@homeflare/distilled-openbao 0.2.0

package/dist/services/jwt.d.ts

@@ -0,0 +1,684 @@
+import * as S from "@distilled.cloud/core/schema";
+import * as API from "@distilled.cloud/core/api";
+import { type OpenBaoOpError, type OpenBaoOpContext } from "../protocol.ts";
+export type { OpenBaoOpError, OpenBaoOpContext };
+/** A list of supported signing algorithms. Defaults to RS256. */
+export type JwtConfigureRequestJwtSupportedAlgsList = Array<string>;
+export declare const JwtConfigureRequestJwtSupportedAlgsList: S.Schema<JwtConfigureRequestJwtSupportedAlgsList>;
+/** A list of PEM-encoded public keys to use to authenticate signatures locally. Cannot be used with "jwks_url" or "oidc_discovery_url". */
+export type JwtConfigureRequestJwtValidationPubkeysList = Array<string>;
+export declare const JwtConfigureRequestJwtValidationPubkeysList: S.Schema<JwtConfigureRequestJwtValidationPubkeysList>;
+/** The response types to request. Allowed values are 'code' and 'id_token'. Defaults to 'code'. */
+export type JwtConfigureRequestOidcResponseTypesList = Array<string>;
+export declare const JwtConfigureRequestOidcResponseTypesList: S.Schema<JwtConfigureRequestOidcResponseTypesList>;
+/** A list of hostnames to accept when performing TLS validation, which applies both to OIDC and JWKS. This overrides default checks that expect the TLS subject to match the hostname specified in the connection URL */
+export type JwtConfigureRequestOverrideAllowedServerNamesList = Array<string>;
+export declare const JwtConfigureRequestOverrideAllowedServerNamesList: S.Schema<JwtConfigureRequestOverrideAllowedServerNamesList>;
+export interface JwtConfigureRequest {
+    /** Path that the backend was mounted at */
+    jwt_mount_path: string;
+    /** The value against which to match the 'iss' claim in a JWT. Optional. */
+    bound_issuer?: string;
+    /** The default role to use if none is provided during login. If not set, a role is required during login. */
+    default_role?: string;
+    /** The CA certificate or chain of certificates, in PEM format, to use to validate connections to the JWKS URL. If not set, system certificates are used. */
+    jwks_ca_pem?: string;
+    /** JWKS URL to use to authenticate signatures. Cannot be used with "oidc_discovery_url" or "jwt_validation_pubkeys". */
+    jwks_url?: string;
+    /** A list of supported signing algorithms. Defaults to RS256. */
+    jwt_supported_algs?: JwtConfigureRequestJwtSupportedAlgsList;
+    /** A list of PEM-encoded public keys to use to authenticate signatures locally. Cannot be used with "jwks_url" or "oidc_discovery_url". */
+    jwt_validation_pubkeys?: JwtConfigureRequestJwtValidationPubkeysList;
+    /** Pass namespace in the OIDC state parameter instead of as a separate query parameter. With this setting, the allowed redirect URL(s) in OpenBao and on the provider side should not contain a namespace query parameter. This means only one redirect URL entry needs to be maintained on the provider side for all OpenBao namespaces that will be authenticating against it. Defaults to true for new configs. */
+    namespace_in_state?: boolean;
+    /** The OAuth Client ID configured with your OIDC provider. */
+    oidc_client_id?: string;
+    /** The OAuth Client Secret configured with your OIDC provider. */
+    oidc_client_secret?: string;
+    /** The CA certificate or chain of certificates, in PEM format, to use to validate connections to the OIDC Discovery URL. If not set, system certificates are used. */
+    oidc_discovery_ca_pem?: string;
+    /** The base URL of the OIDC Discovery URL without ".well-known/openid-configuration" component. Cannot be used with "jwks_url" or "jwt_validation_pubkeys". */
+    oidc_discovery_url?: string;
+    /** The response mode to be used in the OAuth2 request. Allowed values are 'query' and 'form_post'. */
+    oidc_response_mode?: string;
+    /** The response types to request. Allowed values are 'code' and 'id_token'. Defaults to 'code'. */
+    oidc_response_types?: JwtConfigureRequestOidcResponseTypesList;
+    /** A list of hostnames to accept when performing TLS validation, which applies both to OIDC and JWKS. This overrides default checks that expect the TLS subject to match the hostname specified in the connection URL */
+    override_allowed_server_names?: JwtConfigureRequestOverrideAllowedServerNamesList;
+    /** Provider-specific configuration. Optional. */
+    provider_config?: unknown;
+    /** When true and oidc_discovery_url or jwks_url are specified, if the connection fails to load, a warning will be issued and status can be checked later by reading the config endpoint. */
+    skip_jwks_validation?: boolean;
+}
+export declare const JwtConfigureRequest: S.Schema<JwtConfigureRequest>;
+export interface JwtConfigureResponse {
+}
+export declare const JwtConfigureResponse: S.Schema<JwtConfigureResponse>;
+/** A list of supported signing algorithms. Defaults to RS256. */
+export type JwtConfigureRequestJwtSupportedAlgsList2 = Array<string>;
+export declare const JwtConfigureRequestJwtSupportedAlgsList2: S.Schema<JwtConfigureRequestJwtSupportedAlgsList2>;
+/** A list of PEM-encoded public keys to use to authenticate signatures locally. Cannot be used with "jwks_url" or "oidc_discovery_url". */
+export type JwtConfigureRequestJwtValidationPubkeysList2 = Array<string>;
+export declare const JwtConfigureRequestJwtValidationPubkeysList2: S.Schema<JwtConfigureRequestJwtValidationPubkeysList2>;
+/** The response types to request. Allowed values are 'code' and 'id_token'. Defaults to 'code'. */
+export type JwtConfigureRequestOidcResponseTypesList2 = Array<string>;
+export declare const JwtConfigureRequestOidcResponseTypesList2: S.Schema<JwtConfigureRequestOidcResponseTypesList2>;
+/** A list of hostnames to accept when performing TLS validation, which applies both to OIDC and JWKS. This overrides default checks that expect the TLS subject to match the hostname specified in the connection URL */
