@structured-id/ui-core 2.0.0 → 3.0.0

package/src/generated/sid/v1/authn/issuer.ts

@@ -1,1600 +0,0 @@
-// @generated by protobuf-ts 2.11.1 with parameter client_generic,generate_dependencies
-// @generated from protobuf file "sid/v1/authn/issuer.proto" (package "sid.v1.authn", syntax proto3)
-// tslint:disable
-import { OAuth2AuthorizeRequest } from "./auth";
-import { ServiceType } from "@protobuf-ts/runtime-rpc";
-import type { BinaryWriteOptions } from "@protobuf-ts/runtime";
-import type { IBinaryWriter } from "@protobuf-ts/runtime";
-import { WireType } from "@protobuf-ts/runtime";
-import type { BinaryReadOptions } from "@protobuf-ts/runtime";
-import type { IBinaryReader } from "@protobuf-ts/runtime";
-import { UnknownFieldHandler } from "@protobuf-ts/runtime";
-import type { PartialMessage } from "@protobuf-ts/runtime";
-import { reflectionMergePartial } from "@protobuf-ts/runtime";
-import { MessageType } from "@protobuf-ts/runtime";
-import { ResourceId } from "../ids/ids";
-import { HttpBody } from "../../../google/api/httpbody";
-/**
- * A request to one registered client's management endpoint (RFC 7592) in its
- * HTTP form.
- *
- * @generated from protobuf message sid.v1.authn.RegistrationRequest
- */
-export interface RegistrationRequest {
-    /**
-     * The opaque issuer handle: the `<handle>` path segment of the issuer URL
-     * `https://<host>/i/<handle>`. 32 lowercase hex characters.
-     *
-     * @generated from protobuf field: string issuer_handle = 1
-     */
-    issuerHandle: string;
-    /**
-     * The client being managed, the last segment of its
-     * `registration_client_uri` (RFC 7592 §3).
-     *
-     * @generated from protobuf field: string client_id = 2
-     */
-    clientId: string;
-    /**
-     * The HTTP request body with its `Content-Type`: `application/json` client
-     * metadata for an update (RFC 7592 §2.2); absent for read and delete.
-     *
-     * @generated from protobuf field: google.api.HttpBody body = 3
-     */
-    body?: HttpBody;
-}
-/**
- * A logout request of a relying party (OIDC RP-Initiated Logout 1.0 §2) at
- * one issuer's end-session endpoint.
- *
- * @generated from protobuf message sid.v1.authn.EndSessionRequest
- */
-export interface EndSessionRequest {
-    /**
-     * The opaque issuer handle: the `<handle>` path segment of the issuer URL
-     * `https://<host>/i/<handle>`. 32 lowercase hex characters.
-     *
-     * @generated from protobuf field: string issuer_handle = 1
-     */
-    issuerHandle: string;
-    /**
-     * An ID token this issuer gave the relying party, naming the application
-     * session (`sid`) and the client (`aud`) that asks to log out. Accepted
-     * expired (§2); one of another issuer, or not an ID token, is ignored.
-     *
-     * @generated from protobuf field: optional string id_token_hint = 2
-     */
-    idTokenHint?: string;
-    /**
-     * The relying party's client identifier. With `id_token_hint`, it must be
-     * the hint's audience or the hint is ignored.
-     *
-     * @generated from protobuf field: optional string client_id = 3
-     */
-    clientId?: string;
-    /**
-     * Where to send the browser after logout (§3). Followed only when a valid
-     * `id_token_hint` names the client and the URI exactly matches one the
-     * client registered; otherwise the answer is a page.
-     *
-     * @generated from protobuf field: optional string post_logout_redirect_uri = 4
-     */
-    postLogoutRedirectUri?: string;
-    /**
-     * Opaque value of the relying party, added to the post-logout redirect as
-     * `state` (§3).
-     *
-     * @generated from protobuf field: optional string state = 5
-     */
-    state?: string;
-}
-/**
- * An OAuth request to one issuer's endpoint in its HTTP form.
- *
- * @generated from protobuf message sid.v1.authn.ProtocolRequest
- */
-export interface ProtocolRequest {
-    /**
-     * The opaque issuer handle: the `<handle>` path segment of the issuer URL
-     * `https://<host>/i/<handle>`. 32 lowercase hex characters.
-     *
-     * @generated from protobuf field: string issuer_handle = 1
-     */
-    issuerHandle: string;
-    /**
-     * The HTTP request body as the client sent it, with its `Content-Type`;
-     * absent for a request without one (a GET). The endpoints read
-     * `application/x-www-form-urlencoded` (RFC 6749 §3.2) and refuse any other
-     * type as `invalid_request`.
-     *
-     * @generated from protobuf field: google.api.HttpBody body = 2
-     */
-    body?: HttpBody;
-}
-/**
- * Claims about the authenticated user (OIDC Core 1.0 §5.3.2). A claim the
- * token's scopes do not grant, or the user does not have, is absent rather
- * than empty (OIDC Core 1.0 §5.3.2).
- *
- * @generated from protobuf message sid.v1.authn.UserInfo
- */
-export interface UserInfo {
-    /**
-     * The subject, identical to the `sub` of the ID token this issuer gave the
-     * same client (OIDC Core 1.0 §5.3.2).
-     *
-     * @generated from protobuf field: string sub = 1
-     */
-    sub: string;
-    /**
-     * Full display name (`profile` scope).
-     *
-     * @generated from protobuf field: optional string name = 2
-     */
-    name?: string;
-    /**
-     * Given name(s) (`profile` scope).
-     *
-     * @generated from protobuf field: optional string given_name = 3 [json_name = "given_name"]
-     */
-    givenName?: string;
-    /**
-     * Surname(s) (`profile` scope).
-     *
-     * @generated from protobuf field: optional string family_name = 4 [json_name = "family_name"]
-     */
-    familyName?: string;
-    /**
-     * Middle name(s) (`profile` scope).
-     *
-     * @generated from protobuf field: optional string middle_name = 5 [json_name = "middle_name"]
-     */
-    middleName?: string;
-    /**
-     * Shorthand name the user chose (`profile` scope).
-     *
-     * @generated from protobuf field: optional string preferred_username = 6 [json_name = "preferred_username"]
-     */
-    preferredUsername?: string;
-    /**
-     * When the profile information last changed, seconds since the Unix epoch
-     * (`profile` scope). A JSON number (OIDC Core 1.0 §5.1).
-     *
-     * @generated from protobuf field: optional uint32 updated_at = 7 [json_name = "updated_at"]
-     */
-    updatedAt?: number;
-    /**
-     * Primary email address (`email` scope).
-     *
-     * @generated from protobuf field: optional string email = 8
-     */
-    email?: string;
-    /**
-     * Whether the primary email address was verified (`email` scope).
-     *
-     * @generated from protobuf field: optional bool email_verified = 9 [json_name = "email_verified"]
-     */
-    emailVerified?: boolean;
-    /**
-     * Primary phone number in E.164 (`phone` scope).
-     *
-     * @generated from protobuf field: optional string phone_number = 10 [json_name = "phone_number"]
-     */
-    phoneNumber?: string;
-    /**
-     * Whether the primary phone number was verified (`phone` scope).
-     *
-     * @generated from protobuf field: optional bool phone_number_verified = 11 [json_name = "phone_number_verified"]
-     */
-    phoneNumberVerified?: boolean;
-}
-/**
- * Names the issuer a request is for.
- *
- * @generated from protobuf message sid.v1.authn.IssuerHandleRequest
- */
-export interface IssuerHandleRequest {
-    /**
-     * The opaque issuer handle: the `<handle>` path segment of the issuer URL
-     * `https://<host>/i/<handle>`. 32 lowercase hex characters, allocated by
-     * the server at issuer creation and never reused.
