+import type { IBinaryWriter } from "@protobuf-ts/runtime";
+import { WireType } from "@protobuf-ts/runtime";
+import type { BinaryReadOptions } from "@protobuf-ts/runtime";
+import type { IBinaryReader } from "@protobuf-ts/runtime";
+import { UnknownFieldHandler } from "@protobuf-ts/runtime";
+import type { PartialMessage } from "@protobuf-ts/runtime";
+import { reflectionMergePartial } from "@protobuf-ts/runtime";
+import { MessageType } from "@protobuf-ts/runtime";
+import { ResourceId } from "../ids/ids";
+import { HttpBody } from "../../../google/api/httpbody";
+/**
+ * A request to one registered client's management endpoint (RFC 7592) in its
+ * HTTP form.
+ *
+ * @generated from protobuf message sid.v1.authn.RegistrationRequest
+ */
+export interface RegistrationRequest {
+    /**
+     * The opaque issuer handle: the `<handle>` path segment of the issuer URL
+     * `https://<host>/i/<handle>`. 32 lowercase hex characters.
+     *
+     * @generated from protobuf field: string issuer_handle = 1
+     */
+    issuerHandle: string;
+    /**
+     * The client being managed, the last segment of its
+     * `registration_client_uri` (RFC 7592 §3).
+     *
+     * @generated from protobuf field: string client_id = 2
+     */
+    clientId: string;
+    /**
+     * The HTTP request body with its `Content-Type`: `application/json` client
+     * metadata for an update (RFC 7592 §2.2); absent for read and delete.
+     *
+     * @generated from protobuf field: google.api.HttpBody body = 3
+     */
+    body?: HttpBody;
+}
+/**
+ * A logout request of a relying party (OIDC RP-Initiated Logout 1.0 §2) at
+ * one issuer's end-session endpoint.
+ *
+ * @generated from protobuf message sid.v1.authn.EndSessionRequest
+ */
+export interface EndSessionRequest {
+    /**
+     * The opaque issuer handle: the `<handle>` path segment of the issuer URL
+     * `https://<host>/i/<handle>`. 32 lowercase hex characters.
+     *
+     * @generated from protobuf field: string issuer_handle = 1
+     */
+    issuerHandle: string;
+    /**
+     * An ID token this issuer gave the relying party, naming the application
+     * session (`sid`) and the client (`aud`) that asks to log out. Accepted
+     * expired (§2); one of another issuer, or not an ID token, is ignored.
+     *
+     * @generated from protobuf field: optional string id_token_hint = 2
+     */
+    idTokenHint?: string;
+    /**
+     * The relying party's client identifier. With `id_token_hint`, it must be
+     * the hint's audience or the hint is ignored.
+     *
+     * @generated from protobuf field: optional string client_id = 3
+     */
+    clientId?: string;
+    /**
+     * Where to send the browser after logout (§3). Followed only when a valid
+     * `id_token_hint` names the client and the URI exactly matches one the
+     * client registered; otherwise the answer is a page.
+     *
+     * @generated from protobuf field: optional string post_logout_redirect_uri = 4
+     */
+    postLogoutRedirectUri?: string;
+    /**
+     * Opaque value of the relying party, added to the post-logout redirect as
+     * `state` (§3).
+     *
+     * @generated from protobuf field: optional string state = 5
+     */
+    state?: string;
+}
+/**
+ * An OAuth request to one issuer's endpoint in its HTTP form.
+ *
+ * @generated from protobuf message sid.v1.authn.ProtocolRequest
+ */
+export interface ProtocolRequest {
+    /**
+     * The opaque issuer handle: the `<handle>` path segment of the issuer URL
+     * `https://<host>/i/<handle>`. 32 lowercase hex characters.
+     *
+     * @generated from protobuf field: string issuer_handle = 1
+     */
+    issuerHandle: string;
+    /**
+     * The HTTP request body as the client sent it, with its `Content-Type`;
+     * absent for a request without one (a GET). The endpoints read
+     * `application/x-www-form-urlencoded` (RFC 6749 §3.2) and refuse any other
+     * type as `invalid_request`.
+     *
+     * @generated from protobuf field: google.api.HttpBody body = 2
+     */
+    body?: HttpBody;
+}
+/**
+ * Claims about the authenticated user (OIDC Core 1.0 §5.3.2). A claim the
+ * token's scopes do not grant, or the user does not have, is absent rather
+ * than empty (OIDC Core 1.0 §5.3.2).
+ *
+ * @generated from protobuf message sid.v1.authn.UserInfo
+ */
+export interface UserInfo {
+    /**
+     * The subject, identical to the `sub` of the ID token this issuer gave the
+     * same client (OIDC Core 1.0 §5.3.2).
+     *
+     * @generated from protobuf field: string sub = 1
+     */
+    sub: string;
+    /**
+     * Full display name (`profile` scope).
+     *
+     * @generated from protobuf field: optional string name = 2
+     */
+    name?: string;
+    /**
+     * Given name(s) (`profile` scope).
+     *
+     * @generated from protobuf field: optional string given_name = 3 [json_name = "given_name"]
+     */
+    givenName?: string;
+    /**
+     * Surname(s) (`profile` scope).
+     *
+     * @generated from protobuf field: optional string family_name = 4 [json_name = "family_name"]
+     */
+    familyName?: string;
+    /**
+     * Middle name(s) (`profile` scope).
+     *
+     * @generated from protobuf field: optional string middle_name = 5 [json_name = "middle_name"]
+     */
+    middleName?: string;
+    /**
+     * Shorthand name the user chose (`profile` scope).
+     *
+     * @generated from protobuf field: optional string preferred_username = 6 [json_name = "preferred_username"]
+     */
+    preferredUsername?: string;
+    /**
+     * When the profile information last changed, seconds since the Unix epoch
+     * (`profile` scope). A JSON number (OIDC Core 1.0 §5.1).
+     *
+     * @generated from protobuf field: optional uint32 updated_at = 7 [json_name = "updated_at"]
+     */
+    updatedAt?: number;
+    /**
+     * Primary email address (`email` scope).
+     *
+     * @generated from protobuf field: optional string email = 8
+     */
+    email?: string;
+    /**
+     * Whether the primary email address was verified (`email` scope).
+     *
+     * @generated from protobuf field: optional bool email_verified = 9 [json_name = "email_verified"]
+     */
+    emailVerified?: boolean;
+    /**
+     * Primary phone number in E.164 (`phone` scope).
+     *
+     * @generated from protobuf field: optional string phone_number = 10 [json_name = "phone_number"]
+     */
+    phoneNumber?: string;
+    /**
+     * Whether the primary phone number was verified (`phone` scope).
+     *
+     * @generated from protobuf field: optional bool phone_number_verified = 11 [json_name = "phone_number_verified"]
+     */
+    phoneNumberVerified?: boolean;
+}
+/**
+ * Names the issuer a request is for.
+ *
+ * @generated from protobuf message sid.v1.authn.IssuerHandleRequest
+ */
+export interface IssuerHandleRequest {
+    /**
+     * The opaque issuer handle: the `<handle>` path segment of the issuer URL
+     * `https://<host>/i/<handle>`. 32 lowercase hex characters, allocated by
+     * the server at issuer creation and never reused.
+     *
+     * @generated from protobuf field: string issuer_handle = 1
+     */
+    issuerHandle: string;
+}
+/**
+ * OpenID Provider / Authorization Server metadata of one issuer. JSON member
+ * names are the registered metadata names (OIDC Discovery 1.0 §3, RFC 8414 §2);
+ * every endpoint is under the issuer URL.
+ *
+ * @generated from protobuf message sid.v1.authn.ProviderMetadata
+ */
+export interface ProviderMetadata {
+    /**
+     * The issuer identifier, the stored canonical URL byte for byte: the `iss`
+     * of every token this issuer signs (OIDC Discovery 1.0 §4.3, RFC 8414 §3.3).
