@structured-id/ui-core 1.3.0 → 3.0.0

package/src/generated/sid/v1/authn/issuer.client.ts

@@ -1,489 +0,0 @@
-// @generated by protobuf-ts 2.11.1 with parameter client_generic,generate_dependencies
-// @generated from protobuf file "sid/v1/authn/issuer.proto" (package "sid.v1.authn", syntax proto3)
-// tslint:disable
-import { OidcIssuerService } from "./issuer";
-import type { ProtectedResourceTarget } from "./issuer";
-import type { GetProtectedResourceRequest } from "./issuer";
-import type { OidcIssuer } from "./issuer";
-import type { GetOidcIssuerRequest } from "./issuer";
-import type { RpcTransport } from "@protobuf-ts/runtime-rpc";
-import type { ServiceInfo } from "@protobuf-ts/runtime-rpc";
-import { OidcProviderService } from "./issuer";
-import type { RegistrationRequest } from "./issuer";
-import type { EndSessionRequest } from "./issuer";
-import type { ProtocolRequest } from "./issuer";
-import type { HttpBody } from "../../../google/api/httpbody";
-import type { OAuth2AuthorizeRequest } from "./auth";
-import type { UserInfo } from "./issuer";
-import type { JsonWebKeySet } from "./issuer";
-import { stackIntercept } from "@protobuf-ts/runtime-rpc";
-import type { ProviderMetadata } from "./issuer";
-import type { IssuerHandleRequest } from "./issuer";
-import type { UnaryCall } from "@protobuf-ts/runtime-rpc";
-import type { RpcOptions } from "@protobuf-ts/runtime-rpc";
-/**
- * OidcProviderService publishes one issuer's metadata and signing keys to its
- * relying parties. Every document belongs to the issuer the handle names; an
- * unknown handle is NOT_FOUND with ErrorInfo reason OIDC_ISSUER_NOT_FOUND and
- * never falls back to another issuer. There is no issuer-less document.
- *
- * @generated from protobuf service sid.v1.authn.OidcProviderService
- */
-export interface IOidcProviderServiceClient {
-    /**
-     * The issuer's metadata (OpenID Connect Discovery 1.0 §3–4, RFC 8414 §2–3).
-     * One document answers both discovery algorithms: the OIDC location under
-     * the issuer path and the RFC 8414 well-known location with the issuer path
-     * appended.
-     *
-     * @generated from protobuf rpc: GetProviderMetadata
-     */
-    getProviderMetadata(input: IssuerHandleRequest, options?: RpcOptions): UnaryCall<IssuerHandleRequest, ProviderMetadata>;
-    /**
-     * The issuer's JSON Web Key Set (RFC 7517 §5): the public keys that verify
-     * its tokens. The response metadata carries `cache-control` for HTTP caches.
-     *
-     * @generated from protobuf rpc: GetJwks
-     */
-    getJwks(input: IssuerHandleRequest, options?: RpcOptions): UnaryCall<IssuerHandleRequest, JsonWebKeySet>;
-    /**
-     * UserInfo (OIDC Core 1.0 §5.3) over GET. The access token travels in the
-     * `authorization` metadata, `Bearer` (RFC 6750 §2.1) or `DPoP` with a proof
-     * in the `dpop` metadata (RFC 9449 §7.1); only tokens this issuer signed are
-     * accepted. A refused token is UNAUTHENTICATED with a `www-authenticate`
-     * response metadata challenge (RFC 6750 §3, RFC 9449 §7.1). GET and POST
-     * are separate RPCs because a DPoP proof names the request method.
-     *
-     * @generated from protobuf rpc: GetUserInfo
-     */
-    getUserInfo(input: IssuerHandleRequest, options?: RpcOptions): UnaryCall<IssuerHandleRequest, UserInfo>;
-    /**
-     * UserInfo over POST (OIDC Core 1.0 §5.3.1); the same answer as GetUserInfo.