-     *
-     * @generated from protobuf field: string issuer_handle = 1
-     */
-    issuerHandle: string;
-}
-/**
- * OpenID Provider / Authorization Server metadata of one issuer. JSON member
- * names are the registered metadata names (OIDC Discovery 1.0 §3, RFC 8414 §2);
- * every endpoint is under the issuer URL.
- *
- * @generated from protobuf message sid.v1.authn.ProviderMetadata
- */
-export interface ProviderMetadata {
-    /**
-     * The issuer identifier, the stored canonical URL byte for byte: the `iss`
-     * of every token this issuer signs (OIDC Discovery 1.0 §4.3, RFC 8414 §3.3).
-     *
-     * @generated from protobuf field: string issuer = 1
-     */
-    issuer: string;
-    /**
-     * Authorization endpoint (RFC 6749 §3.1).
-     *
-     * @generated from protobuf field: string authorization_endpoint = 2 [json_name = "authorization_endpoint"]
-     */
-    authorizationEndpoint: string;
-    /**
-     * Token endpoint (RFC 6749 §3.2).
-     *
-     * @generated from protobuf field: string token_endpoint = 3 [json_name = "token_endpoint"]
-     */
-    tokenEndpoint: string;
-    /**
-     * UserInfo endpoint (OIDC Core 1.0 §5.3).
-     *
-     * @generated from protobuf field: string userinfo_endpoint = 4 [json_name = "userinfo_endpoint"]
-     */
-    userinfoEndpoint: string;
-    /**
-     * The issuer's JSON Web Key Set (RFC 7517 §5).
-     *
-     * @generated from protobuf field: string jwks_uri = 5 [json_name = "jwks_uri"]
-     */
-    jwksUri: string;
-    /**
-     * RP-Initiated Logout endpoint (OIDC RP-Initiated Logout 1.0 §2.1).
-     *
-     * @generated from protobuf field: string end_session_endpoint = 6 [json_name = "end_session_endpoint"]
-     */
-    endSessionEndpoint: string;
-    /**
-     * Token introspection endpoint (RFC 7662 §2, RFC 8414 §2).
-     *
-     * @generated from protobuf field: string introspection_endpoint = 7 [json_name = "introspection_endpoint"]
-     */
-    introspectionEndpoint: string;
-    /**
-     * Token revocation endpoint (RFC 7009 §2, RFC 8414 §2).
-     *
-     * @generated from protobuf field: string revocation_endpoint = 8 [json_name = "revocation_endpoint"]
-     */
-    revocationEndpoint: string;
-    /**
-     * Device authorization endpoint (RFC 8628 §4).
-     *
-     * @generated from protobuf field: string device_authorization_endpoint = 9 [json_name = "device_authorization_endpoint"]
-     */
-    deviceAuthorizationEndpoint: string;
-    /**
-     * Supported `response_type` values; only the authorization code flow.
-     *
-     * @generated from protobuf field: repeated string response_types_supported = 10 [json_name = "response_types_supported"]
-     */
-    responseTypesSupported: string[];
-    /**
-     * Supported grant types (RFC 8414 §2).
-     *
-     * @generated from protobuf field: repeated string grant_types_supported = 11 [json_name = "grant_types_supported"]
-     */
-    grantTypesSupported: string[];
-    /**
-     * Subject identifier types (OIDC Core 1.0 §8): `public` within this
-     * issuer. Which identifier a user's `sub` is follows the issuer, the
-     * selected Profile and the recipient, never a per-client switch.
-     *
-     * @generated from protobuf field: repeated string subject_types_supported = 12 [json_name = "subject_types_supported"]
-     */
-    subjectTypesSupported: string[];
-    /**
-     * JWS algorithms of ID tokens: the issuer's Ed25519 key signs them (EdDSA).
-     *
-     * @generated from protobuf field: repeated string id_token_signing_alg_values_supported = 13 [json_name = "id_token_signing_alg_values_supported"]
-     */
-    idTokenSigningAlgValuesSupported: string[];
-    /**
-     * Scopes a client may request (RFC 8414 §2).
-     *
-     * @generated from protobuf field: repeated string scopes_supported = 14 [json_name = "scopes_supported"]
-     */
-    scopesSupported: string[];
-    /**
-     * Client authentication methods at the token endpoint (RFC 8414 §2).
-     *
-     * @generated from protobuf field: repeated string token_endpoint_auth_methods_supported = 15 [json_name = "token_endpoint_auth_methods_supported"]
-     */
-    tokenEndpointAuthMethodsSupported: string[];
-    /**
-     * PKCE code challenge methods (RFC 7636 §4.3, RFC 8414 §2); only S256.
-     *
-     * @generated from protobuf field: repeated string code_challenge_methods_supported = 16 [json_name = "code_challenge_methods_supported"]
-     */
-    codeChallengeMethodsSupported: string[];
-    /**
-     * JWS algorithms accepted in DPoP proofs (RFC 9449 §5.1).
-     *
-     * @generated from protobuf field: repeated string dpop_signing_alg_values_supported = 17 [json_name = "dpop_signing_alg_values_supported"]
-     */
-    dpopSigningAlgValuesSupported: string[];
-    /**
-     * Back-channel logout is delivered to registered clients (OIDC Back-Channel
-     * Logout 1.0 §2.1).
-     *
-     * @generated from protobuf field: bool backchannel_logout_supported = 18 [json_name = "backchannel_logout_supported"]
-     */
-    backchannelLogoutSupported: boolean;
-    /**
-     * Logout tokens carry the `sid` claim (OIDC Back-Channel Logout 1.0 §2.1).
-     *
-     * @generated from protobuf field: bool backchannel_logout_session_supported = 19 [json_name = "backchannel_logout_session_supported"]
-     */
-    backchannelLogoutSessionSupported: boolean;
-    /**
-     * Every authorization response names its issuer in `iss` (RFC 9207 §3).
-     *
-     * @generated from protobuf field: bool authorization_response_iss_parameter_supported = 20 [json_name = "authorization_response_iss_parameter_supported"]
-     */
-    authorizationResponseIssParameterSupported: boolean;
-    /**
-     * Dynamic client registration endpoint (RFC 7591 §3, OIDC Discovery 1.0 §3,
-     * RFC 8414 §2).
-     *
-     * @generated from protobuf field: string registration_endpoint = 21 [json_name = "registration_endpoint"]
-     */
-    registrationEndpoint: string;
-    /**
-     * JWS algorithms a `private_key_jwt` client may sign its token endpoint
-     * assertion with (RFC 8414 §2: present whenever that method is listed in
-     * `token_endpoint_auth_methods_supported`). Asymmetric only; never `none`.
-     *
-     * @generated from protobuf field: repeated string token_endpoint_auth_signing_alg_values_supported = 22 [json_name = "token_endpoint_auth_signing_alg_values_supported"]
-     */
-    tokenEndpointAuthSigningAlgValuesSupported: string[];
-    /**
-     * Client authentication methods at the revocation endpoint (RFC 8414 §2;
-     * absent would mean `client_secret_basic` only): the token endpoint's.
-     *
-     * @generated from protobuf field: repeated string revocation_endpoint_auth_methods_supported = 23 [json_name = "revocation_endpoint_auth_methods_supported"]
-     */
-    revocationEndpointAuthMethodsSupported: string[];
-    /**
-     * JWS algorithms of `private_key_jwt` assertions at the revocation
-     * endpoint (RFC 8414 §2): the token endpoint's.
-     *
-     * @generated from protobuf field: repeated string revocation_endpoint_auth_signing_alg_values_supported = 24 [json_name = "revocation_endpoint_auth_signing_alg_values_supported"]
-     */
-    revocationEndpointAuthSigningAlgValuesSupported: string[];
-    /**
-     * Client authentication methods at the introspection endpoint (RFC 8414
-     * §2), for the confidential clients and machine users that may introspect;
-     * `none` is not among them (RFC 7662 §2.1).