+export type JwtConfigureRequestOverrideAllowedServerNamesList2 = Array<string>;
+export declare const JwtConfigureRequestOverrideAllowedServerNamesList2: S.Schema<JwtConfigureRequestOverrideAllowedServerNamesList2>;
+export interface JwtConfigureRequest2 {
+    /** Path that the backend was mounted at */
+    oidc_mount_path: string;
+    /** The value against which to match the 'iss' claim in a JWT. Optional. */
+    bound_issuer?: string;
+    /** The default role to use if none is provided during login. If not set, a role is required during login. */
+    default_role?: string;
+    /** The CA certificate or chain of certificates, in PEM format, to use to validate connections to the JWKS URL. If not set, system certificates are used. */
+    jwks_ca_pem?: string;
+    /** JWKS URL to use to authenticate signatures. Cannot be used with "oidc_discovery_url" or "jwt_validation_pubkeys". */
+    jwks_url?: string;
+    /** A list of supported signing algorithms. Defaults to RS256. */
+    jwt_supported_algs?: JwtConfigureRequestJwtSupportedAlgsList2;
+    /** A list of PEM-encoded public keys to use to authenticate signatures locally. Cannot be used with "jwks_url" or "oidc_discovery_url". */
+    jwt_validation_pubkeys?: JwtConfigureRequestJwtValidationPubkeysList2;
+    /** Pass namespace in the OIDC state parameter instead of as a separate query parameter. With this setting, the allowed redirect URL(s) in OpenBao and on the provider side should not contain a namespace query parameter. This means only one redirect URL entry needs to be maintained on the provider side for all OpenBao namespaces that will be authenticating against it. Defaults to true for new configs. */
+    namespace_in_state?: boolean;
+    /** The OAuth Client ID configured with your OIDC provider. */
+    oidc_client_id?: string;
+    /** The OAuth Client Secret configured with your OIDC provider. */
+    oidc_client_secret?: string;
+    /** The CA certificate or chain of certificates, in PEM format, to use to validate connections to the OIDC Discovery URL. If not set, system certificates are used. */
+    oidc_discovery_ca_pem?: string;
+    /** The base URL of the OIDC Discovery URL without ".well-known/openid-configuration" component. Cannot be used with "jwks_url" or "jwt_validation_pubkeys". */
+    oidc_discovery_url?: string;
+    /** The response mode to be used in the OAuth2 request. Allowed values are 'query' and 'form_post'. */
+    oidc_response_mode?: string;
+    /** The response types to request. Allowed values are 'code' and 'id_token'. Defaults to 'code'. */
+    oidc_response_types?: JwtConfigureRequestOidcResponseTypesList2;
+    /** A list of hostnames to accept when performing TLS validation, which applies both to OIDC and JWKS. This overrides default checks that expect the TLS subject to match the hostname specified in the connection URL */
+    override_allowed_server_names?: JwtConfigureRequestOverrideAllowedServerNamesList2;
+    /** Provider-specific configuration. Optional. */
+    provider_config?: unknown;
+    /** When true and oidc_discovery_url or jwks_url are specified, if the connection fails to load, a warning will be issued and status can be checked later by reading the config endpoint. */
+    skip_jwks_validation?: boolean;
+}
+export declare const JwtConfigureRequest2: S.Schema<JwtConfigureRequest2>;
+export interface JwtConfigure2Response {
+}
+export declare const JwtConfigure2Response: S.Schema<JwtConfigure2Response>;
+export interface JwtDeleteRoleRequest {
+    /** Path that the backend was mounted at */
+    jwt_mount_path: string;
+    /** Name of the cel role */
+    name: string;
+}
+export declare const JwtDeleteRoleRequest: S.Schema<JwtDeleteRoleRequest>;
+export interface JwtDeleteRoleResponse {
+}
+export declare const JwtDeleteRoleResponse: S.Schema<JwtDeleteRoleResponse>;
+export interface JwtDeleteRoleRequest2 {
+    /** Path that the backend was mounted at */
+    jwt_mount_path: string;
+    /** Name of the role. */
+    name: string;
+}
+export declare const JwtDeleteRoleRequest2: S.Schema<JwtDeleteRoleRequest2>;
+export interface JwtDeleteRole2Response {
+}
+export declare const JwtDeleteRole2Response: S.Schema<JwtDeleteRole2Response>;
+export interface JwtDeleteRoleRequest3 {
+    /** Path that the backend was mounted at */
+    oidc_mount_path: string;
+    /** Name of the cel role */
+    name: string;
+}
+export declare const JwtDeleteRoleRequest3: S.Schema<JwtDeleteRoleRequest3>;
+export interface JwtDeleteRole3Response {
+}
+export declare const JwtDeleteRole3Response: S.Schema<JwtDeleteRole3Response>;
+export interface JwtDeleteRoleRequest4 {
+    /** Path that the backend was mounted at */
+    oidc_mount_path: string;
+    /** Name of the role. */
+    name: string;
+}
+export declare const JwtDeleteRoleRequest4: S.Schema<JwtDeleteRoleRequest4>;
+export interface JwtDeleteRole4Response {
+}
+export declare const JwtDeleteRole4Response: S.Schema<JwtDeleteRole4Response>;
+export type JwtListCelRequestList = "true";
+export declare const JwtListCelRequestList: any;
+export interface JwtListCelRequest {
+    /** Path that the backend was mounted at */
+    jwt_mount_path: string;
+    /** Must be set to `true` */
+    list: JwtListCelRequestList | (string & {});
+}
+export declare const JwtListCelRequest: S.Schema<JwtListCelRequest>;
+/** List of CEL roles */
+export type JwtListCelResponseKeysList = Array<string>;
+export declare const JwtListCelResponseKeysList: S.Schema<JwtListCelResponseKeysList>;
+export interface JwtListCelResponse {
+    /** List of CEL roles */
+    keys?: JwtListCelResponseKeysList;
+}
+export declare const JwtListCelResponse: S.Schema<JwtListCelResponse>;
+export type JwtListCelRequestList2 = "true";
+export declare const JwtListCelRequestList2: any;
+export interface JwtListCelRequest2 {
+    /** Path that the backend was mounted at */
+    oidc_mount_path: string;