-     *
-     * @generated from protobuf rpc: PostUserInfo
-     */
-    postUserInfo(input: IssuerHandleRequest, options?: RpcOptions): UnaryCall<IssuerHandleRequest, UserInfo>;
-    /**
-     * The browser authorization endpoint (RFC 6749 §3.1) over GET, the query
-     * parameters bound to the request fields. The answer is an HTTP redirect
-     * (`x-http-code` 303 and `location` response metadata, RFC 9700 §4.11): to
-     * the client's registered redirect URI with `code` or `error`, `state` and
-     * `iss` (RFC 9207 §2), or, when the user must sign in first, to the sign-in
-     * page with this request to return to. A request whose client or exact
-     * redirect URI is not established is answered with a page and never
-     * redirected (RFC 6749 §4.1.2.1). The signed-in user's token, when a
-     * gateway holds one, travels in the `authorization` metadata.
-     *
-     * @generated from protobuf rpc: GetAuthorize
-     */
-    getAuthorize(input: OAuth2AuthorizeRequest, options?: RpcOptions): UnaryCall<OAuth2AuthorizeRequest, HttpBody>;
-    /**
-     * The authorization endpoint over POST with a form body (OIDC Core 1.0
-     * §3.1.2.1); the same answer as GetAuthorize. Parameters it does not know
-     * are ignored (RFC 6749 §3.1).
-     *
-     * @generated from protobuf rpc: PostAuthorize
-     */
-    postAuthorize(input: ProtocolRequest, options?: RpcOptions): UnaryCall<ProtocolRequest, HttpBody>;
-    /**
-     * RP-Initiated Logout (OIDC RP-Initiated Logout 1.0 §2) over GET. The
-     * browser's IdP session is read from its `__Host-sid_session` cookie
-     * (`cookie` metadata). A valid `id_token_hint` of this issuer ends the
-     * application session it names; when that session reuses the browser's
-     * IdP session, single sign-on ends too and the answer clears the cookie.
-     * Otherwise ending the browser's IdP session needs the user's confirmation
-     * (§2): the answer is a page with a form that confirms it by POST. A
-     * `post_logout_redirect_uri` is followed only for a valid `id_token_hint`
-     * whose client registered exactly that URI (§3): the answer is then a 303
-     * to it with `state`, or, while the browser's IdP session remains, the
-     * confirmation page, which returns there after either choice. Otherwise the
-     * answer is a page.
-     *
-     * @generated from protobuf rpc: GetEndSession
-     */
-    getEndSession(input: EndSessionRequest, options?: RpcOptions): UnaryCall<EndSessionRequest, HttpBody>;
-    /**
-     * RP-Initiated Logout over POST with a form body: the same parameters as
-     * GetEndSession, plus `confirmation`, the one-time value of the
-     * confirmation page's form, which ends the browser's IdP session it was
-     * issued for and returns to the post-logout redirect URI that page was
-     * shown for, if any.
-     *
-     * @generated from protobuf rpc: PostEndSession
-     */
-    postEndSession(input: ProtocolRequest, options?: RpcOptions): UnaryCall<ProtocolRequest, HttpBody>;
-    // The endpoints below are the HTTP form of AuthService's OAuth RPCs, with
-    // the same logic: the request body is the `application/x-www-form-urlencoded`
-    // form the RFC defines, the answer is the RFC's JSON with its HTTP status in
-    // the `x-http-code` response metadata and its headers (`cache-control`,
-    // `pragma`, `www-authenticate`) as response metadata. A refusal is an OK
-    // gRPC call carrying the RFC error body; typed gRPC clients use AuthService.
-    // HTTP Basic client authentication travels in the `authorization` metadata,
-    // a DPoP proof in `dpop`.
-
-    /**
-     * Token endpoint (RFC 6749 §3.2): every grant, including the device_code
-     * grant (RFC 8628 §3.4). Success is RFC 6749 §5.1 JSON with
-     * `cache-control: no-store`; a refusal is RFC 6749 §5.2 or RFC 8628 §3.5
-     * JSON, 401 with a `www-authenticate` challenge for `invalid_client` when
-     * the client used HTTP Basic, 400 otherwise.