-     *
-     * @generated from protobuf field: repeated string introspection_endpoint_auth_methods_supported = 25 [json_name = "introspection_endpoint_auth_methods_supported"]
-     */
-    introspectionEndpointAuthMethodsSupported: string[];
-    /**
-     * JWS algorithms of `private_key_jwt` assertions at the introspection
-     * endpoint (RFC 8414 §2): the token endpoint's.
-     *
-     * @generated from protobuf field: repeated string introspection_endpoint_auth_signing_alg_values_supported = 26 [json_name = "introspection_endpoint_auth_signing_alg_values_supported"]
-     */
-    introspectionEndpointAuthSigningAlgValuesSupported: string[];
-}
-/**
- * A JSON Web Key Set (RFC 7517 §5).
- *
- * @generated from protobuf message sid.v1.authn.JsonWebKeySet
- */
-export interface JsonWebKeySet {
-    /**
-     * The issuer's public signing keys, newest generation first.
-     *
-     * @generated from protobuf field: repeated sid.v1.authn.JsonWebKey keys = 1
-     */
-    keys: JsonWebKey[];
-}
-/**
- * A public Ed25519 signing key as an OKP JWK (RFC 7517 §4, RFC 8037 §2).
- *
- * @generated from protobuf message sid.v1.authn.JsonWebKey
- */
-export interface JsonWebKey {
-    /**
-     * Key type (RFC 7517 §4.1): always `OKP`.
-     *
-     * @generated from protobuf field: string kty = 1
-     */
-    kty: string;
-    /**
-     * Intended use (RFC 7517 §4.2): always `sig`.
-     *
-     * @generated from protobuf field: string use = 2
-     */
-    use: string;
-    /**
-     * Algorithm (RFC 7517 §4.4): always `EdDSA`.
-     *
-     * @generated from protobuf field: string alg = 3
-     */
-    alg: string;
-    /**
-     * Key identifier (RFC 7517 §4.5), the JWS `kid` of every token this key
-     * signs. Unique within the issuer only.
-     *
-     * @generated from protobuf field: string kid = 4
-     */
-    kid: string;
-    /**
-     * Curve (RFC 8037 §2): always `Ed25519`.
-     *
-     * @generated from protobuf field: string crv = 5
-     */
-    crv: string;
-    /**
-     * The 32-byte public key, base64url without padding (RFC 8037 §2).
-     *
-     * @generated from protobuf field: string x = 6
-     */
-    x: string;
-}
-/**
- * @generated from protobuf message sid.v1.authn.GetOidcIssuerRequest
- */
-export interface GetOidcIssuerRequest {
-    /**
-     * The opaque issuer handle: the `<handle>` path segment of the issuer URL
-     * `https://<host>/i/<handle>` that received the request. 32 lowercase hex
-     * characters, allocated by the server at issuer creation and never reused.
-     *
-     * @generated from protobuf field: string handle = 1
-     */
-    handle: string;
-}
-/**
- * A logical OIDC issuer as its relying parties see it.
- *
- * @generated from protobuf message sid.v1.authn.OidcIssuer
- */
-export interface OidcIssuer {
-    /**
-     * Exact issuer identifier (the stored canonical URL, `https://<host>/i/<handle>`).
-     * Discovery `issuer`, token `iss` and relying-party configuration must equal
-     * it byte for byte (OpenID Connect Discovery 1.0 §4.3). Never derived from
-     * request Host or Forwarded headers.
-     *
-     * @generated from protobuf field: string issuer = 1
-     */
-    issuer: string;
-    /**
-     * Public signing keys of this issuer, newest generation first: the current
-     * key and every earlier generation still needed to verify artifacts it
-     * issued. Keys of any other issuer never appear here, even under an equal
-     * key identifier.
-     *
-     * @generated from protobuf field: repeated sid.v1.authn.IssuerPublicKey keys = 2
-     */
-    keys: IssuerPublicKey[];
-}
-/**
- * @generated from protobuf message sid.v1.authn.GetProtectedResourceRequest
- */
-export interface GetProtectedResourceRequest {
-    /**
-     * Handle of the issuer the resource is registered under: the `<handle>`
-     * path segment of the issuer URL `https://<host>/i/<handle>`.
-     *
-     * @generated from protobuf field: string issuer_handle = 1
-     */
-    issuerHandle: string;
-    /**
-     * The resource indicator (RFC 8707 §2) as the ingress configuration names
-     * it: an absolute URI without a fragment, in canonical form. Compared
-     * exactly; another spelling of the same URI names no resource.
-     *
-     * @generated from protobuf field: string resource = 2
-     */
-    resource: string;
-}
-/**
- * A registered protected resource as a token verifier needs it.
- *
- * @generated from protobuf message sid.v1.authn.ProtectedResourceTarget
- */
-export interface ProtectedResourceTarget {
-    /**
-     * Exact identifier of the issuer whose tokens the resource accepts; a
-     * token naming another `iss` is refused there.
-     *
-     * @generated from protobuf field: string issuer = 1
-     */
-    issuer: string;
-    /**
-     * The resource indicator, which is the `aud` an access token for this
-     * resource carries (RFC 9068 §4).
-     *
-     * @generated from protobuf field: string resource = 2
-     */
-    resource: string;
-    /**
-     * Whether the resource accepts tokens now. An inactive or retired resource
-     * opens nothing: every token presented for it is refused.
-     *
-     * @generated from protobuf field: bool active = 3
-     */
-    active: boolean;
-    /**
-     * The registered resource itself: the target a permission question about
-     * its requests names.
-     *
-     * @generated from protobuf field: sid.v1.ids.ResourceId id = 4
-     */
-    id?: ResourceId;
-}
-/**
- * One generation of an issuer's server signing key.
- *
- * @generated from protobuf message sid.v1.authn.IssuerPublicKey
- */
-export interface IssuerPublicKey {
-    /**
-     * Key identifier, published as the JWK `kid` and carried in the JWS header
-     * of every token signed with this key (RFC 7515 §4.1.4). Unique within the
-     * issuer only; a verifier matches it together with the exact issuer.
-     *
-     * @generated from protobuf field: string key_id = 1
-     */
-    keyId: string;
-    /**
-     * Ed25519 public key, the 32-byte encoding of RFC 8032 §5.1.5. Published as
-     * an OKP JWK with crv "Ed25519" and alg "EdDSA" (RFC 8037 §2).