+    /** Must be set to `true` */
+    list: JwtListCelRequestList2 | (string & {});
+}
+export declare const JwtListCelRequest2: S.Schema<JwtListCelRequest2>;
+export type JwtListRolesRequestList = "true";
+export declare const JwtListRolesRequestList: any;
+export interface JwtListRolesRequest {
+    /** Path that the backend was mounted at */
+    jwt_mount_path: string;
+    /** Must be set to `true` */
+    list: JwtListRolesRequestList | (string & {});
+}
+export declare const JwtListRolesRequest: S.Schema<JwtListRolesRequest>;
+export interface JwtListRolesResponse {
+}
+export declare const JwtListRolesResponse: S.Schema<JwtListRolesResponse>;
+export type JwtListRolesRequestList2 = "true";
+export declare const JwtListRolesRequestList2: any;
+export interface JwtListRolesRequest2 {
+    /** Path that the backend was mounted at */
+    oidc_mount_path: string;
+    /** Must be set to `true` */
+    list: JwtListRolesRequestList2 | (string & {});
+}
+export declare const JwtListRolesRequest2: S.Schema<JwtListRolesRequest2>;
+export interface JwtListRoles2Response {
+}
+export declare const JwtListRoles2Response: S.Schema<JwtListRoles2Response>;
+export interface JwtOidcCallbackRequest {
+    /** Path that the backend was mounted at */
+    jwt_mount_path: string;
+    client_nonce?: string;
+    code?: string;
+    confirmation?: string;
+    error?: string;
+    error_description?: string;
+    error_uri?: string;
+    state?: string;
+}
+export declare const JwtOidcCallbackRequest: S.Schema<JwtOidcCallbackRequest>;
+export interface JwtOidcCallbackResponse {
+}
+export declare const JwtOidcCallbackResponse: S.Schema<JwtOidcCallbackResponse>;
+export interface JwtOidcCallbackRequest2 {
+    /** Path that the backend was mounted at */
+    oidc_mount_path: string;
+    client_nonce?: string;
+    code?: string;
+    confirmation?: string;
+    error?: string;
+    error_description?: string;
+    error_uri?: string;
+    state?: string;
+}
+export declare const JwtOidcCallbackRequest2: S.Schema<JwtOidcCallbackRequest2>;
+export interface JwtOidcCallback2Response {
+}
+export declare const JwtOidcCallback2Response: S.Schema<JwtOidcCallback2Response>;
+export interface JwtOidcRequestAuthorizationUrlRequest {
+    /** Path that the backend was mounted at */
+    jwt_mount_path: string;
+    /** Client-provided nonce that must match during callback, if present. Required only in direct callback mode. */
+    client_nonce?: string;
+    /** The OAuth redirect_uri to use in the authorization URL. Not needed with device flow. */
+    redirect_uri?: string;
+    /** The role to issue an OIDC authorization URL against. */
+    role?: string;
+}
+export declare const JwtOidcRequestAuthorizationUrlRequest: S.Schema<JwtOidcRequestAuthorizationUrlRequest>;
+export interface JwtOidcRequestAuthorizationUrlResponse {
+}
+export declare const JwtOidcRequestAuthorizationUrlResponse: S.Schema<JwtOidcRequestAuthorizationUrlResponse>;
+export interface JwtOidcRequestAuthorizationUrlRequest2 {
+    /** Path that the backend was mounted at */
+    oidc_mount_path: string;
+    /** Client-provided nonce that must match during callback, if present. Required only in direct callback mode. */
+    client_nonce?: string;
+    /** The OAuth redirect_uri to use in the authorization URL. Not needed with device flow. */
+    redirect_uri?: string;
+    /** The role to issue an OIDC authorization URL against. */
+    role?: string;
+}
+export declare const JwtOidcRequestAuthorizationUrlRequest2: S.Schema<JwtOidcRequestAuthorizationUrlRequest2>;
+export interface JwtOidcRequestAuthorizationUrl2Response {
+}
+export declare const JwtOidcRequestAuthorizationUrl2Response: S.Schema<JwtOidcRequestAuthorizationUrl2Response>;
+/** Comma-separated list of 'aud' claims that are valid for login; any match is sufficient */
+export type JwtPatchRoleRequestBoundAudiencesList = Array<string>;
+export declare const JwtPatchRoleRequestBoundAudiencesList: S.Schema<JwtPatchRoleRequestBoundAudiencesList>;
+export interface JwtPatchRoleRequest {
+    /** Path that the backend was mounted at */
+    jwt_mount_path: string;
+    /** Name of the cel role */
+    name: string;
+    /** Comma-separated list of 'aud' claims that are valid for login; any match is sufficient */
+    bound_audiences?: JwtPatchRoleRequestBoundAudiencesList;
+    /** CEL variables and expression defining the program for the role. This is a map with two fields: 1. 'variables', a list of objects with two fields ('name' and 'expression') defining each variable and the exact execution order. 2. 'expression', the final statement to execute and whose result is returned. For example: cel_program = { "variables": [ { "name": "condition", "expression": "len(claims.groups) > 0" }, { "name": "result", "expression": "pb.Auth{Alias: claims.aud, Groups: claims.groups}" } ], "expression": "condition ? result : false" } */
+    cel_program?: unknown;
+    /** Duration in seconds of leeway when validating all claims to account for clock skew. Defaults to 60 (1 minute) if set to 0 and can be disabled if set to -1. */
+    clock_skew_leeway?: number;
+    /** Duration in seconds of leeway when validating expiration of a token to account for clock skew. Defaults to 150 (2.5 minutes) if set to 0 and can be disabled if set to -1. */
+    expiration_leeway?: number;
+    /** Static error message if validation fails */
+    message?: string;
+    /** Duration in seconds of leeway when validating not before values of a token to account for clock skew. Defaults to 150 (2.5 minutes) if set to 0 and can be disabled if set to -1. */
+    not_before_leeway?: number;
+}
+export declare const JwtPatchRoleRequest: S.Schema<JwtPatchRoleRequest>;
+/** Comma-separated list of 'aud' claims that are valid for login; any match is sufficient */
+export type JwtPatchRoleResponseBoundAudiencesList = Array<string>;