-     *
-     * @generated from protobuf rpc: Token
-     */
-    token(input: ProtocolRequest, options?: RpcOptions): UnaryCall<ProtocolRequest, HttpBody>;
-    /**
-     * Token introspection (RFC 7662 §2): RFC 7662 §2.2 JSON, `{"active":false}`
-     * for any token this issuer does not vouch for.
-     *
-     * @generated from protobuf rpc: Introspect
-     */
-    introspect(input: ProtocolRequest, options?: RpcOptions): UnaryCall<ProtocolRequest, HttpBody>;
-    /**
-     * Token revocation (RFC 7009 §2): 200 with an empty body, also for a token
-     * that is unknown or already revoked (RFC 7009 §2.2).
-     *
-     * @generated from protobuf rpc: Revoke
-     */
-    revoke(input: ProtocolRequest, options?: RpcOptions): UnaryCall<ProtocolRequest, HttpBody>;
-    /**
-     * Device authorization (RFC 8628 §3.1): RFC 8628 §3.2 JSON; a refusal is
-     * RFC 6749 §5.2 JSON as at the token endpoint.
-     *
-     * @generated from protobuf rpc: DeviceAuthorization
-     */
-    deviceAuthorization(input: ProtocolRequest, options?: RpcOptions): UnaryCall<ProtocolRequest, HttpBody>;
-    // The registration endpoints below are the HTTP form of ProjectService's
-    // dynamic registration RPCs, with the same logic. Bodies are
-    // `application/json` client metadata (RFC 7591 §2); the initial access
-    // token or registration access token travels as a bearer token in the
-    // `authorization` metadata. A refusal is an OK gRPC call carrying the RFC
-    // error body with its HTTP status in `x-http-code`.
-
-    /**
-     * Client registration (RFC 7591 §3.1). Success is 201 with every
-     * registered metadata value, the credentials and the management location
-     * (RFC 7591 §3.2.1, RFC 7592 §3); invalid metadata is 400 with
-     * `invalid_client_metadata` or `invalid_redirect_uri` (RFC 7591 §3.2.2); a
-     * missing or invalid initial access token is 401 (RFC 6750 §3.1).
-     *
-     * @generated from protobuf rpc: Register
-     */
-    register(input: ProtocolRequest, options?: RpcOptions): UnaryCall<ProtocolRequest, HttpBody>;
-    /**
-     * Read a registration (RFC 7592 §2.1): the client's current metadata as at
-     * registration, without its secret. An invalid registration access token,
-     * or a client this issuer does not have, is 401 (RFC 7592 §2.1).
-     *
-     * @generated from protobuf rpc: ReadRegistration
-     */
-    readRegistration(input: RegistrationRequest, options?: RpcOptions): UnaryCall<RegistrationRequest, HttpBody>;
-    /**
-     * Update a registration (RFC 7592 §2.2): the body replaces the client's
-     * metadata and is validated as a registration; a refused update changes
-     * nothing.
-     *
-     * @generated from protobuf rpc: UpdateRegistration
-     */
-    updateRegistration(input: RegistrationRequest, options?: RpcOptions): UnaryCall<RegistrationRequest, HttpBody>;
-    /**
-     * Delete a registration (RFC 7592 §2.3): 204 with no body.
-     *
-     * @generated from protobuf rpc: DeleteRegistration
-     */
-    deleteRegistration(input: RegistrationRequest, options?: RpcOptions): UnaryCall<RegistrationRequest, HttpBody>;
-}
-/**
- * OidcProviderService publishes one issuer's metadata and signing keys to its
- * relying parties. Every document belongs to the issuer the handle names; an
- * unknown handle is NOT_FOUND with ErrorInfo reason OIDC_ISSUER_NOT_FOUND and
- * never falls back to another issuer. There is no issuer-less document.