-     *
-     * @generated from protobuf field: bytes public_key = 2
-     */
-    publicKey: Uint8Array;
-}
-// @generated message type with reflection information, may provide speed optimized methods
-class RegistrationRequest$Type extends MessageType<RegistrationRequest> {
-    constructor() {
-        super("sid.v1.authn.RegistrationRequest", [
-            { no: 1, name: "issuer_handle", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "client_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 3, name: "body", kind: "message", T: () => HttpBody }
-        ]);
-    }
-    create(value?: PartialMessage<RegistrationRequest>): RegistrationRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.issuerHandle = "";
-        message.clientId = "";
-        if (value !== undefined)
-            reflectionMergePartial<RegistrationRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: RegistrationRequest): RegistrationRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string issuer_handle */ 1:
-                    message.issuerHandle = reader.string();
-                    break;
-                case /* string client_id */ 2:
-                    message.clientId = reader.string();
-                    break;
-                case /* google.api.HttpBody body */ 3:
-                    message.body = HttpBody.internalBinaryRead(reader, reader.uint32(), options, message.body);
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: RegistrationRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string issuer_handle = 1; */
-        if (message.issuerHandle !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.issuerHandle);
-        /* string client_id = 2; */
-        if (message.clientId !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.clientId);
-        /* google.api.HttpBody body = 3; */
-        if (message.body)
-            HttpBody.internalBinaryWrite(message.body, writer.tag(3, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.authn.RegistrationRequest
- */
-export const RegistrationRequest = new RegistrationRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class EndSessionRequest$Type extends MessageType<EndSessionRequest> {
-    constructor() {
-        super("sid.v1.authn.EndSessionRequest", [
-            { no: 1, name: "issuer_handle", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "id_token_hint", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
-            { no: 3, name: "client_id", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
-            { no: 4, name: "post_logout_redirect_uri", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
-            { no: 5, name: "state", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<EndSessionRequest>): EndSessionRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.issuerHandle = "";
-        if (value !== undefined)
-            reflectionMergePartial<EndSessionRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: EndSessionRequest): EndSessionRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string issuer_handle */ 1:
-                    message.issuerHandle = reader.string();
-                    break;
-                case /* optional string id_token_hint */ 2:
-                    message.idTokenHint = reader.string();
-                    break;
-                case /* optional string client_id */ 3:
-                    message.clientId = reader.string();
-                    break;
-                case /* optional string post_logout_redirect_uri */ 4:
-                    message.postLogoutRedirectUri = reader.string();
-                    break;
-                case /* optional string state */ 5:
-                    message.state = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: EndSessionRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string issuer_handle = 1; */
-        if (message.issuerHandle !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.issuerHandle);
-        /* optional string id_token_hint = 2; */
-        if (message.idTokenHint !== undefined)
-            writer.tag(2, WireType.LengthDelimited).string(message.idTokenHint);
-        /* optional string client_id = 3; */
-        if (message.clientId !== undefined)
-            writer.tag(3, WireType.LengthDelimited).string(message.clientId);
-        /* optional string post_logout_redirect_uri = 4; */
-        if (message.postLogoutRedirectUri !== undefined)
-            writer.tag(4, WireType.LengthDelimited).string(message.postLogoutRedirectUri);
-        /* optional string state = 5; */
-        if (message.state !== undefined)
-            writer.tag(5, WireType.LengthDelimited).string(message.state);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.authn.EndSessionRequest
- */
-export const EndSessionRequest = new EndSessionRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class ProtocolRequest$Type extends MessageType<ProtocolRequest> {
-    constructor() {
-        super("sid.v1.authn.ProtocolRequest", [
-            { no: 1, name: "issuer_handle", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "body", kind: "message", T: () => HttpBody }
-        ]);
-    }
-    create(value?: PartialMessage<ProtocolRequest>): ProtocolRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.issuerHandle = "";
-        if (value !== undefined)
-            reflectionMergePartial<ProtocolRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ProtocolRequest): ProtocolRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string issuer_handle */ 1:
-                    message.issuerHandle = reader.string();
-                    break;
-                case /* google.api.HttpBody body */ 2:
-                    message.body = HttpBody.internalBinaryRead(reader, reader.uint32(), options, message.body);
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: ProtocolRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string issuer_handle = 1; */
-        if (message.issuerHandle !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.issuerHandle);
-        /* google.api.HttpBody body = 2; */
-        if (message.body)
-            HttpBody.internalBinaryWrite(message.body, writer.tag(2, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.authn.ProtocolRequest
- */
-export const ProtocolRequest = new ProtocolRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class UserInfo$Type extends MessageType<UserInfo> {
-    constructor() {
-        super("sid.v1.authn.UserInfo", [
-            { no: 1, name: "sub", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "name", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
-            { no: 3, name: "given_name", kind: "scalar", jsonName: "given_name", opt: true, T: 9 /*ScalarType.STRING*/ },
-            { no: 4, name: "family_name", kind: "scalar", jsonName: "family_name", opt: true, T: 9 /*ScalarType.STRING*/ },
-            { no: 5, name: "middle_name", kind: "scalar", jsonName: "middle_name", opt: true, T: 9 /*ScalarType.STRING*/ },
-            { no: 6, name: "preferred_username", kind: "scalar", jsonName: "preferred_username", opt: true, T: 9 /*ScalarType.STRING*/ },
-            { no: 7, name: "updated_at", kind: "scalar", jsonName: "updated_at", opt: true, T: 13 /*ScalarType.UINT32*/ },
-            { no: 8, name: "email", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
-            { no: 9, name: "email_verified", kind: "scalar", jsonName: "email_verified", opt: true, T: 8 /*ScalarType.BOOL*/ },
-            { no: 10, name: "phone_number", kind: "scalar", jsonName: "phone_number", opt: true, T: 9 /*ScalarType.STRING*/ },
-            { no: 11, name: "phone_number_verified", kind: "scalar", jsonName: "phone_number_verified", opt: true, T: 8 /*ScalarType.BOOL*/ }
-        ]);
-    }
-    create(value?: PartialMessage<UserInfo>): UserInfo {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.sub = "";
-        if (value !== undefined)
-            reflectionMergePartial<UserInfo>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: UserInfo): UserInfo {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string sub */ 1:
-                    message.sub = reader.string();
-                    break;
-                case /* optional string name */ 2:
-                    message.name = reader.string();
-                    break;
-                case /* optional string given_name = 3 [json_name = "given_name"] */ 3:
-                    message.givenName = reader.string();
-                    break;
-                case /* optional string family_name = 4 [json_name = "family_name"] */ 4:
-                    message.familyName = reader.string();
-                    break;
-                case /* optional string middle_name = 5 [json_name = "middle_name"] */ 5:
-                    message.middleName = reader.string();
-                    break;
-                case /* optional string preferred_username = 6 [json_name = "preferred_username"] */ 6:
-                    message.preferredUsername = reader.string();
-                    break;
-                case /* optional uint32 updated_at = 7 [json_name = "updated_at"] */ 7:
-                    message.updatedAt = reader.uint32();
-                    break;
-                case /* optional string email */ 8:
-                    message.email = reader.string();
-                    break;
-                case /* optional bool email_verified = 9 [json_name = "email_verified"] */ 9:
-                    message.emailVerified = reader.bool();