+     *
+     * @generated from protobuf field: string issuer = 1
+     */
+    issuer: string;
+    /**
+     * Authorization endpoint (RFC 6749 §3.1).
+     *
+     * @generated from protobuf field: string authorization_endpoint = 2 [json_name = "authorization_endpoint"]
+     */
+    authorizationEndpoint: string;
+    /**
+     * Token endpoint (RFC 6749 §3.2).
+     *
+     * @generated from protobuf field: string token_endpoint = 3 [json_name = "token_endpoint"]
+     */
+    tokenEndpoint: string;
+    /**
+     * UserInfo endpoint (OIDC Core 1.0 §5.3).
+     *
+     * @generated from protobuf field: string userinfo_endpoint = 4 [json_name = "userinfo_endpoint"]
+     */
+    userinfoEndpoint: string;
+    /**
+     * The issuer's JSON Web Key Set (RFC 7517 §5).
+     *
+     * @generated from protobuf field: string jwks_uri = 5 [json_name = "jwks_uri"]
+     */
+    jwksUri: string;
+    /**
+     * RP-Initiated Logout endpoint (OIDC RP-Initiated Logout 1.0 §2.1).
+     *
+     * @generated from protobuf field: string end_session_endpoint = 6 [json_name = "end_session_endpoint"]
+     */
+    endSessionEndpoint: string;
+    /**
+     * Token introspection endpoint (RFC 7662 §2, RFC 8414 §2).
+     *
+     * @generated from protobuf field: string introspection_endpoint = 7 [json_name = "introspection_endpoint"]
+     */
+    introspectionEndpoint: string;
+    /**
+     * Token revocation endpoint (RFC 7009 §2, RFC 8414 §2).
+     *
+     * @generated from protobuf field: string revocation_endpoint = 8 [json_name = "revocation_endpoint"]
+     */
+    revocationEndpoint: string;
+    /**
+     * Device authorization endpoint (RFC 8628 §4).
+     *
+     * @generated from protobuf field: string device_authorization_endpoint = 9 [json_name = "device_authorization_endpoint"]
+     */
+    deviceAuthorizationEndpoint: string;
+    /**
+     * Supported `response_type` values; only the authorization code flow.
+     *
+     * @generated from protobuf field: repeated string response_types_supported = 10 [json_name = "response_types_supported"]
+     */
+    responseTypesSupported: string[];
+    /**
+     * Supported grant types (RFC 8414 §2).
+     *
+     * @generated from protobuf field: repeated string grant_types_supported = 11 [json_name = "grant_types_supported"]
+     */
+    grantTypesSupported: string[];
+    /**
+     * Subject identifier types (OIDC Core 1.0 §8): `public` within this
+     * issuer. Which identifier a user's `sub` is follows the issuer, the
+     * selected Profile and the recipient, never a per-client switch.
+     *
+     * @generated from protobuf field: repeated string subject_types_supported = 12 [json_name = "subject_types_supported"]
+     */
+    subjectTypesSupported: string[];
+    /**
+     * JWS algorithms of ID tokens: the issuer's Ed25519 key signs them (EdDSA).
+     *
+     * @generated from protobuf field: repeated string id_token_signing_alg_values_supported = 13 [json_name = "id_token_signing_alg_values_supported"]
+     */
+    idTokenSigningAlgValuesSupported: string[];
+    /**
+     * Scopes a client may request (RFC 8414 §2).
+     *
+     * @generated from protobuf field: repeated string scopes_supported = 14 [json_name = "scopes_supported"]
+     */
+    scopesSupported: string[];
+    /**
+     * Client authentication methods at the token endpoint (RFC 8414 §2).
+     *
+     * @generated from protobuf field: repeated string token_endpoint_auth_methods_supported = 15 [json_name = "token_endpoint_auth_methods_supported"]
+     */
+    tokenEndpointAuthMethodsSupported: string[];
+    /**
+     * PKCE code challenge methods (RFC 7636 §4.3, RFC 8414 §2); only S256.
+     *
+     * @generated from protobuf field: repeated string code_challenge_methods_supported = 16 [json_name = "code_challenge_methods_supported"]
+     */
+    codeChallengeMethodsSupported: string[];
+    /**
+     * JWS algorithms accepted in DPoP proofs (RFC 9449 §5.1).
+     *
+     * @generated from protobuf field: repeated string dpop_signing_alg_values_supported = 17 [json_name = "dpop_signing_alg_values_supported"]
+     */
+    dpopSigningAlgValuesSupported: string[];
+    /**
+     * Back-channel logout is delivered to registered clients (OIDC Back-Channel
+     * Logout 1.0 §2.1).
+     *
+     * @generated from protobuf field: bool backchannel_logout_supported = 18 [json_name = "backchannel_logout_supported"]
+     */
+    backchannelLogoutSupported: boolean;
+    /**
+     * Logout tokens carry the `sid` claim (OIDC Back-Channel Logout 1.0 §2.1).
+     *
+     * @generated from protobuf field: bool backchannel_logout_session_supported = 19 [json_name = "backchannel_logout_session_supported"]
+     */
+    backchannelLogoutSessionSupported: boolean;
+    /**
+     * Every authorization response names its issuer in `iss` (RFC 9207 §3).
+     *
+     * @generated from protobuf field: bool authorization_response_iss_parameter_supported = 20 [json_name = "authorization_response_iss_parameter_supported"]
+     */
+    authorizationResponseIssParameterSupported: boolean;
+    /**
+     * Dynamic client registration endpoint (RFC 7591 §3, OIDC Discovery 1.0 §3,
+     * RFC 8414 §2).
+     *
+     * @generated from protobuf field: string registration_endpoint = 21 [json_name = "registration_endpoint"]
+     */
+    registrationEndpoint: string;
+    /**
+     * JWS algorithms a `private_key_jwt` client may sign its token endpoint
+     * assertion with (RFC 8414 §2: present whenever that method is listed in
+     * `token_endpoint_auth_methods_supported`). Asymmetric only; never `none`.
+     *
+     * @generated from protobuf field: repeated string token_endpoint_auth_signing_alg_values_supported = 22 [json_name = "token_endpoint_auth_signing_alg_values_supported"]
+     */
+    tokenEndpointAuthSigningAlgValuesSupported: string[];
+    /**
+     * Client authentication methods at the revocation endpoint (RFC 8414 §2;
+     * absent would mean `client_secret_basic` only): the token endpoint's.
+     *
+     * @generated from protobuf field: repeated string revocation_endpoint_auth_methods_supported = 23 [json_name = "revocation_endpoint_auth_methods_supported"]
+     */
+    revocationEndpointAuthMethodsSupported: string[];
+    /**
+     * JWS algorithms of `private_key_jwt` assertions at the revocation
+     * endpoint (RFC 8414 §2): the token endpoint's.
+     *
+     * @generated from protobuf field: repeated string revocation_endpoint_auth_signing_alg_values_supported = 24 [json_name = "revocation_endpoint_auth_signing_alg_values_supported"]
+     */
+    revocationEndpointAuthSigningAlgValuesSupported: string[];
+    /**
+     * Client authentication methods at the introspection endpoint (RFC 8414
+     * §2), for the confidential clients and machine users that may introspect;
+     * `none` is not among them (RFC 7662 §2.1).
+     *
+     * @generated from protobuf field: repeated string introspection_endpoint_auth_methods_supported = 25 [json_name = "introspection_endpoint_auth_methods_supported"]
+     */
+    introspectionEndpointAuthMethodsSupported: string[];
+    /**
+     * JWS algorithms of `private_key_jwt` assertions at the introspection
+     * endpoint (RFC 8414 §2): the token endpoint's.