- *
- * @generated from protobuf service sid.v1.authn.OidcProviderService
- */
-export class OidcProviderServiceClient implements IOidcProviderServiceClient, ServiceInfo {
-    typeName = OidcProviderService.typeName;
-    methods = OidcProviderService.methods;
-    options = OidcProviderService.options;
-    constructor(private readonly _transport: RpcTransport) {
-    }
-    /**
-     * The issuer's metadata (OpenID Connect Discovery 1.0 §3–4, RFC 8414 §2–3).
-     * One document answers both discovery algorithms: the OIDC location under
-     * the issuer path and the RFC 8414 well-known location with the issuer path
-     * appended.
-     *
-     * @generated from protobuf rpc: GetProviderMetadata
-     */
-    getProviderMetadata(input: IssuerHandleRequest, options?: RpcOptions): UnaryCall<IssuerHandleRequest, ProviderMetadata> {
-        const method = this.methods[0], opt = this._transport.mergeOptions(options);
-        return stackIntercept<IssuerHandleRequest, ProviderMetadata>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * The issuer's JSON Web Key Set (RFC 7517 §5): the public keys that verify
-     * its tokens. The response metadata carries `cache-control` for HTTP caches.
-     *
-     * @generated from protobuf rpc: GetJwks
-     */
-    getJwks(input: IssuerHandleRequest, options?: RpcOptions): UnaryCall<IssuerHandleRequest, JsonWebKeySet> {
-        const method = this.methods[1], opt = this._transport.mergeOptions(options);
-        return stackIntercept<IssuerHandleRequest, JsonWebKeySet>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * UserInfo (OIDC Core 1.0 §5.3) over GET. The access token travels in the
-     * `authorization` metadata, `Bearer` (RFC 6750 §2.1) or `DPoP` with a proof
-     * in the `dpop` metadata (RFC 9449 §7.1); only tokens this issuer signed are
-     * accepted. A refused token is UNAUTHENTICATED with a `www-authenticate`
-     * response metadata challenge (RFC 6750 §3, RFC 9449 §7.1). GET and POST
-     * are separate RPCs because a DPoP proof names the request method.
-     *
-     * @generated from protobuf rpc: GetUserInfo
-     */
-    getUserInfo(input: IssuerHandleRequest, options?: RpcOptions): UnaryCall<IssuerHandleRequest, UserInfo> {
-        const method = this.methods[2], opt = this._transport.mergeOptions(options);
-        return stackIntercept<IssuerHandleRequest, UserInfo>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * UserInfo over POST (OIDC Core 1.0 §5.3.1); the same answer as GetUserInfo.
-     *
-     * @generated from protobuf rpc: PostUserInfo
-     */
-    postUserInfo(input: IssuerHandleRequest, options?: RpcOptions): UnaryCall<IssuerHandleRequest, UserInfo> {
-        const method = this.methods[3], opt = this._transport.mergeOptions(options);
-        return stackIntercept<IssuerHandleRequest, UserInfo>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * The browser authorization endpoint (RFC 6749 §3.1) over GET, the query
-     * parameters bound to the request fields. The answer is an HTTP redirect
-     * (`x-http-code` 303 and `location` response metadata, RFC 9700 §4.11): to
-     * the client's registered redirect URI with `code` or `error`, `state` and
-     * `iss` (RFC 9207 §2), or, when the user must sign in first, to the sign-in
-     * page with this request to return to. A request whose client or exact
-     * redirect URI is not established is answered with a page and never
-     * redirected (RFC 6749 §4.1.2.1). The signed-in user's token, when a
-     * gateway holds one, travels in the `authorization` metadata.
-     *
-     * @generated from protobuf rpc: GetAuthorize
-     */
-    getAuthorize(input: OAuth2AuthorizeRequest, options?: RpcOptions): UnaryCall<OAuth2AuthorizeRequest, HttpBody> {
-        const method = this.methods[4], opt = this._transport.mergeOptions(options);
-        return stackIntercept<OAuth2AuthorizeRequest, HttpBody>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * The authorization endpoint over POST with a form body (OIDC Core 1.0
-     * §3.1.2.1); the same answer as GetAuthorize. Parameters it does not know
-     * are ignored (RFC 6749 §3.1).