+export declare const JwtPatchRoleResponseBoundAudiencesList: S.Schema<JwtPatchRoleResponseBoundAudiencesList>;
+export interface JwtPatchRoleResponse {
+    /** Comma-separated list of 'aud' claims that are valid for login; any match is sufficient */
+    bound_audiences?: JwtPatchRoleResponseBoundAudiencesList;
+    /** CEL variables and expression defining the program for the role. This is a map with two fields: 1. 'variables', a list of objects with two fields ('name' and 'expression') defining each variable and the exact execution order. 2. 'expression', the final statement to execute and whose result is returned. For example: cel_program = { "variables": [ { "name": "condition", "expression": "len(claims.groups) > 0" }, { "name": "result", "expression": "pb.Auth{Alias: claims.aud, Groups: claims.groups}" } ], "expression": "condition ? result : false" } */
+    cel_program?: unknown;
+    /** Duration in seconds of leeway when validating all claims to account for clock skew. Defaults to 60 (1 minute) if set to 0 and can be disabled if set to -1. */
+    clock_skew_leeway?: number;
+    /** Duration in seconds of leeway when validating expiration of a token to account for clock skew. Defaults to 150 (2.5 minutes) if set to 0 and can be disabled if set to -1. */
+    expiration_leeway?: number;
+    /** Static error message if validation fails */
+    message?: string;
+    /** Name of the cel role */
+    name?: string;
+    /** Duration in seconds of leeway when validating not before values of a token to account for clock skew. Defaults to 150 (2.5 minutes) if set to 0 and can be disabled if set to -1. */
+    not_before_leeway?: number;
+}
+export declare const JwtPatchRoleResponse: S.Schema<JwtPatchRoleResponse>;
+/** Comma-separated list of 'aud' claims that are valid for login; any match is sufficient */
+export type JwtPatchRoleRequestBoundAudiencesList2 = Array<string>;
+export declare const JwtPatchRoleRequestBoundAudiencesList2: S.Schema<JwtPatchRoleRequestBoundAudiencesList2>;
+export interface JwtPatchRoleRequest2 {
+    /** Path that the backend was mounted at */
+    oidc_mount_path: string;
+    /** Name of the cel role */
+    name: string;
+    /** Comma-separated list of 'aud' claims that are valid for login; any match is sufficient */
+    bound_audiences?: JwtPatchRoleRequestBoundAudiencesList2;
+    /** CEL variables and expression defining the program for the role. This is a map with two fields: 1. 'variables', a list of objects with two fields ('name' and 'expression') defining each variable and the exact execution order. 2. 'expression', the final statement to execute and whose result is returned. For example: cel_program = { "variables": [ { "name": "condition", "expression": "len(claims.groups) > 0" }, { "name": "result", "expression": "pb.Auth{Alias: claims.aud, Groups: claims.groups}" } ], "expression": "condition ? result : false" } */
+    cel_program?: unknown;
+    /** Duration in seconds of leeway when validating all claims to account for clock skew. Defaults to 60 (1 minute) if set to 0 and can be disabled if set to -1. */
+    clock_skew_leeway?: number;
+    /** Duration in seconds of leeway when validating expiration of a token to account for clock skew. Defaults to 150 (2.5 minutes) if set to 0 and can be disabled if set to -1. */
+    expiration_leeway?: number;
+    /** Static error message if validation fails */
+    message?: string;
+    /** Duration in seconds of leeway when validating not before values of a token to account for clock skew. Defaults to 150 (2.5 minutes) if set to 0 and can be disabled if set to -1. */
+    not_before_leeway?: number;
+}
+export declare const JwtPatchRoleRequest2: S.Schema<JwtPatchRoleRequest2>;
+export interface JwtReadConfigurationRequest {
+    /** Path that the backend was mounted at */
+    jwt_mount_path: string;
+}
+export declare const JwtReadConfigurationRequest: S.Schema<JwtReadConfigurationRequest>;
+export interface JwtReadConfigurationResponse {
+}
+export declare const JwtReadConfigurationResponse: S.Schema<JwtReadConfigurationResponse>;
+export interface JwtReadConfigurationRequest2 {
+    /** Path that the backend was mounted at */
+    oidc_mount_path: string;
+}
+export declare const JwtReadConfigurationRequest2: S.Schema<JwtReadConfigurationRequest2>;
+export interface JwtReadConfiguration2Response {
+}
+export declare const JwtReadConfiguration2Response: S.Schema<JwtReadConfiguration2Response>;
+export interface JwtReadRoleRequest {
+    /** Path that the backend was mounted at */
+    jwt_mount_path: string;
+    /** Name of the cel role */
+    name: string;
+}
+export declare const JwtReadRoleRequest: S.Schema<JwtReadRoleRequest>;
+/** Comma-separated list of 'aud' claims that are valid for login; any match is sufficient */
+export type JwtReadRoleResponseBoundAudiencesList = Array<string>;
+export declare const JwtReadRoleResponseBoundAudiencesList: S.Schema<JwtReadRoleResponseBoundAudiencesList>;
+export interface JwtReadRoleResponse {
+    /** Comma-separated list of 'aud' claims that are valid for login; any match is sufficient */
+    bound_audiences?: JwtReadRoleResponseBoundAudiencesList;
+    /** CEL variables and expression defining the program for the role. This is a map with two fields: 1. 'variables', a list of objects with two fields ('name' and 'expression') defining each variable and the exact execution order. 2. 'expression', the final statement to execute and whose result is returned. For example: cel_program = { "variables": [ { "name": "condition", "expression": "len(claims.groups) > 0" }, { "name": "result", "expression": "pb.Auth{Alias: claims.aud, Groups: claims.groups}" } ], "expression": "condition ? result : false" } */
+    cel_program?: unknown;
+    /** Duration in seconds of leeway when validating all claims to account for clock skew. Defaults to 60 (1 minute) if set to 0 and can be disabled if set to -1. */
+    clock_skew_leeway?: number;