-                    break;
-                case /* optional string phone_number = 10 [json_name = "phone_number"] */ 10:
-                    message.phoneNumber = reader.string();
-                    break;
-                case /* optional bool phone_number_verified = 11 [json_name = "phone_number_verified"] */ 11:
-                    message.phoneNumberVerified = reader.bool();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: UserInfo, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string sub = 1; */
-        if (message.sub !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.sub);
-        /* optional string name = 2; */
-        if (message.name !== undefined)
-            writer.tag(2, WireType.LengthDelimited).string(message.name);
-        /* optional string given_name = 3 [json_name = "given_name"]; */
-        if (message.givenName !== undefined)
-            writer.tag(3, WireType.LengthDelimited).string(message.givenName);
-        /* optional string family_name = 4 [json_name = "family_name"]; */
-        if (message.familyName !== undefined)
-            writer.tag(4, WireType.LengthDelimited).string(message.familyName);
-        /* optional string middle_name = 5 [json_name = "middle_name"]; */
-        if (message.middleName !== undefined)
-            writer.tag(5, WireType.LengthDelimited).string(message.middleName);
-        /* optional string preferred_username = 6 [json_name = "preferred_username"]; */
-        if (message.preferredUsername !== undefined)
-            writer.tag(6, WireType.LengthDelimited).string(message.preferredUsername);
-        /* optional uint32 updated_at = 7 [json_name = "updated_at"]; */
-        if (message.updatedAt !== undefined)
-            writer.tag(7, WireType.Varint).uint32(message.updatedAt);
-        /* optional string email = 8; */
-        if (message.email !== undefined)
-            writer.tag(8, WireType.LengthDelimited).string(message.email);
-        /* optional bool email_verified = 9 [json_name = "email_verified"]; */
-        if (message.emailVerified !== undefined)
-            writer.tag(9, WireType.Varint).bool(message.emailVerified);
-        /* optional string phone_number = 10 [json_name = "phone_number"]; */
-        if (message.phoneNumber !== undefined)
-            writer.tag(10, WireType.LengthDelimited).string(message.phoneNumber);
-        /* optional bool phone_number_verified = 11 [json_name = "phone_number_verified"]; */
-        if (message.phoneNumberVerified !== undefined)
-            writer.tag(11, WireType.Varint).bool(message.phoneNumberVerified);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.authn.UserInfo
- */
-export const UserInfo = new UserInfo$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class IssuerHandleRequest$Type extends MessageType<IssuerHandleRequest> {
-    constructor() {
-        super("sid.v1.authn.IssuerHandleRequest", [
-            { no: 1, name: "issuer_handle", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<IssuerHandleRequest>): IssuerHandleRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.issuerHandle = "";
-        if (value !== undefined)
-            reflectionMergePartial<IssuerHandleRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: IssuerHandleRequest): IssuerHandleRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string issuer_handle */ 1:
-                    message.issuerHandle = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: IssuerHandleRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string issuer_handle = 1; */
-        if (message.issuerHandle !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.issuerHandle);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.authn.IssuerHandleRequest
- */
-export const IssuerHandleRequest = new IssuerHandleRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class ProviderMetadata$Type extends MessageType<ProviderMetadata> {
-    constructor() {
-        super("sid.v1.authn.ProviderMetadata", [
-            { no: 1, name: "issuer", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "authorization_endpoint", kind: "scalar", jsonName: "authorization_endpoint", T: 9 /*ScalarType.STRING*/ },
-            { no: 3, name: "token_endpoint", kind: "scalar", jsonName: "token_endpoint", T: 9 /*ScalarType.STRING*/ },
-            { no: 4, name: "userinfo_endpoint", kind: "scalar", jsonName: "userinfo_endpoint", T: 9 /*ScalarType.STRING*/ },
-            { no: 5, name: "jwks_uri", kind: "scalar", jsonName: "jwks_uri", T: 9 /*ScalarType.STRING*/ },
-            { no: 6, name: "end_session_endpoint", kind: "scalar", jsonName: "end_session_endpoint", T: 9 /*ScalarType.STRING*/ },
-            { no: 7, name: "introspection_endpoint", kind: "scalar", jsonName: "introspection_endpoint", T: 9 /*ScalarType.STRING*/ },
-            { no: 8, name: "revocation_endpoint", kind: "scalar", jsonName: "revocation_endpoint", T: 9 /*ScalarType.STRING*/ },
-            { no: 9, name: "device_authorization_endpoint", kind: "scalar", jsonName: "device_authorization_endpoint", T: 9 /*ScalarType.STRING*/ },
-            { no: 10, name: "response_types_supported", kind: "scalar", jsonName: "response_types_supported", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
-            { no: 11, name: "grant_types_supported", kind: "scalar", jsonName: "grant_types_supported", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
-            { no: 12, name: "subject_types_supported", kind: "scalar", jsonName: "subject_types_supported", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
-            { no: 13, name: "id_token_signing_alg_values_supported", kind: "scalar", jsonName: "id_token_signing_alg_values_supported", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
-            { no: 14, name: "scopes_supported", kind: "scalar", jsonName: "scopes_supported", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
-            { no: 15, name: "token_endpoint_auth_methods_supported", kind: "scalar", jsonName: "token_endpoint_auth_methods_supported", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
-            { no: 16, name: "code_challenge_methods_supported", kind: "scalar", jsonName: "code_challenge_methods_supported", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
-            { no: 17, name: "dpop_signing_alg_values_supported", kind: "scalar", jsonName: "dpop_signing_alg_values_supported", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
-            { no: 18, name: "backchannel_logout_supported", kind: "scalar", jsonName: "backchannel_logout_supported", T: 8 /*ScalarType.BOOL*/ },
-            { no: 19, name: "backchannel_logout_session_supported", kind: "scalar", jsonName: "backchannel_logout_session_supported", T: 8 /*ScalarType.BOOL*/ },
-            { no: 20, name: "authorization_response_iss_parameter_supported", kind: "scalar", jsonName: "authorization_response_iss_parameter_supported", T: 8 /*ScalarType.BOOL*/ },
-            { no: 21, name: "registration_endpoint", kind: "scalar", jsonName: "registration_endpoint", T: 9 /*ScalarType.STRING*/ },
-            { no: 22, name: "token_endpoint_auth_signing_alg_values_supported", kind: "scalar", jsonName: "token_endpoint_auth_signing_alg_values_supported", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
-            { no: 23, name: "revocation_endpoint_auth_methods_supported", kind: "scalar", jsonName: "revocation_endpoint_auth_methods_supported", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
-            { no: 24, name: "revocation_endpoint_auth_signing_alg_values_supported", kind: "scalar", jsonName: "revocation_endpoint_auth_signing_alg_values_supported", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
-            { no: 25, name: "introspection_endpoint_auth_methods_supported", kind: "scalar", jsonName: "introspection_endpoint_auth_methods_supported", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
-            { no: 26, name: "introspection_endpoint_auth_signing_alg_values_supported", kind: "scalar", jsonName: "introspection_endpoint_auth_signing_alg_values_supported", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<ProviderMetadata>): ProviderMetadata {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.issuer = "";
-        message.authorizationEndpoint = "";
-        message.tokenEndpoint = "";
-        message.userinfoEndpoint = "";
-        message.jwksUri = "";
-        message.endSessionEndpoint = "";
-        message.introspectionEndpoint = "";
-        message.revocationEndpoint = "";
-        message.deviceAuthorizationEndpoint = "";
-        message.responseTypesSupported = [];
-        message.grantTypesSupported = [];
-        message.subjectTypesSupported = [];
-        message.idTokenSigningAlgValuesSupported = [];
-        message.scopesSupported = [];
-        message.tokenEndpointAuthMethodsSupported = [];
-        message.codeChallengeMethodsSupported = [];
-        message.dpopSigningAlgValuesSupported = [];
-        message.backchannelLogoutSupported = false;
-        message.backchannelLogoutSessionSupported = false;
-        message.authorizationResponseIssParameterSupported = false;
-        message.registrationEndpoint = "";
-        message.tokenEndpointAuthSigningAlgValuesSupported = [];
-        message.revocationEndpointAuthMethodsSupported = [];
-        message.revocationEndpointAuthSigningAlgValuesSupported = [];
-        message.introspectionEndpointAuthMethodsSupported = [];