-     *
-     * @generated from protobuf rpc: PostAuthorize
-     */
-    postAuthorize(input: ProtocolRequest, options?: RpcOptions): UnaryCall<ProtocolRequest, HttpBody> {
-        const method = this.methods[5], opt = this._transport.mergeOptions(options);
-        return stackIntercept<ProtocolRequest, HttpBody>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * RP-Initiated Logout (OIDC RP-Initiated Logout 1.0 §2) over GET. The
-     * browser's IdP session is read from its `__Host-sid_session` cookie
-     * (`cookie` metadata). A valid `id_token_hint` of this issuer ends the
-     * application session it names; when that session reuses the browser's
-     * IdP session, single sign-on ends too and the answer clears the cookie.
-     * Otherwise ending the browser's IdP session needs the user's confirmation
-     * (§2): the answer is a page with a form that confirms it by POST. A
-     * `post_logout_redirect_uri` is followed only for a valid `id_token_hint`
-     * whose client registered exactly that URI (§3): the answer is then a 303
-     * to it with `state`, or, while the browser's IdP session remains, the
-     * confirmation page, which returns there after either choice. Otherwise the
-     * answer is a page.
-     *
-     * @generated from protobuf rpc: GetEndSession
-     */
-    getEndSession(input: EndSessionRequest, options?: RpcOptions): UnaryCall<EndSessionRequest, HttpBody> {
-        const method = this.methods[6], opt = this._transport.mergeOptions(options);
-        return stackIntercept<EndSessionRequest, HttpBody>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * RP-Initiated Logout over POST with a form body: the same parameters as
-     * GetEndSession, plus `confirmation`, the one-time value of the
-     * confirmation page's form, which ends the browser's IdP session it was
-     * issued for and returns to the post-logout redirect URI that page was
-     * shown for, if any.
-     *
-     * @generated from protobuf rpc: PostEndSession
-     */
-    postEndSession(input: ProtocolRequest, options?: RpcOptions): UnaryCall<ProtocolRequest, HttpBody> {
-        const method = this.methods[7], opt = this._transport.mergeOptions(options);
-        return stackIntercept<ProtocolRequest, HttpBody>("unary", this._transport, method, opt, input);
-    }
-    // The endpoints below are the HTTP form of AuthService's OAuth RPCs, with
-    // the same logic: the request body is the `application/x-www-form-urlencoded`
-    // form the RFC defines, the answer is the RFC's JSON with its HTTP status in
-    // the `x-http-code` response metadata and its headers (`cache-control`,
-    // `pragma`, `www-authenticate`) as response metadata. A refusal is an OK
-    // gRPC call carrying the RFC error body; typed gRPC clients use AuthService.
-    // HTTP Basic client authentication travels in the `authorization` metadata,
-    // a DPoP proof in `dpop`.
-
-    /**
-     * Token endpoint (RFC 6749 §3.2): every grant, including the device_code
-     * grant (RFC 8628 §3.4). Success is RFC 6749 §5.1 JSON with
-     * `cache-control: no-store`; a refusal is RFC 6749 §5.2 or RFC 8628 §3.5
-     * JSON, 401 with a `www-authenticate` challenge for `invalid_client` when
-     * the client used HTTP Basic, 400 otherwise.
-     *
-     * @generated from protobuf rpc: Token
-     */
-    token(input: ProtocolRequest, options?: RpcOptions): UnaryCall<ProtocolRequest, HttpBody> {
-        const method = this.methods[8], opt = this._transport.mergeOptions(options);
-        return stackIntercept<ProtocolRequest, HttpBody>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * Token introspection (RFC 7662 §2): RFC 7662 §2.2 JSON, `{"active":false}`
-     * for any token this issuer does not vouch for.