+    /** Duration in seconds of leeway when validating expiration of a token to account for clock skew. Defaults to 150 (2.5 minutes) if set to 0 and can be disabled if set to -1. */
+    expiration_leeway?: number;
+    /** Static error message if validation fails */
+    message?: string;
+    /** Name of the cel role */
+    name?: string;
+    /** Duration in seconds of leeway when validating not before values of a token to account for clock skew. Defaults to 150 (2.5 minutes) if set to 0 and can be disabled if set to -1. */
+    not_before_leeway?: number;
+}
+export declare const JwtReadRoleResponse: S.Schema<JwtReadRoleResponse>;
+export interface JwtReadRoleRequest2 {
+    /** Path that the backend was mounted at */
+    jwt_mount_path: string;
+    /** Name of the role. */
+    name: string;
+}
+export declare const JwtReadRoleRequest2: S.Schema<JwtReadRoleRequest2>;
+export interface JwtReadRole2Response {
+}
+export declare const JwtReadRole2Response: S.Schema<JwtReadRole2Response>;
+export interface JwtReadRoleRequest3 {
+    /** Path that the backend was mounted at */
+    oidc_mount_path: string;
+    /** Name of the cel role */
+    name: string;
+}
+export declare const JwtReadRoleRequest3: S.Schema<JwtReadRoleRequest3>;
+export interface JwtReadRoleRequest4 {
+    /** Path that the backend was mounted at */
+    oidc_mount_path: string;
+    /** Name of the role. */
+    name: string;
+}
+export declare const JwtReadRoleRequest4: S.Schema<JwtReadRoleRequest4>;
+export interface JwtReadRole4Response {
+}
+export declare const JwtReadRole4Response: S.Schema<JwtReadRole4Response>;
+/** Comma-separated list of 'aud' claims that are valid for login; any match is sufficient */
+export type JwtWriteRoleRequestBoundAudiencesList = Array<string>;
+export declare const JwtWriteRoleRequestBoundAudiencesList: S.Schema<JwtWriteRoleRequestBoundAudiencesList>;
+export interface JwtWriteRoleRequest {
+    /** Path that the backend was mounted at */
+    jwt_mount_path: string;
+    /** Name of the cel role */
+    name: string;
+    /** Comma-separated list of 'aud' claims that are valid for login; any match is sufficient */
+    bound_audiences?: JwtWriteRoleRequestBoundAudiencesList;
+    /** CEL variables and expression defining the program for the role. This is a map with two fields: 1. 'variables', a list of objects with two fields ('name' and 'expression') defining each variable and the exact execution order. 2. 'expression', the final statement to execute and whose result is returned. For example: cel_program = { "variables": [ { "name": "condition", "expression": "len(claims.groups) > 0" }, { "name": "result", "expression": "pb.Auth{Alias: claims.aud, Groups: claims.groups}" } ], "expression": "condition ? result : false" } */
+    cel_program?: unknown;
+    /** Duration in seconds of leeway when validating all claims to account for clock skew. Defaults to 60 (1 minute) if set to 0 and can be disabled if set to -1. */
+    clock_skew_leeway?: number;
+    /** Duration in seconds of leeway when validating expiration of a token to account for clock skew. Defaults to 150 (2.5 minutes) if set to 0 and can be disabled if set to -1. */
+    expiration_leeway?: number;
+    /** Static error message if validation fails */
+    message?: string;
+    /** Duration in seconds of leeway when validating not before values of a token to account for clock skew. Defaults to 150 (2.5 minutes) if set to 0 and can be disabled if set to -1. */
+    not_before_leeway?: number;
+}
+export declare const JwtWriteRoleRequest: S.Schema<JwtWriteRoleRequest>;
+/** Comma-separated list of 'aud' claims that are valid for login; any match is sufficient */
+export type JwtWriteRoleResponseBoundAudiencesList = Array<string>;
+export declare const JwtWriteRoleResponseBoundAudiencesList: S.Schema<JwtWriteRoleResponseBoundAudiencesList>;
+export interface JwtWriteRoleResponse {
+    /** Comma-separated list of 'aud' claims that are valid for login; any match is sufficient */
+    bound_audiences?: JwtWriteRoleResponseBoundAudiencesList;
+    /** CEL variables and expression defining the program for the role. This is a map with two fields: 1. 'variables', a list of objects with two fields ('name' and 'expression') defining each variable and the exact execution order. 2. 'expression', the final statement to execute and whose result is returned. For example: cel_program = { "variables": [ { "name": "condition", "expression": "len(claims.groups) > 0" }, { "name": "result", "expression": "pb.Auth{Alias: claims.aud, Groups: claims.groups}" } ], "expression": "condition ? result : false" } */
+    cel_program?: unknown;
+    /** Duration in seconds of leeway when validating all claims to account for clock skew. Defaults to 60 (1 minute) if set to 0 and can be disabled if set to -1. */
+    clock_skew_leeway?: number;
+    /** Duration in seconds of leeway when validating expiration of a token to account for clock skew. Defaults to 150 (2.5 minutes) if set to 0 and can be disabled if set to -1. */
+    expiration_leeway?: number;
+    /** Static error message if validation fails */
+    message?: string;
+    /** Name of the cel role */
+    name?: string;
+    /** Duration in seconds of leeway when validating not before values of a token to account for clock skew. Defaults to 150 (2.5 minutes) if set to 0 and can be disabled if set to -1. */
+    not_before_leeway?: number;
+}
+export declare const JwtWriteRoleResponse: S.Schema<JwtWriteRoleResponse>;
+/** Comma-separated list of 'aud' claims that are valid for login; any match is sufficient */
+export type JwtWriteRoleRequestBoundAudiencesList2 = Array<string>;
+export declare const JwtWriteRoleRequestBoundAudiencesList2: S.Schema<JwtWriteRoleRequestBoundAudiencesList2>;
+export interface JwtWriteRoleRequest2 {
+    /** Path that the backend was mounted at */
+    jwt_mount_path: string;
+    /** Name of the role. */
+    name: string;