-        message.introspectionEndpointAuthSigningAlgValuesSupported = [];
-        if (value !== undefined)
-            reflectionMergePartial<ProviderMetadata>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ProviderMetadata): ProviderMetadata {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string issuer */ 1:
-                    message.issuer = reader.string();
-                    break;
-                case /* string authorization_endpoint = 2 [json_name = "authorization_endpoint"] */ 2:
-                    message.authorizationEndpoint = reader.string();
-                    break;
-                case /* string token_endpoint = 3 [json_name = "token_endpoint"] */ 3:
-                    message.tokenEndpoint = reader.string();
-                    break;
-                case /* string userinfo_endpoint = 4 [json_name = "userinfo_endpoint"] */ 4:
-                    message.userinfoEndpoint = reader.string();
-                    break;
-                case /* string jwks_uri = 5 [json_name = "jwks_uri"] */ 5:
-                    message.jwksUri = reader.string();
-                    break;
-                case /* string end_session_endpoint = 6 [json_name = "end_session_endpoint"] */ 6:
-                    message.endSessionEndpoint = reader.string();
-                    break;
-                case /* string introspection_endpoint = 7 [json_name = "introspection_endpoint"] */ 7:
-                    message.introspectionEndpoint = reader.string();
-                    break;
-                case /* string revocation_endpoint = 8 [json_name = "revocation_endpoint"] */ 8:
-                    message.revocationEndpoint = reader.string();
-                    break;
-                case /* string device_authorization_endpoint = 9 [json_name = "device_authorization_endpoint"] */ 9:
-                    message.deviceAuthorizationEndpoint = reader.string();
-                    break;
-                case /* repeated string response_types_supported = 10 [json_name = "response_types_supported"] */ 10:
-                    message.responseTypesSupported.push(reader.string());
-                    break;
-                case /* repeated string grant_types_supported = 11 [json_name = "grant_types_supported"] */ 11:
-                    message.grantTypesSupported.push(reader.string());
-                    break;
-                case /* repeated string subject_types_supported = 12 [json_name = "subject_types_supported"] */ 12:
-                    message.subjectTypesSupported.push(reader.string());
-                    break;
-                case /* repeated string id_token_signing_alg_values_supported = 13 [json_name = "id_token_signing_alg_values_supported"] */ 13:
-                    message.idTokenSigningAlgValuesSupported.push(reader.string());
-                    break;
-                case /* repeated string scopes_supported = 14 [json_name = "scopes_supported"] */ 14:
-                    message.scopesSupported.push(reader.string());
-                    break;
-                case /* repeated string token_endpoint_auth_methods_supported = 15 [json_name = "token_endpoint_auth_methods_supported"] */ 15:
-                    message.tokenEndpointAuthMethodsSupported.push(reader.string());
-                    break;
-                case /* repeated string code_challenge_methods_supported = 16 [json_name = "code_challenge_methods_supported"] */ 16:
-                    message.codeChallengeMethodsSupported.push(reader.string());
-                    break;
-                case /* repeated string dpop_signing_alg_values_supported = 17 [json_name = "dpop_signing_alg_values_supported"] */ 17:
-                    message.dpopSigningAlgValuesSupported.push(reader.string());
-                    break;
-                case /* bool backchannel_logout_supported = 18 [json_name = "backchannel_logout_supported"] */ 18:
-                    message.backchannelLogoutSupported = reader.bool();
-                    break;
-                case /* bool backchannel_logout_session_supported = 19 [json_name = "backchannel_logout_session_supported"] */ 19:
-                    message.backchannelLogoutSessionSupported = reader.bool();
-                    break;
-                case /* bool authorization_response_iss_parameter_supported = 20 [json_name = "authorization_response_iss_parameter_supported"] */ 20:
-                    message.authorizationResponseIssParameterSupported = reader.bool();
-                    break;
-                case /* string registration_endpoint = 21 [json_name = "registration_endpoint"] */ 21:
-                    message.registrationEndpoint = reader.string();
-                    break;
-                case /* repeated string token_endpoint_auth_signing_alg_values_supported = 22 [json_name = "token_endpoint_auth_signing_alg_values_supported"] */ 22:
-                    message.tokenEndpointAuthSigningAlgValuesSupported.push(reader.string());
-                    break;
-                case /* repeated string revocation_endpoint_auth_methods_supported = 23 [json_name = "revocation_endpoint_auth_methods_supported"] */ 23:
-                    message.revocationEndpointAuthMethodsSupported.push(reader.string());
-                    break;
-                case /* repeated string revocation_endpoint_auth_signing_alg_values_supported = 24 [json_name = "revocation_endpoint_auth_signing_alg_values_supported"] */ 24:
-                    message.revocationEndpointAuthSigningAlgValuesSupported.push(reader.string());
-                    break;
-                case /* repeated string introspection_endpoint_auth_methods_supported = 25 [json_name = "introspection_endpoint_auth_methods_supported"] */ 25:
-                    message.introspectionEndpointAuthMethodsSupported.push(reader.string());
-                    break;
-                case /* repeated string introspection_endpoint_auth_signing_alg_values_supported = 26 [json_name = "introspection_endpoint_auth_signing_alg_values_supported"] */ 26:
-                    message.introspectionEndpointAuthSigningAlgValuesSupported.push(reader.string());
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: ProviderMetadata, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string issuer = 1; */
-        if (message.issuer !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.issuer);
-        /* string authorization_endpoint = 2 [json_name = "authorization_endpoint"]; */
-        if (message.authorizationEndpoint !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.authorizationEndpoint);
-        /* string token_endpoint = 3 [json_name = "token_endpoint"]; */
-        if (message.tokenEndpoint !== "")
-            writer.tag(3, WireType.LengthDelimited).string(message.tokenEndpoint);
-        /* string userinfo_endpoint = 4 [json_name = "userinfo_endpoint"]; */
-        if (message.userinfoEndpoint !== "")
-            writer.tag(4, WireType.LengthDelimited).string(message.userinfoEndpoint);
-        /* string jwks_uri = 5 [json_name = "jwks_uri"]; */
-        if (message.jwksUri !== "")
-            writer.tag(5, WireType.LengthDelimited).string(message.jwksUri);
-        /* string end_session_endpoint = 6 [json_name = "end_session_endpoint"]; */
-        if (message.endSessionEndpoint !== "")
-            writer.tag(6, WireType.LengthDelimited).string(message.endSessionEndpoint);
-        /* string introspection_endpoint = 7 [json_name = "introspection_endpoint"]; */
-        if (message.introspectionEndpoint !== "")
-            writer.tag(7, WireType.LengthDelimited).string(message.introspectionEndpoint);
-        /* string revocation_endpoint = 8 [json_name = "revocation_endpoint"]; */
-        if (message.revocationEndpoint !== "")
-            writer.tag(8, WireType.LengthDelimited).string(message.revocationEndpoint);
-        /* string device_authorization_endpoint = 9 [json_name = "device_authorization_endpoint"]; */
-        if (message.deviceAuthorizationEndpoint !== "")
-            writer.tag(9, WireType.LengthDelimited).string(message.deviceAuthorizationEndpoint);
-        /* repeated string response_types_supported = 10 [json_name = "response_types_supported"]; */
-        for (let i = 0; i < message.responseTypesSupported.length; i++)
-            writer.tag(10, WireType.LengthDelimited).string(message.responseTypesSupported[i]);
-        /* repeated string grant_types_supported = 11 [json_name = "grant_types_supported"]; */
-        for (let i = 0; i < message.grantTypesSupported.length; i++)
-            writer.tag(11, WireType.LengthDelimited).string(message.grantTypesSupported[i]);
-        /* repeated string subject_types_supported = 12 [json_name = "subject_types_supported"]; */
-        for (let i = 0; i < message.subjectTypesSupported.length; i++)
-            writer.tag(12, WireType.LengthDelimited).string(message.subjectTypesSupported[i]);
-        /* repeated string id_token_signing_alg_values_supported = 13 [json_name = "id_token_signing_alg_values_supported"]; */
-        for (let i = 0; i < message.idTokenSigningAlgValuesSupported.length; i++)
-            writer.tag(13, WireType.LengthDelimited).string(message.idTokenSigningAlgValuesSupported[i]);
-        /* repeated string scopes_supported = 14 [json_name = "scopes_supported"]; */
-        for (let i = 0; i < message.scopesSupported.length; i++)
-            writer.tag(14, WireType.LengthDelimited).string(message.scopesSupported[i]);