-     *
-     * @generated from protobuf rpc: Introspect
-     */
-    introspect(input: ProtocolRequest, options?: RpcOptions): UnaryCall<ProtocolRequest, HttpBody> {
-        const method = this.methods[9], opt = this._transport.mergeOptions(options);
-        return stackIntercept<ProtocolRequest, HttpBody>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * Token revocation (RFC 7009 §2): 200 with an empty body, also for a token
-     * that is unknown or already revoked (RFC 7009 §2.2).
-     *
-     * @generated from protobuf rpc: Revoke
-     */
-    revoke(input: ProtocolRequest, options?: RpcOptions): UnaryCall<ProtocolRequest, HttpBody> {
-        const method = this.methods[10], opt = this._transport.mergeOptions(options);
-        return stackIntercept<ProtocolRequest, HttpBody>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * Device authorization (RFC 8628 §3.1): RFC 8628 §3.2 JSON; a refusal is
-     * RFC 6749 §5.2 JSON as at the token endpoint.
-     *
-     * @generated from protobuf rpc: DeviceAuthorization
-     */
-    deviceAuthorization(input: ProtocolRequest, options?: RpcOptions): UnaryCall<ProtocolRequest, HttpBody> {
-        const method = this.methods[11], opt = this._transport.mergeOptions(options);
-        return stackIntercept<ProtocolRequest, HttpBody>("unary", this._transport, method, opt, input);
-    }
-    // The registration endpoints below are the HTTP form of ProjectService's
-    // dynamic registration RPCs, with the same logic. Bodies are
-    // `application/json` client metadata (RFC 7591 §2); the initial access
-    // token or registration access token travels as a bearer token in the
-    // `authorization` metadata. A refusal is an OK gRPC call carrying the RFC
-    // error body with its HTTP status in `x-http-code`.
-
-    /**
-     * Client registration (RFC 7591 §3.1). Success is 201 with every
-     * registered metadata value, the credentials and the management location
-     * (RFC 7591 §3.2.1, RFC 7592 §3); invalid metadata is 400 with
-     * `invalid_client_metadata` or `invalid_redirect_uri` (RFC 7591 §3.2.2); a
-     * missing or invalid initial access token is 401 (RFC 6750 §3.1).
-     *
-     * @generated from protobuf rpc: Register
-     */
-    register(input: ProtocolRequest, options?: RpcOptions): UnaryCall<ProtocolRequest, HttpBody> {
-        const method = this.methods[12], opt = this._transport.mergeOptions(options);
-        return stackIntercept<ProtocolRequest, HttpBody>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * Read a registration (RFC 7592 §2.1): the client's current metadata as at
-     * registration, without its secret. An invalid registration access token,
-     * or a client this issuer does not have, is 401 (RFC 7592 §2.1).
-     *
-     * @generated from protobuf rpc: ReadRegistration
-     */
-    readRegistration(input: RegistrationRequest, options?: RpcOptions): UnaryCall<RegistrationRequest, HttpBody> {
-        const method = this.methods[13], opt = this._transport.mergeOptions(options);
-        return stackIntercept<RegistrationRequest, HttpBody>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * Update a registration (RFC 7592 §2.2): the body replaces the client's
-     * metadata and is validated as a registration; a refused update changes
-     * nothing.
-     *
-     * @generated from protobuf rpc: UpdateRegistration
-     */
-    updateRegistration(input: RegistrationRequest, options?: RpcOptions): UnaryCall<RegistrationRequest, HttpBody> {
-        const method = this.methods[14], opt = this._transport.mergeOptions(options);
-        return stackIntercept<RegistrationRequest, HttpBody>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * Delete a registration (RFC 7592 §2.3): 204 with no body.