+     *
+     * @generated from protobuf field: repeated string introspection_endpoint_auth_signing_alg_values_supported = 26 [json_name = "introspection_endpoint_auth_signing_alg_values_supported"]
+     */
+    introspectionEndpointAuthSigningAlgValuesSupported: string[];
+}
+/**
+ * A JSON Web Key Set (RFC 7517 §5).
+ *
+ * @generated from protobuf message sid.v1.authn.JsonWebKeySet
+ */
+export interface JsonWebKeySet {
+    /**
+     * The issuer's public signing keys, newest generation first.
+     *
+     * @generated from protobuf field: repeated sid.v1.authn.JsonWebKey keys = 1
+     */
+    keys: JsonWebKey[];
+}
+/**
+ * A public Ed25519 signing key as an OKP JWK (RFC 7517 §4, RFC 8037 §2).
+ *
+ * @generated from protobuf message sid.v1.authn.JsonWebKey
+ */
+export interface JsonWebKey {
+    /**
+     * Key type (RFC 7517 §4.1): always `OKP`.
+     *
+     * @generated from protobuf field: string kty = 1
+     */
+    kty: string;
+    /**
+     * Intended use (RFC 7517 §4.2): always `sig`.
+     *
+     * @generated from protobuf field: string use = 2
+     */
+    use: string;
+    /**
+     * Algorithm (RFC 7517 §4.4): always `EdDSA`.
+     *
+     * @generated from protobuf field: string alg = 3
+     */
+    alg: string;
+    /**
+     * Key identifier (RFC 7517 §4.5), the JWS `kid` of every token this key
+     * signs. Unique within the issuer only.
+     *
+     * @generated from protobuf field: string kid = 4
+     */
+    kid: string;
+    /**
+     * Curve (RFC 8037 §2): always `Ed25519`.
+     *
+     * @generated from protobuf field: string crv = 5
+     */
+    crv: string;
+    /**
+     * The 32-byte public key, base64url without padding (RFC 8037 §2).
+     *
+     * @generated from protobuf field: string x = 6
+     */
+    x: string;
+}
+/**
+ * @generated from protobuf message sid.v1.authn.GetOidcIssuerRequest
+ */
+export interface GetOidcIssuerRequest {
+    /**
+     * The opaque issuer handle: the `<handle>` path segment of the issuer URL
+     * `https://<host>/i/<handle>` that received the request. 32 lowercase hex
+     * characters, allocated by the server at issuer creation and never reused.
+     *
+     * @generated from protobuf field: string handle = 1
+     */
+    handle: string;
+}
+/**
+ * A logical OIDC issuer as its relying parties see it.
+ *
+ * @generated from protobuf message sid.v1.authn.OidcIssuer
+ */
+export interface OidcIssuer {
+    /**
+     * Exact issuer identifier (the stored canonical URL, `https://<host>/i/<handle>`).
+     * Discovery `issuer`, token `iss` and relying-party configuration must equal
+     * it byte for byte (OpenID Connect Discovery 1.0 §4.3). Never derived from
+     * request Host or Forwarded headers.
+     *
+     * @generated from protobuf field: string issuer = 1
+     */
+    issuer: string;
+    /**
+     * Public signing keys of this issuer, newest generation first: the current
+     * key and every earlier generation still needed to verify artifacts it
+     * issued. Keys of any other issuer never appear here, even under an equal
+     * key identifier.
+     *
+     * @generated from protobuf field: repeated sid.v1.authn.IssuerPublicKey keys = 2
+     */
+    keys: IssuerPublicKey[];
+}
+/**
+ * @generated from protobuf message sid.v1.authn.GetProtectedResourceRequest
+ */
+export interface GetProtectedResourceRequest {
+    /**
+     * Handle of the issuer the resource is registered under: the `<handle>`
+     * path segment of the issuer URL `https://<host>/i/<handle>`.
+     *
+     * @generated from protobuf field: string issuer_handle = 1
+     */
+    issuerHandle: string;
+    /**
+     * The resource indicator (RFC 8707 §2) as the ingress configuration names
+     * it: an absolute URI without a fragment, in canonical form. Compared
+     * exactly; another spelling of the same URI names no resource.
+     *
+     * @generated from protobuf field: string resource = 2
+     */
+    resource: string;
+}
+/**
+ * A registered protected resource as a token verifier needs it.
+ *
+ * @generated from protobuf message sid.v1.authn.ProtectedResourceTarget
+ */
+export interface ProtectedResourceTarget {
+    /**
+     * Exact identifier of the issuer whose tokens the resource accepts; a
+     * token naming another `iss` is refused there.
+     *
+     * @generated from protobuf field: string issuer = 1
+     */
+    issuer: string;
+    /**
+     * The resource indicator, which is the `aud` an access token for this
+     * resource carries (RFC 9068 §4).
+     *
+     * @generated from protobuf field: string resource = 2
+     */
+    resource: string;
+    /**
+     * Whether the resource accepts tokens now. An inactive or retired resource
+     * opens nothing: every token presented for it is refused.
+     *
+     * @generated from protobuf field: bool active = 3
+     */
+    active: boolean;
+    /**
+     * The registered resource itself: the target a permission question about
+     * its requests names.
+     *
+     * @generated from protobuf field: sid.v1.ids.ResourceId id = 4
+     */
+    id?: ResourceId;
+}
+/**
+ * One generation of an issuer's server signing key.
+ *
+ * @generated from protobuf message sid.v1.authn.IssuerPublicKey
+ */
+export interface IssuerPublicKey {
+    /**
+     * Key identifier, published as the JWK `kid` and carried in the JWS header
+     * of every token signed with this key (RFC 7515 §4.1.4). Unique within the
+     * issuer only; a verifier matches it together with the exact issuer.
+     *
+     * @generated from protobuf field: string key_id = 1
+     */
+    keyId: string;
+    /**
+     * Ed25519 public key, the 32-byte encoding of RFC 8032 §5.1.5. Published as
+     * an OKP JWK with crv "Ed25519" and alg "EdDSA" (RFC 8037 §2).