-        /* repeated string token_endpoint_auth_methods_supported = 15 [json_name = "token_endpoint_auth_methods_supported"]; */
-        for (let i = 0; i < message.tokenEndpointAuthMethodsSupported.length; i++)
-            writer.tag(15, WireType.LengthDelimited).string(message.tokenEndpointAuthMethodsSupported[i]);
-        /* repeated string code_challenge_methods_supported = 16 [json_name = "code_challenge_methods_supported"]; */
-        for (let i = 0; i < message.codeChallengeMethodsSupported.length; i++)
-            writer.tag(16, WireType.LengthDelimited).string(message.codeChallengeMethodsSupported[i]);
-        /* repeated string dpop_signing_alg_values_supported = 17 [json_name = "dpop_signing_alg_values_supported"]; */
-        for (let i = 0; i < message.dpopSigningAlgValuesSupported.length; i++)
-            writer.tag(17, WireType.LengthDelimited).string(message.dpopSigningAlgValuesSupported[i]);
-        /* bool backchannel_logout_supported = 18 [json_name = "backchannel_logout_supported"]; */
-        if (message.backchannelLogoutSupported !== false)
-            writer.tag(18, WireType.Varint).bool(message.backchannelLogoutSupported);
-        /* bool backchannel_logout_session_supported = 19 [json_name = "backchannel_logout_session_supported"]; */
-        if (message.backchannelLogoutSessionSupported !== false)
-            writer.tag(19, WireType.Varint).bool(message.backchannelLogoutSessionSupported);
-        /* bool authorization_response_iss_parameter_supported = 20 [json_name = "authorization_response_iss_parameter_supported"]; */
-        if (message.authorizationResponseIssParameterSupported !== false)
-            writer.tag(20, WireType.Varint).bool(message.authorizationResponseIssParameterSupported);
-        /* string registration_endpoint = 21 [json_name = "registration_endpoint"]; */
-        if (message.registrationEndpoint !== "")
-            writer.tag(21, WireType.LengthDelimited).string(message.registrationEndpoint);
-        /* repeated string token_endpoint_auth_signing_alg_values_supported = 22 [json_name = "token_endpoint_auth_signing_alg_values_supported"]; */
-        for (let i = 0; i < message.tokenEndpointAuthSigningAlgValuesSupported.length; i++)
-            writer.tag(22, WireType.LengthDelimited).string(message.tokenEndpointAuthSigningAlgValuesSupported[i]);
-        /* repeated string revocation_endpoint_auth_methods_supported = 23 [json_name = "revocation_endpoint_auth_methods_supported"]; */
-        for (let i = 0; i < message.revocationEndpointAuthMethodsSupported.length; i++)
-            writer.tag(23, WireType.LengthDelimited).string(message.revocationEndpointAuthMethodsSupported[i]);
-        /* repeated string revocation_endpoint_auth_signing_alg_values_supported = 24 [json_name = "revocation_endpoint_auth_signing_alg_values_supported"]; */
-        for (let i = 0; i < message.revocationEndpointAuthSigningAlgValuesSupported.length; i++)
-            writer.tag(24, WireType.LengthDelimited).string(message.revocationEndpointAuthSigningAlgValuesSupported[i]);
-        /* repeated string introspection_endpoint_auth_methods_supported = 25 [json_name = "introspection_endpoint_auth_methods_supported"]; */
-        for (let i = 0; i < message.introspectionEndpointAuthMethodsSupported.length; i++)
-            writer.tag(25, WireType.LengthDelimited).string(message.introspectionEndpointAuthMethodsSupported[i]);
-        /* repeated string introspection_endpoint_auth_signing_alg_values_supported = 26 [json_name = "introspection_endpoint_auth_signing_alg_values_supported"]; */
-        for (let i = 0; i < message.introspectionEndpointAuthSigningAlgValuesSupported.length; i++)
-            writer.tag(26, WireType.LengthDelimited).string(message.introspectionEndpointAuthSigningAlgValuesSupported[i]);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.authn.ProviderMetadata
- */
-export const ProviderMetadata = new ProviderMetadata$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class JsonWebKeySet$Type extends MessageType<JsonWebKeySet> {
-    constructor() {
-        super("sid.v1.authn.JsonWebKeySet", [
-            { no: 1, name: "keys", kind: "message", repeat: 2 /*RepeatType.UNPACKED*/, T: () => JsonWebKey }
-        ]);
-    }
-    create(value?: PartialMessage<JsonWebKeySet>): JsonWebKeySet {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.keys = [];
-        if (value !== undefined)
-            reflectionMergePartial<JsonWebKeySet>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: JsonWebKeySet): JsonWebKeySet {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* repeated sid.v1.authn.JsonWebKey keys */ 1:
-                    message.keys.push(JsonWebKey.internalBinaryRead(reader, reader.uint32(), options));
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: JsonWebKeySet, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* repeated sid.v1.authn.JsonWebKey keys = 1; */
-        for (let i = 0; i < message.keys.length; i++)
-            JsonWebKey.internalBinaryWrite(message.keys[i], writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.authn.JsonWebKeySet
- */
-export const JsonWebKeySet = new JsonWebKeySet$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class JsonWebKey$Type extends MessageType<JsonWebKey> {
-    constructor() {
-        super("sid.v1.authn.JsonWebKey", [
-            { no: 1, name: "kty", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "use", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 3, name: "alg", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 4, name: "kid", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 5, name: "crv", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 6, name: "x", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<JsonWebKey>): JsonWebKey {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.kty = "";
-        message.use = "";
-        message.alg = "";
-        message.kid = "";
-        message.crv = "";
-        message.x = "";
-        if (value !== undefined)
-            reflectionMergePartial<JsonWebKey>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: JsonWebKey): JsonWebKey {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string kty */ 1:
-                    message.kty = reader.string();
-                    break;
-                case /* string use */ 2:
-                    message.use = reader.string();
-                    break;
-                case /* string alg */ 3:
-                    message.alg = reader.string();
-                    break;
-                case /* string kid */ 4:
-                    message.kid = reader.string();
-                    break;
-                case /* string crv */ 5:
-                    message.crv = reader.string();
-                    break;
-                case /* string x */ 6:
-                    message.x = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: JsonWebKey, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string kty = 1; */
-        if (message.kty !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.kty);
-        /* string use = 2; */
-        if (message.use !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.use);
-        /* string alg = 3; */
-        if (message.alg !== "")
-            writer.tag(3, WireType.LengthDelimited).string(message.alg);
-        /* string kid = 4; */
-        if (message.kid !== "")
-            writer.tag(4, WireType.LengthDelimited).string(message.kid);
-        /* string crv = 5; */
-        if (message.crv !== "")
-            writer.tag(5, WireType.LengthDelimited).string(message.crv);
-        /* string x = 6; */
-        if (message.x !== "")
-            writer.tag(6, WireType.LengthDelimited).string(message.x);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.authn.JsonWebKey
- */
-export const JsonWebKey = new JsonWebKey$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class GetOidcIssuerRequest$Type extends MessageType<GetOidcIssuerRequest> {
-    constructor() {
-        super("sid.v1.authn.GetOidcIssuerRequest", [
-            { no: 1, name: "handle", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<GetOidcIssuerRequest>): GetOidcIssuerRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.handle = "";
-        if (value !== undefined)
-            reflectionMergePartial<GetOidcIssuerRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetOidcIssuerRequest): GetOidcIssuerRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string handle */ 1:
-                    message.handle = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: GetOidcIssuerRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string handle = 1; */
-        if (message.handle !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.handle);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.authn.GetOidcIssuerRequest
- */
-export const GetOidcIssuerRequest = new GetOidcIssuerRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class OidcIssuer$Type extends MessageType<OidcIssuer> {
-    constructor() {
-        super("sid.v1.authn.OidcIssuer", [
-            { no: 1, name: "issuer", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "keys", kind: "message", repeat: 2 /*RepeatType.UNPACKED*/, T: () => IssuerPublicKey }
-        ]);
-    }
-    create(value?: PartialMessage<OidcIssuer>): OidcIssuer {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.issuer = "";
-        message.keys = [];
-        if (value !== undefined)