+    /** Comma-separated list of 'aud' claims that are valid for login; any match is sufficient */
+    bound_audiences?: JwtWriteRoleRequestBoundAudiencesList2;
+    /** CEL variables and expression defining the program for the role. This is a map with two fields: 1. 'variables', a list of objects with two fields ('name' and 'expression') defining each variable and the exact execution order. 2. 'expression', the final statement to execute and whose result is returned. For example: cel_program = { "variables": [ { "name": "condition", "expression": "len(claims.groups) > 0" }, { "name": "result", "expression": "pb.Auth{Alias: claims.aud, Groups: claims.groups}" } ], "expression": "condition ? result : false" } */
+    cel_program?: unknown;
+    /** Duration in seconds of leeway when validating all claims to account for clock skew. Defaults to 60 (1 minute) if set to 0 and can be disabled if set to -1. */
+    clock_skew_leeway?: number;
+    /** Duration in seconds of leeway when validating expiration of a token to account for clock skew. Defaults to 150 (2.5 minutes) if set to 0 and can be disabled if set to -1. */
+    expiration_leeway?: number;
+    /** Static error message if validation fails */
+    message?: string;
+    /** Duration in seconds of leeway when validating not before values of a token to account for clock skew. Defaults to 150 (2.5 minutes) if set to 0 and can be disabled if set to -1. */
+    not_before_leeway?: number;
+}
+export declare const JwtWriteRoleRequest2: S.Schema<JwtWriteRoleRequest2>;
+export interface JwtWriteRole2Response {
+}
+export declare const JwtWriteRole2Response: S.Schema<JwtWriteRole2Response>;
+/** Comma-separated list of 'aud' claims that are valid for login; any match is sufficient */
+export type JwtWriteRoleRequestBoundAudiencesList3 = Array<string>;
+export declare const JwtWriteRoleRequestBoundAudiencesList3: S.Schema<JwtWriteRoleRequestBoundAudiencesList3>;
+export interface JwtWriteRoleRequest3 {
+    /** Path that the backend was mounted at */
+    oidc_mount_path: string;
+    /** Name of the cel role */
+    name: string;
+    /** Comma-separated list of 'aud' claims that are valid for login; any match is sufficient */
+    bound_audiences?: JwtWriteRoleRequestBoundAudiencesList3;
+    /** CEL variables and expression defining the program for the role. This is a map with two fields: 1. 'variables', a list of objects with two fields ('name' and 'expression') defining each variable and the exact execution order. 2. 'expression', the final statement to execute and whose result is returned. For example: cel_program = { "variables": [ { "name": "condition", "expression": "len(claims.groups) > 0" }, { "name": "result", "expression": "pb.Auth{Alias: claims.aud, Groups: claims.groups}" } ], "expression": "condition ? result : false" } */
+    cel_program?: unknown;
+    /** Duration in seconds of leeway when validating all claims to account for clock skew. Defaults to 60 (1 minute) if set to 0 and can be disabled if set to -1. */
+    clock_skew_leeway?: number;
+    /** Duration in seconds of leeway when validating expiration of a token to account for clock skew. Defaults to 150 (2.5 minutes) if set to 0 and can be disabled if set to -1. */
+    expiration_leeway?: number;
+    /** Static error message if validation fails */
+    message?: string;
+    /** Duration in seconds of leeway when validating not before values of a token to account for clock skew. Defaults to 150 (2.5 minutes) if set to 0 and can be disabled if set to -1. */
+    not_before_leeway?: number;
+}
+export declare const JwtWriteRoleRequest3: S.Schema<JwtWriteRoleRequest3>;
+/** Comma-separated list of 'aud' claims that are valid for login; any match is sufficient */
+export type JwtWriteRoleRequestBoundAudiencesList4 = Array<string>;
+export declare const JwtWriteRoleRequestBoundAudiencesList4: S.Schema<JwtWriteRoleRequestBoundAudiencesList4>;
+export interface JwtWriteRoleRequest4 {
+    /** Path that the backend was mounted at */
+    oidc_mount_path: string;
+    /** Name of the role. */
+    name: string;
+    /** Comma-separated list of 'aud' claims that are valid for login; any match is sufficient */
+    bound_audiences?: JwtWriteRoleRequestBoundAudiencesList4;
+    /** CEL variables and expression defining the program for the role. This is a map with two fields: 1. 'variables', a list of objects with two fields ('name' and 'expression') defining each variable and the exact execution order. 2. 'expression', the final statement to execute and whose result is returned. For example: cel_program = { "variables": [ { "name": "condition", "expression": "len(claims.groups) > 0" }, { "name": "result", "expression": "pb.Auth{Alias: claims.aud, Groups: claims.groups}" } ], "expression": "condition ? result : false" } */
+    cel_program?: unknown;
+    /** Duration in seconds of leeway when validating all claims to account for clock skew. Defaults to 60 (1 minute) if set to 0 and can be disabled if set to -1. */
+    clock_skew_leeway?: number;
+    /** Duration in seconds of leeway when validating expiration of a token to account for clock skew. Defaults to 150 (2.5 minutes) if set to 0 and can be disabled if set to -1. */
+    expiration_leeway?: number;
+    /** Static error message if validation fails */
+    message?: string;
+    /** Duration in seconds of leeway when validating not before values of a token to account for clock skew. Defaults to 150 (2.5 minutes) if set to 0 and can be disabled if set to -1. */
+    not_before_leeway?: number;
+}
+export declare const JwtWriteRoleRequest4: S.Schema<JwtWriteRoleRequest4>;
+export interface JwtWriteRole4Response {
+}
+export declare const JwtWriteRole4Response: S.Schema<JwtWriteRole4Response>;
+export interface LoginJwtRequest {
+    /** Path that the backend was mounted at */
+    jwt_mount_path: string;
+    /** The signed JWT to validate. */
+    jwt?: string;
+    /** The CEL role to log in against. */