+     *
+     * @generated from protobuf field: bytes public_key = 2
+     */
+    publicKey: Uint8Array;
+}
+// @generated message type with reflection information, may provide speed optimized methods
+class RegistrationRequest$Type extends MessageType<RegistrationRequest> {
+    constructor() {
+        super("sid.v1.authn.RegistrationRequest", [
+            { no: 1, name: "issuer_handle", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "client_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "body", kind: "message", T: () => HttpBody }
+        ]);
+    }
+    create(value?: PartialMessage<RegistrationRequest>): RegistrationRequest {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.issuerHandle = "";
+        message.clientId = "";
+        if (value !== undefined)
+            reflectionMergePartial<RegistrationRequest>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: RegistrationRequest): RegistrationRequest {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string issuer_handle */ 1:
+                    message.issuerHandle = reader.string();
+                    break;
+                case /* string client_id */ 2:
+                    message.clientId = reader.string();
+                    break;
+                case /* google.api.HttpBody body */ 3:
+                    message.body = HttpBody.internalBinaryRead(reader, reader.uint32(), options, message.body);
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: RegistrationRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string issuer_handle = 1; */
+        if (message.issuerHandle !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.issuerHandle);
+        /* string client_id = 2; */
+        if (message.clientId !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.clientId);
+        /* google.api.HttpBody body = 3; */
+        if (message.body)
+            HttpBody.internalBinaryWrite(message.body, writer.tag(3, WireType.LengthDelimited).fork(), options).join();
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.authn.RegistrationRequest
+ */
+export const RegistrationRequest = new RegistrationRequest$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class EndSessionRequest$Type extends MessageType<EndSessionRequest> {
+    constructor() {
+        super("sid.v1.authn.EndSessionRequest", [
+            { no: 1, name: "issuer_handle", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "id_token_hint", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "client_id", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 4, name: "post_logout_redirect_uri", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 5, name: "state", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<EndSessionRequest>): EndSessionRequest {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.issuerHandle = "";
+        if (value !== undefined)
+            reflectionMergePartial<EndSessionRequest>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: EndSessionRequest): EndSessionRequest {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string issuer_handle */ 1:
+                    message.issuerHandle = reader.string();
+                    break;
+                case /* optional string id_token_hint */ 2:
+                    message.idTokenHint = reader.string();
+                    break;
+                case /* optional string client_id */ 3:
+                    message.clientId = reader.string();
+                    break;
+                case /* optional string post_logout_redirect_uri */ 4:
+                    message.postLogoutRedirectUri = reader.string();
+                    break;
+                case /* optional string state */ 5:
+                    message.state = reader.string();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: EndSessionRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string issuer_handle = 1; */
+        if (message.issuerHandle !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.issuerHandle);
+        /* optional string id_token_hint = 2; */
+        if (message.idTokenHint !== undefined)
+            writer.tag(2, WireType.LengthDelimited).string(message.idTokenHint);
+        /* optional string client_id = 3; */
+        if (message.clientId !== undefined)
+            writer.tag(3, WireType.LengthDelimited).string(message.clientId);
+        /* optional string post_logout_redirect_uri = 4; */
+        if (message.postLogoutRedirectUri !== undefined)
+            writer.tag(4, WireType.LengthDelimited).string(message.postLogoutRedirectUri);
+        /* optional string state = 5; */
+        if (message.state !== undefined)
+            writer.tag(5, WireType.LengthDelimited).string(message.state);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.authn.EndSessionRequest
+ */
+export const EndSessionRequest = new EndSessionRequest$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class ProtocolRequest$Type extends MessageType<ProtocolRequest> {
+    constructor() {
+        super("sid.v1.authn.ProtocolRequest", [
+            { no: 1, name: "issuer_handle", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "body", kind: "message", T: () => HttpBody }
+        ]);
+    }
+    create(value?: PartialMessage<ProtocolRequest>): ProtocolRequest {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.issuerHandle = "";
+        if (value !== undefined)
+            reflectionMergePartial<ProtocolRequest>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ProtocolRequest): ProtocolRequest {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string issuer_handle */ 1:
+                    message.issuerHandle = reader.string();
+                    break;
+                case /* google.api.HttpBody body */ 2:
+                    message.body = HttpBody.internalBinaryRead(reader, reader.uint32(), options, message.body);
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: ProtocolRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string issuer_handle = 1; */
+        if (message.issuerHandle !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.issuerHandle);
+        /* google.api.HttpBody body = 2; */
+        if (message.body)
+            HttpBody.internalBinaryWrite(message.body, writer.tag(2, WireType.LengthDelimited).fork(), options).join();
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.authn.ProtocolRequest
+ */
+export const ProtocolRequest = new ProtocolRequest$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class UserInfo$Type extends MessageType<UserInfo> {
+    constructor() {
+        super("sid.v1.authn.UserInfo", [
+            { no: 1, name: "sub", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "name", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "given_name", kind: "scalar", jsonName: "given_name", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 4, name: "family_name", kind: "scalar", jsonName: "family_name", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 5, name: "middle_name", kind: "scalar", jsonName: "middle_name", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 6, name: "preferred_username", kind: "scalar", jsonName: "preferred_username", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 7, name: "updated_at", kind: "scalar", jsonName: "updated_at", opt: true, T: 13 /*ScalarType.UINT32*/ },
+            { no: 8, name: "email", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 9, name: "email_verified", kind: "scalar", jsonName: "email_verified", opt: true, T: 8 /*ScalarType.BOOL*/ },
+            { no: 10, name: "phone_number", kind: "scalar", jsonName: "phone_number", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 11, name: "phone_number_verified", kind: "scalar", jsonName: "phone_number_verified", opt: true, T: 8 /*ScalarType.BOOL*/ }
+        ]);
+    }
+    create(value?: PartialMessage<UserInfo>): UserInfo {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.sub = "";
+        if (value !== undefined)
+            reflectionMergePartial<UserInfo>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: UserInfo): UserInfo {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string sub */ 1:
+                    message.sub = reader.string();
+                    break;
+                case /* optional string name */ 2:
+                    message.name = reader.string();
+                    break;
+                case /* optional string given_name = 3 [json_name = "given_name"] */ 3:
+                    message.givenName = reader.string();
+                    break;
+                case /* optional string family_name = 4 [json_name = "family_name"] */ 4:
+                    message.familyName = reader.string();
+                    break;
+                case /* optional string middle_name = 5 [json_name = "middle_name"] */ 5:
+                    message.middleName = reader.string();
+                    break;
+                case /* optional string preferred_username = 6 [json_name = "preferred_username"] */ 6:
+                    message.preferredUsername = reader.string();
+                    break;
+                case /* optional uint32 updated_at = 7 [json_name = "updated_at"] */ 7:
+                    message.updatedAt = reader.uint32();
+                    break;
+                case /* optional string email */ 8:
+                    message.email = reader.string();
+                    break;
+                case /* optional bool email_verified = 9 [json_name = "email_verified"] */ 9:
+                    message.emailVerified = reader.bool();