-            reflectionMergePartial<OidcIssuer>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: OidcIssuer): OidcIssuer {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string issuer */ 1:
-                    message.issuer = reader.string();
-                    break;
-                case /* repeated sid.v1.authn.IssuerPublicKey keys */ 2:
-                    message.keys.push(IssuerPublicKey.internalBinaryRead(reader, reader.uint32(), options));
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: OidcIssuer, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string issuer = 1; */
-        if (message.issuer !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.issuer);
-        /* repeated sid.v1.authn.IssuerPublicKey keys = 2; */
-        for (let i = 0; i < message.keys.length; i++)
-            IssuerPublicKey.internalBinaryWrite(message.keys[i], writer.tag(2, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.authn.OidcIssuer
- */
-export const OidcIssuer = new OidcIssuer$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class GetProtectedResourceRequest$Type extends MessageType<GetProtectedResourceRequest> {
-    constructor() {
-        super("sid.v1.authn.GetProtectedResourceRequest", [
-            { no: 1, name: "issuer_handle", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "resource", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<GetProtectedResourceRequest>): GetProtectedResourceRequest {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.issuerHandle = "";
-        message.resource = "";
-        if (value !== undefined)
-            reflectionMergePartial<GetProtectedResourceRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetProtectedResourceRequest): GetProtectedResourceRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string issuer_handle */ 1:
-                    message.issuerHandle = reader.string();
-                    break;
-                case /* string resource */ 2:
-                    message.resource = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: GetProtectedResourceRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string issuer_handle = 1; */
-        if (message.issuerHandle !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.issuerHandle);
-        /* string resource = 2; */
-        if (message.resource !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.resource);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.authn.GetProtectedResourceRequest
- */
-export const GetProtectedResourceRequest = new GetProtectedResourceRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class ProtectedResourceTarget$Type extends MessageType<ProtectedResourceTarget> {
-    constructor() {
-        super("sid.v1.authn.ProtectedResourceTarget", [
-            { no: 1, name: "issuer", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "resource", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 3, name: "active", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
-            { no: 4, name: "id", kind: "message", T: () => ResourceId }
-        ]);
-    }
-    create(value?: PartialMessage<ProtectedResourceTarget>): ProtectedResourceTarget {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.issuer = "";
-        message.resource = "";
-        message.active = false;
-        if (value !== undefined)
-            reflectionMergePartial<ProtectedResourceTarget>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ProtectedResourceTarget): ProtectedResourceTarget {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string issuer */ 1:
-                    message.issuer = reader.string();
-                    break;
-                case /* string resource */ 2:
-                    message.resource = reader.string();
-                    break;
-                case /* bool active */ 3:
-                    message.active = reader.bool();
-                    break;
-                case /* sid.v1.ids.ResourceId id */ 4:
-                    message.id = ResourceId.internalBinaryRead(reader, reader.uint32(), options, message.id);
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: ProtectedResourceTarget, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string issuer = 1; */
-        if (message.issuer !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.issuer);
-        /* string resource = 2; */
-        if (message.resource !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.resource);
-        /* bool active = 3; */
-        if (message.active !== false)
-            writer.tag(3, WireType.Varint).bool(message.active);
-        /* sid.v1.ids.ResourceId id = 4; */
-        if (message.id)
-            ResourceId.internalBinaryWrite(message.id, writer.tag(4, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.authn.ProtectedResourceTarget
- */
-export const ProtectedResourceTarget = new ProtectedResourceTarget$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class IssuerPublicKey$Type extends MessageType<IssuerPublicKey> {
-    constructor() {
-        super("sid.v1.authn.IssuerPublicKey", [
-            { no: 1, name: "key_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "public_key", kind: "scalar", T: 12 /*ScalarType.BYTES*/ }
-        ]);
-    }
-    create(value?: PartialMessage<IssuerPublicKey>): IssuerPublicKey {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.keyId = "";
-        message.publicKey = new Uint8Array(0);
-        if (value !== undefined)
-            reflectionMergePartial<IssuerPublicKey>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: IssuerPublicKey): IssuerPublicKey {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string key_id */ 1:
-                    message.keyId = reader.string();
-                    break;
-                case /* bytes public_key */ 2:
-                    message.publicKey = reader.bytes();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: IssuerPublicKey, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string key_id = 1; */
-        if (message.keyId !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.keyId);
-        /* bytes public_key = 2; */
-        if (message.publicKey.length)
-            writer.tag(2, WireType.LengthDelimited).bytes(message.publicKey);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message sid.v1.authn.IssuerPublicKey
- */
-export const IssuerPublicKey = new IssuerPublicKey$Type();
-/**
- * @generated ServiceType for protobuf service sid.v1.authn.OidcProviderService
- */
-export const OidcProviderService = new ServiceType("sid.v1.authn.OidcProviderService", [
-    { name: "GetProviderMetadata", options: { "google.api.http": { get: "/i/{issuer_handle}/.well-known/openid-configuration", additionalBindings: [{ get: "/.well-known/oauth-authorization-server/i/{issuer_handle}" }] } }, I: IssuerHandleRequest, O: ProviderMetadata },
-    { name: "GetJwks", options: { "google.api.http": { get: "/i/{issuer_handle}/jwks" } }, I: IssuerHandleRequest, O: JsonWebKeySet },
-    { name: "GetUserInfo", options: { "google.api.http": { get: "/i/{issuer_handle}/userinfo" } }, I: IssuerHandleRequest, O: UserInfo },
-    { name: "PostUserInfo", options: { "google.api.http": { post: "/i/{issuer_handle}/userinfo", body: "*" } }, I: IssuerHandleRequest, O: UserInfo },
-    { name: "GetAuthorize", options: { "google.api.http": { get: "/i/{issuer_handle}/oauth2/authorize" } }, I: OAuth2AuthorizeRequest, O: HttpBody },
-    { name: "PostAuthorize", options: { "google.api.http": { post: "/i/{issuer_handle}/oauth2/authorize", body: "body" } }, I: ProtocolRequest, O: HttpBody },
-    { name: "GetEndSession", options: { "google.api.http": { get: "/i/{issuer_handle}/oauth2/end-session" } }, I: EndSessionRequest, O: HttpBody },
-    { name: "PostEndSession", options: { "google.api.http": { post: "/i/{issuer_handle}/oauth2/end-session", body: "body" } }, I: ProtocolRequest, O: HttpBody },
-    { name: "Token", options: { "google.api.http": { post: "/i/{issuer_handle}/oauth2/token", body: "body" } }, I: ProtocolRequest, O: HttpBody },
-    { name: "Introspect", options: { "google.api.http": { post: "/i/{issuer_handle}/oauth2/introspect", body: "body" } }, I: ProtocolRequest, O: HttpBody },
-    { name: "Revoke", options: { "google.api.http": { post: "/i/{issuer_handle}/oauth2/revoke", body: "body" } }, I: ProtocolRequest, O: HttpBody },
-    { name: "DeviceAuthorization", options: { "google.api.http": { post: "/i/{issuer_handle}/oauth2/device", body: "body" } }, I: ProtocolRequest, O: HttpBody },
-    { name: "Register", options: { "google.api.http": { post: "/i/{issuer_handle}/oauth2/register", body: "body" } }, I: ProtocolRequest, O: HttpBody },
-    { name: "ReadRegistration", options: { "google.api.http": { get: "/i/{issuer_handle}/oauth2/register/{client_id}" } }, I: RegistrationRequest, O: HttpBody },
-    { name: "UpdateRegistration", options: { "google.api.http": { put: "/i/{issuer_handle}/oauth2/register/{client_id}", body: "body" } }, I: RegistrationRequest, O: HttpBody },
-    { name: "DeleteRegistration", options: { "google.api.http": { delete: "/i/{issuer_handle}/oauth2/register/{client_id}" } }, I: RegistrationRequest, O: HttpBody }
-]);
-/**
- * @generated ServiceType for protobuf service sid.v1.authn.OidcIssuerService
- */
-export const OidcIssuerService = new ServiceType("sid.v1.authn.OidcIssuerService", [
-    { name: "GetOidcIssuer", options: {}, I: GetOidcIssuerRequest, O: OidcIssuer },
-    { name: "GetProtectedResource", options: {}, I: GetProtectedResourceRequest, O: ProtectedResourceTarget }
-]);