+    role?: string;
+}
+export declare const LoginJwtRequest: S.Schema<LoginJwtRequest>;
+export interface LoginJwtResponse {
+}
+export declare const LoginJwtResponse: S.Schema<LoginJwtResponse>;
+export interface LoginJwtRequest2 {
+    /** Path that the backend was mounted at */
+    jwt_mount_path: string;
+    /** The signed JWT to validate. */
+    jwt?: string;
+    /** The CEL role to log in against. */
+    role?: string;
+}
+export declare const LoginJwtRequest2: S.Schema<LoginJwtRequest2>;
+export interface LoginJwt2Response {
+}
+export declare const LoginJwt2Response: S.Schema<LoginJwt2Response>;
+export interface LoginJwtRequest3 {
+    /** Path that the backend was mounted at */
+    oidc_mount_path: string;
+    /** The signed JWT to validate. */
+    jwt?: string;
+    /** The CEL role to log in against. */
+    role?: string;
+}
+export declare const LoginJwtRequest3: S.Schema<LoginJwtRequest3>;
+export interface LoginJwt3Response {
+}
+export declare const LoginJwt3Response: S.Schema<LoginJwt3Response>;
+export interface LoginJwtRequest4 {
+    /** Path that the backend was mounted at */
+    oidc_mount_path: string;
+    /** The signed JWT to validate. */
+    jwt?: string;
+    /** The CEL role to log in against. */
+    role?: string;
+}
+export declare const LoginJwtRequest4: S.Schema<LoginJwtRequest4>;
+export interface LoginJwt4Response {
+}
+export declare const LoginJwt4Response: S.Schema<LoginJwt4Response>;
+export interface PollJwtWriteOidcRequest {
+    /** Path that the backend was mounted at */
+    jwt_mount_path: string;
+    client_nonce?: string;
+    state?: string;
+}
+export declare const PollJwtWriteOidcRequest: S.Schema<PollJwtWriteOidcRequest>;
+export interface PollJwtWriteOidcResponse {
+}
+export declare const PollJwtWriteOidcResponse: S.Schema<PollJwtWriteOidcResponse>;
+export interface PostJwtOidcCallbackFormRequest {
+    /** Path that the backend was mounted at */
+    jwt_mount_path: string;
+    client_nonce?: string;
+    code?: string;
+    confirmation?: string;
+    error?: string;
+    error_description?: string;
+    error_uri?: string;
+    state?: string;
+    id_token?: string;
+}
+export declare const PostJwtOidcCallbackFormRequest: S.Schema<PostJwtOidcCallbackFormRequest>;
+export interface PostJwtOidcCallbackFormResponse {
+}
+export declare const PostJwtOidcCallbackFormResponse: S.Schema<PostJwtOidcCallbackFormResponse>;
+export interface PostJwtOidcCallbackFormRequest2 {
+    /** Path that the backend was mounted at */
+    oidc_mount_path: string;
+    client_nonce?: string;
+    code?: string;
+    confirmation?: string;
+    error?: string;
+    error_description?: string;
+    error_uri?: string;
+    state?: string;
+    id_token?: string;
+}
+export declare const PostJwtOidcCallbackFormRequest2: S.Schema<PostJwtOidcCallbackFormRequest2>;
+export interface PostJwtOidcCallbackForm2Response {
+}
+export declare const PostJwtOidcCallbackForm2Response: S.Schema<PostJwtOidcCallbackForm2Response>;
+export type JwtConfigureError = OpenBaoOpError;
+/** Configure the JWT authentication backend. The JWT authentication backend validates JWTs (or OIDC) using the configured credentials. If using OIDC Discovery, the URL must be provided, along with (optionally) the CA cert to use for the connection. If performing JWT validation locally, a set of public keys must be provided. */
+export declare const jwtConfigure: API.OperationMethod<JwtConfigureRequest, JwtConfigureResponse, JwtConfigureError, OpenBaoOpContext>;
+export type JwtConfigure2Error = OpenBaoOpError;
+/** Configure the JWT authentication backend. The JWT authentication backend validates JWTs (or OIDC) using the configured credentials. If using OIDC Discovery, the URL must be provided, along with (optionally) the CA cert to use for the connection. If performing JWT validation locally, a set of public keys must be provided. */
+export declare const jwtConfigure2: API.OperationMethod<JwtConfigureRequest2, JwtConfigure2Response, JwtConfigure2Error, OpenBaoOpContext>;
+export type JwtDeleteRoleError = OpenBaoOpError;
+export declare const jwtDeleteRole: API.OperationMethod<JwtDeleteRoleRequest, JwtDeleteRoleResponse, JwtDeleteRoleError, OpenBaoOpContext>;
+export type JwtDeleteRole2Error = OpenBaoOpError;
+/** Delete an existing role. */
+export declare const jwtDeleteRole2: API.OperationMethod<JwtDeleteRoleRequest2, JwtDeleteRole2Response, JwtDeleteRole2Error, OpenBaoOpContext>;
+export type JwtDeleteRole3Error = OpenBaoOpError;
+export declare const jwtDeleteRole3: API.OperationMethod<JwtDeleteRoleRequest3, JwtDeleteRole3Response, JwtDeleteRole3Error, OpenBaoOpContext>;
+export type JwtDeleteRole4Error = OpenBaoOpError;
+/** Delete an existing role. */
+export declare const jwtDeleteRole4: API.OperationMethod<JwtDeleteRoleRequest4, JwtDeleteRole4Response, JwtDeleteRole4Error, OpenBaoOpContext>;
+export type JwtListCelError = OpenBaoOpError;
+export declare const jwtListCel: API.OperationMethod<JwtListCelRequest, JwtListCelResponse, JwtListCelError, OpenBaoOpContext>;
+export type JwtListCel2Error = OpenBaoOpError;
+export declare const jwtListCel2: API.OperationMethod<JwtListCelRequest2, JwtListCelResponse, JwtListCel2Error, OpenBaoOpContext>;
+export type JwtListRolesError = OpenBaoOpError;
+/** Lists all the roles registered with the backend. The list will contain the names of the roles. */
+export declare const jwtListRoles: API.OperationMethod<JwtListRolesRequest, JwtListRolesResponse, JwtListRolesError, OpenBaoOpContext>;
+export type JwtListRoles2Error = OpenBaoOpError;
+/** Lists all the roles registered with the backend. The list will contain the names of the roles. */
+export declare const jwtListRoles2: API.OperationMethod<JwtListRolesRequest2, JwtListRoles2Response, JwtListRoles2Error, OpenBaoOpContext>;
+export type JwtOidcCallbackError = OpenBaoOpError;
+/** Callback endpoint to complete an OIDC login. */