+                    break;
+                case /* optional string phone_number = 10 [json_name = "phone_number"] */ 10:
+                    message.phoneNumber = reader.string();
+                    break;
+                case /* optional bool phone_number_verified = 11 [json_name = "phone_number_verified"] */ 11:
+                    message.phoneNumberVerified = reader.bool();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: UserInfo, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string sub = 1; */
+        if (message.sub !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.sub);
+        /* optional string name = 2; */
+        if (message.name !== undefined)
+            writer.tag(2, WireType.LengthDelimited).string(message.name);
+        /* optional string given_name = 3 [json_name = "given_name"]; */
+        if (message.givenName !== undefined)
+            writer.tag(3, WireType.LengthDelimited).string(message.givenName);
+        /* optional string family_name = 4 [json_name = "family_name"]; */
+        if (message.familyName !== undefined)
+            writer.tag(4, WireType.LengthDelimited).string(message.familyName);
+        /* optional string middle_name = 5 [json_name = "middle_name"]; */
+        if (message.middleName !== undefined)
+            writer.tag(5, WireType.LengthDelimited).string(message.middleName);
+        /* optional string preferred_username = 6 [json_name = "preferred_username"]; */
+        if (message.preferredUsername !== undefined)
+            writer.tag(6, WireType.LengthDelimited).string(message.preferredUsername);
+        /* optional uint32 updated_at = 7 [json_name = "updated_at"]; */
+        if (message.updatedAt !== undefined)
+            writer.tag(7, WireType.Varint).uint32(message.updatedAt);
+        /* optional string email = 8; */
+        if (message.email !== undefined)
+            writer.tag(8, WireType.LengthDelimited).string(message.email);
+        /* optional bool email_verified = 9 [json_name = "email_verified"]; */
+        if (message.emailVerified !== undefined)
+            writer.tag(9, WireType.Varint).bool(message.emailVerified);
+        /* optional string phone_number = 10 [json_name = "phone_number"]; */
+        if (message.phoneNumber !== undefined)
+            writer.tag(10, WireType.LengthDelimited).string(message.phoneNumber);
+        /* optional bool phone_number_verified = 11 [json_name = "phone_number_verified"]; */
+        if (message.phoneNumberVerified !== undefined)
+            writer.tag(11, WireType.Varint).bool(message.phoneNumberVerified);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.authn.UserInfo
+ */
+export const UserInfo = new UserInfo$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class IssuerHandleRequest$Type extends MessageType<IssuerHandleRequest> {
+    constructor() {
+        super("sid.v1.authn.IssuerHandleRequest", [
+            { no: 1, name: "issuer_handle", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<IssuerHandleRequest>): IssuerHandleRequest {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.issuerHandle = "";
+        if (value !== undefined)
+            reflectionMergePartial<IssuerHandleRequest>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: IssuerHandleRequest): IssuerHandleRequest {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string issuer_handle */ 1:
+                    message.issuerHandle = reader.string();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: IssuerHandleRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string issuer_handle = 1; */
+        if (message.issuerHandle !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.issuerHandle);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.authn.IssuerHandleRequest
+ */
+export const IssuerHandleRequest = new IssuerHandleRequest$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class ProviderMetadata$Type extends MessageType<ProviderMetadata> {
+    constructor() {
+        super("sid.v1.authn.ProviderMetadata", [
+            { no: 1, name: "issuer", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "authorization_endpoint", kind: "scalar", jsonName: "authorization_endpoint", T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "token_endpoint", kind: "scalar", jsonName: "token_endpoint", T: 9 /*ScalarType.STRING*/ },
+            { no: 4, name: "userinfo_endpoint", kind: "scalar", jsonName: "userinfo_endpoint", T: 9 /*ScalarType.STRING*/ },
+            { no: 5, name: "jwks_uri", kind: "scalar", jsonName: "jwks_uri", T: 9 /*ScalarType.STRING*/ },
+            { no: 6, name: "end_session_endpoint", kind: "scalar", jsonName: "end_session_endpoint", T: 9 /*ScalarType.STRING*/ },
+            { no: 7, name: "introspection_endpoint", kind: "scalar", jsonName: "introspection_endpoint", T: 9 /*ScalarType.STRING*/ },
+            { no: 8, name: "revocation_endpoint", kind: "scalar", jsonName: "revocation_endpoint", T: 9 /*ScalarType.STRING*/ },
+            { no: 9, name: "device_authorization_endpoint", kind: "scalar", jsonName: "device_authorization_endpoint", T: 9 /*ScalarType.STRING*/ },
+            { no: 10, name: "response_types_supported", kind: "scalar", jsonName: "response_types_supported", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
+            { no: 11, name: "grant_types_supported", kind: "scalar", jsonName: "grant_types_supported", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
+            { no: 12, name: "subject_types_supported", kind: "scalar", jsonName: "subject_types_supported", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
+            { no: 13, name: "id_token_signing_alg_values_supported", kind: "scalar", jsonName: "id_token_signing_alg_values_supported", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
+            { no: 14, name: "scopes_supported", kind: "scalar", jsonName: "scopes_supported", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
+            { no: 15, name: "token_endpoint_auth_methods_supported", kind: "scalar", jsonName: "token_endpoint_auth_methods_supported", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
+            { no: 16, name: "code_challenge_methods_supported", kind: "scalar", jsonName: "code_challenge_methods_supported", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
+            { no: 17, name: "dpop_signing_alg_values_supported", kind: "scalar", jsonName: "dpop_signing_alg_values_supported", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
+            { no: 18, name: "backchannel_logout_supported", kind: "scalar", jsonName: "backchannel_logout_supported", T: 8 /*ScalarType.BOOL*/ },
+            { no: 19, name: "backchannel_logout_session_supported", kind: "scalar", jsonName: "backchannel_logout_session_supported", T: 8 /*ScalarType.BOOL*/ },
+            { no: 20, name: "authorization_response_iss_parameter_supported", kind: "scalar", jsonName: "authorization_response_iss_parameter_supported", T: 8 /*ScalarType.BOOL*/ },
+            { no: 21, name: "registration_endpoint", kind: "scalar", jsonName: "registration_endpoint", T: 9 /*ScalarType.STRING*/ },
+            { no: 22, name: "token_endpoint_auth_signing_alg_values_supported", kind: "scalar", jsonName: "token_endpoint_auth_signing_alg_values_supported", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
+            { no: 23, name: "revocation_endpoint_auth_methods_supported", kind: "scalar", jsonName: "revocation_endpoint_auth_methods_supported", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
+            { no: 24, name: "revocation_endpoint_auth_signing_alg_values_supported", kind: "scalar", jsonName: "revocation_endpoint_auth_signing_alg_values_supported", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
+            { no: 25, name: "introspection_endpoint_auth_methods_supported", kind: "scalar", jsonName: "introspection_endpoint_auth_methods_supported", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
+            { no: 26, name: "introspection_endpoint_auth_signing_alg_values_supported", kind: "scalar", jsonName: "introspection_endpoint_auth_signing_alg_values_supported", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<ProviderMetadata>): ProviderMetadata {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.issuer = "";
+        message.authorizationEndpoint = "";
+        message.tokenEndpoint = "";
+        message.userinfoEndpoint = "";
+        message.jwksUri = "";
+        message.endSessionEndpoint = "";
+        message.introspectionEndpoint = "";
+        message.revocationEndpoint = "";
+        message.deviceAuthorizationEndpoint = "";
+        message.responseTypesSupported = [];
+        message.grantTypesSupported = [];
+        message.subjectTypesSupported = [];
+        message.idTokenSigningAlgValuesSupported = [];
+        message.scopesSupported = [];
+        message.tokenEndpointAuthMethodsSupported = [];
+        message.codeChallengeMethodsSupported = [];
+        message.dpopSigningAlgValuesSupported = [];
+        message.backchannelLogoutSupported = false;
+        message.backchannelLogoutSessionSupported = false;
+        message.authorizationResponseIssParameterSupported = false;
+        message.registrationEndpoint = "";
+        message.tokenEndpointAuthSigningAlgValuesSupported = [];
+        message.revocationEndpointAuthMethodsSupported = [];
+        message.revocationEndpointAuthSigningAlgValuesSupported = [];
+        message.introspectionEndpointAuthMethodsSupported = [];
+        message.introspectionEndpointAuthSigningAlgValuesSupported = [];