-     *
-     * @generated from protobuf rpc: DeleteRegistration
-     */
-    deleteRegistration(input: RegistrationRequest, options?: RpcOptions): UnaryCall<RegistrationRequest, HttpBody> {
-        const method = this.methods[15], opt = this._transport.mergeOptions(options);
-        return stackIntercept<RegistrationRequest, HttpBody>("unary", this._transport, method, opt, input);
-    }
-}
-/**
- * OidcIssuerService lets services that verify an issuer's tokens resolve the
- * issuer and its keys by handle, and the registered resource a token must be
- * issued for.
- *
- * Internal only, no HTTP annotation: relying parties use OidcProviderService.
- *
- * @generated from protobuf service sid.v1.authn.OidcIssuerService
- */
-export interface IOidcIssuerServiceClient {
-    /**
-     * Look up an issuer by handle. An unknown handle is NOT_FOUND with
-     * ErrorInfo reason OIDC_ISSUER_NOT_FOUND and a ResourceInfo naming the
-     * handle; the caller refuses the request and never falls back to another
-     * issuer.
-     *
-     * @generated from protobuf rpc: GetOidcIssuer
-     */
-    getOidcIssuer(input: GetOidcIssuerRequest, options?: RpcOptions): UnaryCall<GetOidcIssuerRequest, OidcIssuer>;
-    /**
-     * Resolve the protected resource a route of the ingress configuration names
-     * before a token is accepted for it. The resource must be registered under
-     * this issuer: an unknown issuer or indicator is NOT_FOUND with ErrorInfo
-     * reason RESOURCE_NOT_FOUND and a ResourceInfo naming the indicator. The
-     * caller refuses the route and never falls back to another target.
-     *
-     * @generated from protobuf rpc: GetProtectedResource
-     */
-    getProtectedResource(input: GetProtectedResourceRequest, options?: RpcOptions): UnaryCall<GetProtectedResourceRequest, ProtectedResourceTarget>;
-}
-/**
- * OidcIssuerService lets services that verify an issuer's tokens resolve the
- * issuer and its keys by handle, and the registered resource a token must be
- * issued for.
- *
- * Internal only, no HTTP annotation: relying parties use OidcProviderService.
- *
- * @generated from protobuf service sid.v1.authn.OidcIssuerService
- */
-export class OidcIssuerServiceClient implements IOidcIssuerServiceClient, ServiceInfo {
-    typeName = OidcIssuerService.typeName;
-    methods = OidcIssuerService.methods;
-    options = OidcIssuerService.options;
-    constructor(private readonly _transport: RpcTransport) {
-    }
-    /**
-     * Look up an issuer by handle. An unknown handle is NOT_FOUND with
-     * ErrorInfo reason OIDC_ISSUER_NOT_FOUND and a ResourceInfo naming the
-     * handle; the caller refuses the request and never falls back to another
-     * issuer.
-     *
-     * @generated from protobuf rpc: GetOidcIssuer
-     */
-    getOidcIssuer(input: GetOidcIssuerRequest, options?: RpcOptions): UnaryCall<GetOidcIssuerRequest, OidcIssuer> {
-        const method = this.methods[0], opt = this._transport.mergeOptions(options);
-        return stackIntercept<GetOidcIssuerRequest, OidcIssuer>("unary", this._transport, method, opt, input);
-    }
-    /**
-     * Resolve the protected resource a route of the ingress configuration names
-     * before a token is accepted for it. The resource must be registered under
-     * this issuer: an unknown issuer or indicator is NOT_FOUND with ErrorInfo
-     * reason RESOURCE_NOT_FOUND and a ResourceInfo naming the indicator. The
-     * caller refuses the route and never falls back to another target.
-     *
-     * @generated from protobuf rpc: GetProtectedResource
-     */
-    getProtectedResource(input: GetProtectedResourceRequest, options?: RpcOptions): UnaryCall<GetProtectedResourceRequest, ProtectedResourceTarget> {
-        const method = this.methods[1], opt = this._transport.mergeOptions(options);
-        return stackIntercept<GetProtectedResourceRequest, ProtectedResourceTarget>("unary", this._transport, method, opt, input);
-    }
-}