+export declare const jwtOidcCallback: API.OperationMethod<JwtOidcCallbackRequest, JwtOidcCallbackResponse, JwtOidcCallbackError, OpenBaoOpContext>;
+export type JwtOidcCallback2Error = OpenBaoOpError;
+/** Callback endpoint to complete an OIDC login. */
+export declare const jwtOidcCallback2: API.OperationMethod<JwtOidcCallbackRequest2, JwtOidcCallback2Response, JwtOidcCallback2Error, OpenBaoOpContext>;
+export type JwtOidcRequestAuthorizationUrlError = OpenBaoOpError;
+/** Request an authorization URL to start an OIDC login flow. */
+export declare const jwtOidcRequestAuthorizationUrl: API.OperationMethod<JwtOidcRequestAuthorizationUrlRequest, JwtOidcRequestAuthorizationUrlResponse, JwtOidcRequestAuthorizationUrlError, OpenBaoOpContext>;
+export type JwtOidcRequestAuthorizationUrl2Error = OpenBaoOpError;
+/** Request an authorization URL to start an OIDC login flow. */
+export declare const jwtOidcRequestAuthorizationUrl2: API.OperationMethod<JwtOidcRequestAuthorizationUrlRequest2, JwtOidcRequestAuthorizationUrl2Response, JwtOidcRequestAuthorizationUrl2Error, OpenBaoOpContext>;
+export type JwtPatchRoleError = OpenBaoOpError;
+export declare const jwtPatchRole: API.OperationMethod<JwtPatchRoleRequest, JwtPatchRoleResponse, JwtPatchRoleError, OpenBaoOpContext>;
+export type JwtPatchRole2Error = OpenBaoOpError;
+export declare const jwtPatchRole2: API.OperationMethod<JwtPatchRoleRequest2, JwtPatchRoleResponse, JwtPatchRole2Error, OpenBaoOpContext>;
+export type JwtReadConfigurationError = OpenBaoOpError;
+/** Read the current JWT authentication backend configuration. */
+export declare const jwtReadConfiguration: API.OperationMethod<JwtReadConfigurationRequest, JwtReadConfigurationResponse, JwtReadConfigurationError, OpenBaoOpContext>;
+export type JwtReadConfiguration2Error = OpenBaoOpError;
+/** Read the current JWT authentication backend configuration. */
+export declare const jwtReadConfiguration2: API.OperationMethod<JwtReadConfigurationRequest2, JwtReadConfiguration2Response, JwtReadConfiguration2Error, OpenBaoOpContext>;
+export type JwtReadRoleError = OpenBaoOpError;
+export declare const jwtReadRole: API.OperationMethod<JwtReadRoleRequest, JwtReadRoleResponse, JwtReadRoleError, OpenBaoOpContext>;
+export type JwtReadRole2Error = OpenBaoOpError;
+/** Read an existing role. */
+export declare const jwtReadRole2: API.OperationMethod<JwtReadRoleRequest2, JwtReadRole2Response, JwtReadRole2Error, OpenBaoOpContext>;
+export type JwtReadRole3Error = OpenBaoOpError;
+export declare const jwtReadRole3: API.OperationMethod<JwtReadRoleRequest3, JwtReadRoleResponse, JwtReadRole3Error, OpenBaoOpContext>;
+export type JwtReadRole4Error = OpenBaoOpError;
+/** Read an existing role. */
+export declare const jwtReadRole4: API.OperationMethod<JwtReadRoleRequest4, JwtReadRole4Response, JwtReadRole4Error, OpenBaoOpContext>;
+export type JwtWriteRoleError = OpenBaoOpError;
+export declare const jwtWriteRole: API.OperationMethod<JwtWriteRoleRequest, JwtWriteRoleResponse, JwtWriteRoleError, OpenBaoOpContext>;
+export type JwtWriteRole2Error = OpenBaoOpError;
+/** Register an role with the backend. A role is required to authenticate with this backend. The role binds JWT token information with token policies and settings. The bindings, token polices and token settings can all be configured using this endpoint */
+export declare const jwtWriteRole2: API.OperationMethod<JwtWriteRoleRequest2, JwtWriteRole2Response, JwtWriteRole2Error, OpenBaoOpContext>;
+export type JwtWriteRole3Error = OpenBaoOpError;
+export declare const jwtWriteRole3: API.OperationMethod<JwtWriteRoleRequest3, JwtWriteRoleResponse, JwtWriteRole3Error, OpenBaoOpContext>;
+export type JwtWriteRole4Error = OpenBaoOpError;
+/** Register an role with the backend. A role is required to authenticate with this backend. The role binds JWT token information with token policies and settings. The bindings, token polices and token settings can all be configured using this endpoint */
+export declare const jwtWriteRole4: API.OperationMethod<JwtWriteRoleRequest4, JwtWriteRole4Response, JwtWriteRole4Error, OpenBaoOpContext>;
+export type LoginJwtError = OpenBaoOpError;
+/** Authenticates to OpenBao using a JWT (or OIDC) token against a CEL role. */
+export declare const loginJwt: API.OperationMethod<LoginJwtRequest, LoginJwtResponse, LoginJwtError, OpenBaoOpContext>;
+export type LoginJwt2Error = OpenBaoOpError;
+/** Authenticates to OpenBao using a JWT (or OIDC) token. */
+export declare const loginJwt2: API.OperationMethod<LoginJwtRequest2, LoginJwt2Response, LoginJwt2Error, OpenBaoOpContext>;
+export type LoginJwt3Error = OpenBaoOpError;
+/** Authenticates to OpenBao using a JWT (or OIDC) token against a CEL role. */
+export declare const loginJwt3: API.OperationMethod<LoginJwtRequest3, LoginJwt3Response, LoginJwt3Error, OpenBaoOpContext>;
+export type LoginJwt4Error = OpenBaoOpError;
+/** Authenticates to OpenBao using a JWT (or OIDC) token. */
+export declare const loginJwt4: API.OperationMethod<LoginJwtRequest4, LoginJwt4Response, LoginJwt4Error, OpenBaoOpContext>;
+export type PollJwtWriteOidcError = OpenBaoOpError;
+/** Poll endpoint to complete an OIDC login. */
+export declare const pollJwtWriteOidc: API.OperationMethod<PollJwtWriteOidcRequest, PollJwtWriteOidcResponse, PollJwtWriteOidcError, OpenBaoOpContext>;
+export type PostJwtOidcCallbackFormError = OpenBaoOpError;
+/** Callback endpoint to handle form_posts. */
+export declare const postJwtOidcCallbackForm: API.OperationMethod<PostJwtOidcCallbackFormRequest, PostJwtOidcCallbackFormResponse, PostJwtOidcCallbackFormError, OpenBaoOpContext>;
+export type PostJwtOidcCallbackForm2Error = OpenBaoOpError;
+/** Callback endpoint to handle form_posts. */
+export declare const postJwtOidcCallbackForm2: API.OperationMethod<PostJwtOidcCallbackFormRequest2, PostJwtOidcCallbackForm2Response, PostJwtOidcCallbackForm2Error, OpenBaoOpContext>;
+//# sourceMappingURL=jwt.d.ts.map