+        if (value !== undefined)
+            reflectionMergePartial<ProviderMetadata>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ProviderMetadata): ProviderMetadata {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string issuer */ 1:
+                    message.issuer = reader.string();
+                    break;
+                case /* string authorization_endpoint = 2 [json_name = "authorization_endpoint"] */ 2:
+                    message.authorizationEndpoint = reader.string();
+                    break;
+                case /* string token_endpoint = 3 [json_name = "token_endpoint"] */ 3:
+                    message.tokenEndpoint = reader.string();
+                    break;
+                case /* string userinfo_endpoint = 4 [json_name = "userinfo_endpoint"] */ 4:
+                    message.userinfoEndpoint = reader.string();
+                    break;
+                case /* string jwks_uri = 5 [json_name = "jwks_uri"] */ 5:
+                    message.jwksUri = reader.string();
+                    break;
+                case /* string end_session_endpoint = 6 [json_name = "end_session_endpoint"] */ 6:
+                    message.endSessionEndpoint = reader.string();
+                    break;
+                case /* string introspection_endpoint = 7 [json_name = "introspection_endpoint"] */ 7:
+                    message.introspectionEndpoint = reader.string();
+                    break;
+                case /* string revocation_endpoint = 8 [json_name = "revocation_endpoint"] */ 8:
+                    message.revocationEndpoint = reader.string();
+                    break;
+                case /* string device_authorization_endpoint = 9 [json_name = "device_authorization_endpoint"] */ 9:
+                    message.deviceAuthorizationEndpoint = reader.string();
+                    break;
+                case /* repeated string response_types_supported = 10 [json_name = "response_types_supported"] */ 10:
+                    message.responseTypesSupported.push(reader.string());
+                    break;
+                case /* repeated string grant_types_supported = 11 [json_name = "grant_types_supported"] */ 11:
+                    message.grantTypesSupported.push(reader.string());
+                    break;
+                case /* repeated string subject_types_supported = 12 [json_name = "subject_types_supported"] */ 12:
+                    message.subjectTypesSupported.push(reader.string());
+                    break;
+                case /* repeated string id_token_signing_alg_values_supported = 13 [json_name = "id_token_signing_alg_values_supported"] */ 13:
+                    message.idTokenSigningAlgValuesSupported.push(reader.string());
+                    break;
+                case /* repeated string scopes_supported = 14 [json_name = "scopes_supported"] */ 14:
+                    message.scopesSupported.push(reader.string());
+                    break;
+                case /* repeated string token_endpoint_auth_methods_supported = 15 [json_name = "token_endpoint_auth_methods_supported"] */ 15:
+                    message.tokenEndpointAuthMethodsSupported.push(reader.string());
+                    break;
+                case /* repeated string code_challenge_methods_supported = 16 [json_name = "code_challenge_methods_supported"] */ 16:
+                    message.codeChallengeMethodsSupported.push(reader.string());
+                    break;
+                case /* repeated string dpop_signing_alg_values_supported = 17 [json_name = "dpop_signing_alg_values_supported"] */ 17:
+                    message.dpopSigningAlgValuesSupported.push(reader.string());
+                    break;
+                case /* bool backchannel_logout_supported = 18 [json_name = "backchannel_logout_supported"] */ 18:
+                    message.backchannelLogoutSupported = reader.bool();
+                    break;
+                case /* bool backchannel_logout_session_supported = 19 [json_name = "backchannel_logout_session_supported"] */ 19:
+                    message.backchannelLogoutSessionSupported = reader.bool();
+                    break;
+                case /* bool authorization_response_iss_parameter_supported = 20 [json_name = "authorization_response_iss_parameter_supported"] */ 20:
+                    message.authorizationResponseIssParameterSupported = reader.bool();
+                    break;
+                case /* string registration_endpoint = 21 [json_name = "registration_endpoint"] */ 21:
+                    message.registrationEndpoint = reader.string();
+                    break;
+                case /* repeated string token_endpoint_auth_signing_alg_values_supported = 22 [json_name = "token_endpoint_auth_signing_alg_values_supported"] */ 22:
+                    message.tokenEndpointAuthSigningAlgValuesSupported.push(reader.string());
+                    break;
+                case /* repeated string revocation_endpoint_auth_methods_supported = 23 [json_name = "revocation_endpoint_auth_methods_supported"] */ 23:
+                    message.revocationEndpointAuthMethodsSupported.push(reader.string());
+                    break;
+                case /* repeated string revocation_endpoint_auth_signing_alg_values_supported = 24 [json_name = "revocation_endpoint_auth_signing_alg_values_supported"] */ 24:
+                    message.revocationEndpointAuthSigningAlgValuesSupported.push(reader.string());
+                    break;
+                case /* repeated string introspection_endpoint_auth_methods_supported = 25 [json_name = "introspection_endpoint_auth_methods_supported"] */ 25:
+                    message.introspectionEndpointAuthMethodsSupported.push(reader.string());
+                    break;
+                case /* repeated string introspection_endpoint_auth_signing_alg_values_supported = 26 [json_name = "introspection_endpoint_auth_signing_alg_values_supported"] */ 26:
+                    message.introspectionEndpointAuthSigningAlgValuesSupported.push(reader.string());
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: ProviderMetadata, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string issuer = 1; */
+        if (message.issuer !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.issuer);
+        /* string authorization_endpoint = 2 [json_name = "authorization_endpoint"]; */
+        if (message.authorizationEndpoint !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.authorizationEndpoint);
+        /* string token_endpoint = 3 [json_name = "token_endpoint"]; */
+        if (message.tokenEndpoint !== "")
+            writer.tag(3, WireType.LengthDelimited).string(message.tokenEndpoint);
+        /* string userinfo_endpoint = 4 [json_name = "userinfo_endpoint"]; */
+        if (message.userinfoEndpoint !== "")
+            writer.tag(4, WireType.LengthDelimited).string(message.userinfoEndpoint);
+        /* string jwks_uri = 5 [json_name = "jwks_uri"]; */
+        if (message.jwksUri !== "")
+            writer.tag(5, WireType.LengthDelimited).string(message.jwksUri);
+        /* string end_session_endpoint = 6 [json_name = "end_session_endpoint"]; */
+        if (message.endSessionEndpoint !== "")
+            writer.tag(6, WireType.LengthDelimited).string(message.endSessionEndpoint);
+        /* string introspection_endpoint = 7 [json_name = "introspection_endpoint"]; */
+        if (message.introspectionEndpoint !== "")
+            writer.tag(7, WireType.LengthDelimited).string(message.introspectionEndpoint);
+        /* string revocation_endpoint = 8 [json_name = "revocation_endpoint"]; */
+        if (message.revocationEndpoint !== "")
+            writer.tag(8, WireType.LengthDelimited).string(message.revocationEndpoint);
+        /* string device_authorization_endpoint = 9 [json_name = "device_authorization_endpoint"]; */
+        if (message.deviceAuthorizationEndpoint !== "")
+            writer.tag(9, WireType.LengthDelimited).string(message.deviceAuthorizationEndpoint);
+        /* repeated string response_types_supported = 10 [json_name = "response_types_supported"]; */
+        for (let i = 0; i < message.responseTypesSupported.length; i++)
+            writer.tag(10, WireType.LengthDelimited).string(message.responseTypesSupported[i]);
+        /* repeated string grant_types_supported = 11 [json_name = "grant_types_supported"]; */
+        for (let i = 0; i < message.grantTypesSupported.length; i++)
+            writer.tag(11, WireType.LengthDelimited).string(message.grantTypesSupported[i]);
+        /* repeated string subject_types_supported = 12 [json_name = "subject_types_supported"]; */
+        for (let i = 0; i < message.subjectTypesSupported.length; i++)
+            writer.tag(12, WireType.LengthDelimited).string(message.subjectTypesSupported[i]);
+        /* repeated string id_token_signing_alg_values_supported = 13 [json_name = "id_token_signing_alg_values_supported"]; */
+        for (let i = 0; i < message.idTokenSigningAlgValuesSupported.length; i++)
+            writer.tag(13, WireType.LengthDelimited).string(message.idTokenSigningAlgValuesSupported[i]);
+        /* repeated string scopes_supported = 14 [json_name = "scopes_supported"]; */
+        for (let i = 0; i < message.scopesSupported.length; i++)
+            writer.tag(14, WireType.LengthDelimited).string(message.scopesSupported[i]);
+        /* repeated string token_endpoint_auth_methods_supported = 15 [json_name = "token_endpoint_auth_methods_supported"]; */
+        for (let i = 0; i < message.tokenEndpointAuthMethodsSupported.length; i++)
+            writer.tag(15, WireType.LengthDelimited).string(message.tokenEndpointAuthMethodsSupported[i]);
+        /* repeated string code_challenge_methods_supported = 16 [json_name = "code_challenge_methods_supported"]; */
+        for (let i = 0; i < message.codeChallengeMethodsSupported.length; i++)
+            writer.tag(16, WireType.LengthDelimited).string(message.codeChallengeMethodsSupported[i]);
+        /* repeated string dpop_signing_alg_values_supported = 17 [json_name = "dpop_signing_alg_values_supported"]; */
+        for (let i = 0; i < message.dpopSigningAlgValuesSupported.length; i++)
+            writer.tag(17, WireType.LengthDelimited).string(message.dpopSigningAlgValuesSupported[i]);
+        /* bool backchannel_logout_supported = 18 [json_name = "backchannel_logout_supported"]; */
+        if (message.backchannelLogoutSupported !== false)
+            writer.tag(18, WireType.Varint).bool(message.backchannelLogoutSupported);
+        /* bool backchannel_logout_session_supported = 19 [json_name = "backchannel_logout_session_supported"]; */
+        if (message.backchannelLogoutSessionSupported !== false)
+            writer.tag(19, WireType.Varint).bool(message.backchannelLogoutSessionSupported);
+        /* bool authorization_response_iss_parameter_supported = 20 [json_name = "authorization_response_iss_parameter_supported"]; */
+        if (message.authorizationResponseIssParameterSupported !== false)
+            writer.tag(20, WireType.Varint).bool(message.authorizationResponseIssParameterSupported);
+        /* string registration_endpoint = 21 [json_name = "registration_endpoint"]; */
+        if (message.registrationEndpoint !== "")
+            writer.tag(21, WireType.LengthDelimited).string(message.registrationEndpoint);
+        /* repeated string token_endpoint_auth_signing_alg_values_supported = 22 [json_name = "token_endpoint_auth_signing_alg_values_supported"]; */
+        for (let i = 0; i < message.tokenEndpointAuthSigningAlgValuesSupported.length; i++)
+            writer.tag(22, WireType.LengthDelimited).string(message.tokenEndpointAuthSigningAlgValuesSupported[i]);
+        /* repeated string revocation_endpoint_auth_methods_supported = 23 [json_name = "revocation_endpoint_auth_methods_supported"]; */
+        for (let i = 0; i < message.revocationEndpointAuthMethodsSupported.length; i++)
+            writer.tag(23, WireType.LengthDelimited).string(message.revocationEndpointAuthMethodsSupported[i]);
+        /* repeated string revocation_endpoint_auth_signing_alg_values_supported = 24 [json_name = "revocation_endpoint_auth_signing_alg_values_supported"]; */
+        for (let i = 0; i < message.revocationEndpointAuthSigningAlgValuesSupported.length; i++)
+            writer.tag(24, WireType.LengthDelimited).string(message.revocationEndpointAuthSigningAlgValuesSupported[i]);
+        /* repeated string introspection_endpoint_auth_methods_supported = 25 [json_name = "introspection_endpoint_auth_methods_supported"]; */
+        for (let i = 0; i < message.introspectionEndpointAuthMethodsSupported.length; i++)
+            writer.tag(25, WireType.LengthDelimited).string(message.introspectionEndpointAuthMethodsSupported[i]);
+        /* repeated string introspection_endpoint_auth_signing_alg_values_supported = 26 [json_name = "introspection_endpoint_auth_signing_alg_values_supported"]; */
+        for (let i = 0; i < message.introspectionEndpointAuthSigningAlgValuesSupported.length; i++)
+            writer.tag(26, WireType.LengthDelimited).string(message.introspectionEndpointAuthSigningAlgValuesSupported[i]);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.authn.ProviderMetadata
+ */
+export const ProviderMetadata = new ProviderMetadata$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class JsonWebKeySet$Type extends MessageType<JsonWebKeySet> {
+    constructor() {
+        super("sid.v1.authn.JsonWebKeySet", [
+            { no: 1, name: "keys", kind: "message", repeat: 2 /*RepeatType.UNPACKED*/, T: () => JsonWebKey }
+        ]);
+    }
+    create(value?: PartialMessage<JsonWebKeySet>): JsonWebKeySet {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.keys = [];
+        if (value !== undefined)
+            reflectionMergePartial<JsonWebKeySet>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: JsonWebKeySet): JsonWebKeySet {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* repeated sid.v1.authn.JsonWebKey keys */ 1:
+                    message.keys.push(JsonWebKey.internalBinaryRead(reader, reader.uint32(), options));
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: JsonWebKeySet, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* repeated sid.v1.authn.JsonWebKey keys = 1; */
+        for (let i = 0; i < message.keys.length; i++)
+            JsonWebKey.internalBinaryWrite(message.keys[i], writer.tag(1, WireType.LengthDelimited).fork(), options).join();
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.authn.JsonWebKeySet
+ */
+export const JsonWebKeySet = new JsonWebKeySet$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class JsonWebKey$Type extends MessageType<JsonWebKey> {
+    constructor() {
+        super("sid.v1.authn.JsonWebKey", [
+            { no: 1, name: "kty", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "use", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "alg", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 4, name: "kid", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 5, name: "crv", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 6, name: "x", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<JsonWebKey>): JsonWebKey {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.kty = "";
+        message.use = "";
+        message.alg = "";
+        message.kid = "";
+        message.crv = "";
+        message.x = "";
+        if (value !== undefined)
+            reflectionMergePartial<JsonWebKey>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: JsonWebKey): JsonWebKey {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string kty */ 1:
+                    message.kty = reader.string();
+                    break;
+                case /* string use */ 2:
+                    message.use = reader.string();
+                    break;
+                case /* string alg */ 3:
+                    message.alg = reader.string();
+                    break;
+                case /* string kid */ 4:
+                    message.kid = reader.string();
+                    break;
+                case /* string crv */ 5:
+                    message.crv = reader.string();
+                    break;
+                case /* string x */ 6:
+                    message.x = reader.string();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: JsonWebKey, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string kty = 1; */
+        if (message.kty !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.kty);
+        /* string use = 2; */
+        if (message.use !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.use);
+        /* string alg = 3; */
+        if (message.alg !== "")
+            writer.tag(3, WireType.LengthDelimited).string(message.alg);
+        /* string kid = 4; */
+        if (message.kid !== "")
+            writer.tag(4, WireType.LengthDelimited).string(message.kid);
+        /* string crv = 5; */
+        if (message.crv !== "")
+            writer.tag(5, WireType.LengthDelimited).string(message.crv);
+        /* string x = 6; */
+        if (message.x !== "")
+            writer.tag(6, WireType.LengthDelimited).string(message.x);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.authn.JsonWebKey
+ */
+export const JsonWebKey = new JsonWebKey$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class GetOidcIssuerRequest$Type extends MessageType<GetOidcIssuerRequest> {
+    constructor() {
+        super("sid.v1.authn.GetOidcIssuerRequest", [
+            { no: 1, name: "handle", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<GetOidcIssuerRequest>): GetOidcIssuerRequest {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.handle = "";
+        if (value !== undefined)
+            reflectionMergePartial<GetOidcIssuerRequest>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetOidcIssuerRequest): GetOidcIssuerRequest {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string handle */ 1:
+                    message.handle = reader.string();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: GetOidcIssuerRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string handle = 1; */
+        if (message.handle !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.handle);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.authn.GetOidcIssuerRequest
+ */
+export const GetOidcIssuerRequest = new GetOidcIssuerRequest$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class OidcIssuer$Type extends MessageType<OidcIssuer> {
+    constructor() {
+        super("sid.v1.authn.OidcIssuer", [
+            { no: 1, name: "issuer", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "keys", kind: "message", repeat: 2 /*RepeatType.UNPACKED*/, T: () => IssuerPublicKey }
+        ]);
+    }
+    create(value?: PartialMessage<OidcIssuer>): OidcIssuer {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.issuer = "";
+        message.keys = [];
+        if (value !== undefined)
+            reflectionMergePartial<OidcIssuer>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: OidcIssuer): OidcIssuer {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string issuer */ 1:
+                    message.issuer = reader.string();
+                    break;
+                case /* repeated sid.v1.authn.IssuerPublicKey keys */ 2:
+                    message.keys.push(IssuerPublicKey.internalBinaryRead(reader, reader.uint32(), options));
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: OidcIssuer, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string issuer = 1; */
+        if (message.issuer !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.issuer);
+        /* repeated sid.v1.authn.IssuerPublicKey keys = 2; */
+        for (let i = 0; i < message.keys.length; i++)
+            IssuerPublicKey.internalBinaryWrite(message.keys[i], writer.tag(2, WireType.LengthDelimited).fork(), options).join();
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.authn.OidcIssuer
+ */
+export const OidcIssuer = new OidcIssuer$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class GetProtectedResourceRequest$Type extends MessageType<GetProtectedResourceRequest> {
+    constructor() {
+        super("sid.v1.authn.GetProtectedResourceRequest", [
+            { no: 1, name: "issuer_handle", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "resource", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<GetProtectedResourceRequest>): GetProtectedResourceRequest {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.issuerHandle = "";
+        message.resource = "";
+        if (value !== undefined)
+            reflectionMergePartial<GetProtectedResourceRequest>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetProtectedResourceRequest): GetProtectedResourceRequest {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string issuer_handle */ 1:
+                    message.issuerHandle = reader.string();
+                    break;
+                case /* string resource */ 2:
+                    message.resource = reader.string();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: GetProtectedResourceRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string issuer_handle = 1; */
+        if (message.issuerHandle !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.issuerHandle);
+        /* string resource = 2; */
+        if (message.resource !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.resource);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.authn.GetProtectedResourceRequest
+ */
+export const GetProtectedResourceRequest = new GetProtectedResourceRequest$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class ProtectedResourceTarget$Type extends MessageType<ProtectedResourceTarget> {
+    constructor() {
+        super("sid.v1.authn.ProtectedResourceTarget", [
+            { no: 1, name: "issuer", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "resource", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "active", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
+            { no: 4, name: "id", kind: "message", T: () => ResourceId }
+        ]);
+    }
+    create(value?: PartialMessage<ProtectedResourceTarget>): ProtectedResourceTarget {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.issuer = "";
+        message.resource = "";
+        message.active = false;
+        if (value !== undefined)
+            reflectionMergePartial<ProtectedResourceTarget>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ProtectedResourceTarget): ProtectedResourceTarget {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string issuer */ 1:
+                    message.issuer = reader.string();
+                    break;
+                case /* string resource */ 2:
+                    message.resource = reader.string();
+                    break;
+                case /* bool active */ 3:
+                    message.active = reader.bool();
+                    break;
+                case /* sid.v1.ids.ResourceId id */ 4:
+                    message.id = ResourceId.internalBinaryRead(reader, reader.uint32(), options, message.id);
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: ProtectedResourceTarget, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string issuer = 1; */
+        if (message.issuer !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.issuer);
+        /* string resource = 2; */
+        if (message.resource !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.resource);
+        /* bool active = 3; */
+        if (message.active !== false)
+            writer.tag(3, WireType.Varint).bool(message.active);
+        /* sid.v1.ids.ResourceId id = 4; */
+        if (message.id)
+            ResourceId.internalBinaryWrite(message.id, writer.tag(4, WireType.LengthDelimited).fork(), options).join();
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.authn.ProtectedResourceTarget
+ */
+export const ProtectedResourceTarget = new ProtectedResourceTarget$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class IssuerPublicKey$Type extends MessageType<IssuerPublicKey> {
+    constructor() {
+        super("sid.v1.authn.IssuerPublicKey", [
+            { no: 1, name: "key_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "public_key", kind: "scalar", T: 12 /*ScalarType.BYTES*/ }
+        ]);
+    }
+    create(value?: PartialMessage<IssuerPublicKey>): IssuerPublicKey {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.keyId = "";
+        message.publicKey = new Uint8Array(0);
+        if (value !== undefined)
+            reflectionMergePartial<IssuerPublicKey>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: IssuerPublicKey): IssuerPublicKey {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string key_id */ 1:
+                    message.keyId = reader.string();
+                    break;
+                case /* bytes public_key */ 2:
+                    message.publicKey = reader.bytes();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: IssuerPublicKey, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string key_id = 1; */
+        if (message.keyId !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.keyId);
+        /* bytes public_key = 2; */
+        if (message.publicKey.length)
+            writer.tag(2, WireType.LengthDelimited).bytes(message.publicKey);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.authn.IssuerPublicKey
+ */
+export const IssuerPublicKey = new IssuerPublicKey$Type();
+/**
+ * @generated ServiceType for protobuf service sid.v1.authn.OidcProviderService
+ */
+export const OidcProviderService = new ServiceType("sid.v1.authn.OidcProviderService", [
+    { name: "GetProviderMetadata", options: { "google.api.http": { get: "/i/{issuer_handle}/.well-known/openid-configuration", additionalBindings: [{ get: "/.well-known/oauth-authorization-server/i/{issuer_handle}" }] } }, I: IssuerHandleRequest, O: ProviderMetadata },
+    { name: "GetJwks", options: { "google.api.http": { get: "/i/{issuer_handle}/jwks" } }, I: IssuerHandleRequest, O: JsonWebKeySet },
+    { name: "GetUserInfo", options: { "google.api.http": { get: "/i/{issuer_handle}/userinfo" } }, I: IssuerHandleRequest, O: UserInfo },
+    { name: "PostUserInfo", options: { "google.api.http": { post: "/i/{issuer_handle}/userinfo", body: "*" } }, I: IssuerHandleRequest, O: UserInfo },
+    { name: "GetAuthorize", options: { "google.api.http": { get: "/i/{issuer_handle}/oauth2/authorize" } }, I: OAuth2AuthorizeRequest, O: HttpBody },
+    { name: "PostAuthorize", options: { "google.api.http": { post: "/i/{issuer_handle}/oauth2/authorize", body: "body" } }, I: ProtocolRequest, O: HttpBody },
+    { name: "GetEndSession", options: { "google.api.http": { get: "/i/{issuer_handle}/oauth2/end-session" } }, I: EndSessionRequest, O: HttpBody },
+    { name: "PostEndSession", options: { "google.api.http": { post: "/i/{issuer_handle}/oauth2/end-session", body: "body" } }, I: ProtocolRequest, O: HttpBody },
+    { name: "Token", options: { "google.api.http": { post: "/i/{issuer_handle}/oauth2/token", body: "body" } }, I: ProtocolRequest, O: HttpBody },
+    { name: "Introspect", options: { "google.api.http": { post: "/i/{issuer_handle}/oauth2/introspect", body: "body" } }, I: ProtocolRequest, O: HttpBody },
+    { name: "Revoke", options: { "google.api.http": { post: "/i/{issuer_handle}/oauth2/revoke", body: "body" } }, I: ProtocolRequest, O: HttpBody },
+    { name: "DeviceAuthorization", options: { "google.api.http": { post: "/i/{issuer_handle}/oauth2/device", body: "body" } }, I: ProtocolRequest, O: HttpBody },
+    { name: "Register", options: { "google.api.http": { post: "/i/{issuer_handle}/oauth2/register", body: "body" } }, I: ProtocolRequest, O: HttpBody },
+    { name: "ReadRegistration", options: { "google.api.http": { get: "/i/{issuer_handle}/oauth2/register/{client_id}" } }, I: RegistrationRequest, O: HttpBody },
+    { name: "UpdateRegistration", options: { "google.api.http": { put: "/i/{issuer_handle}/oauth2/register/{client_id}", body: "body" } }, I: RegistrationRequest, O: HttpBody },
+    { name: "DeleteRegistration", options: { "google.api.http": { delete: "/i/{issuer_handle}/oauth2/register/{client_id}" } }, I: RegistrationRequest, O: HttpBody }
+]);
+/**
+ * @generated ServiceType for protobuf service sid.v1.authn.OidcIssuerService
+ */
+export const OidcIssuerService = new ServiceType("sid.v1.authn.OidcIssuerService", [
+    { name: "GetOidcIssuer", options: {}, I: GetOidcIssuerRequest, O: OidcIssuer },
+    { name: "GetProtectedResource", options: {}, I: GetProtectedResourceRequest, O: ProtectedResourceTarget }
+]);