@homeflare/distilled-openbao 0.2.0

package/src/services/approle.ts

@@ -0,0 +1,2750 @@
+// AUTO-GENERATED by scripts/generate.ts from .generated-specs (specs/spec-mirror-openbao, generated — see fetch-specs.ts). Do not edit.
+import * as S from "@distilled.cloud/core/schema";
+import * as API from "@distilled.cloud/core/api";
+import * as T from "../traits.ts";
+import {
+  OpenBaoProtocol,
+  type OpenBaoOpError,
+  type OpenBaoOpContext,
+} from "../protocol.ts";
+import * as Retry from "../retry.ts";
+
+export type { OpenBaoOpError, OpenBaoOpContext };
+
+export interface AppRoleDeleteBindSecretIdRequest {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+  /** Name of the role. Must be less than 4096 bytes. */
+  role_name: string;
+}
+export const AppRoleDeleteBindSecretIdRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    approle_mount_path: S.String.pipe(T.Label()),
+    role_name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "DELETE",
+      uri: "/auth/{approle_mount_path}/role/{role_name}/bind-secret-id",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "AppRoleDeleteBindSecretIdRequest",
+}) as any as S.Schema<AppRoleDeleteBindSecretIdRequest>;
+
+export interface AppRoleDeleteBindSecretIdResponse {}
+export const AppRoleDeleteBindSecretIdResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "AppRoleDeleteBindSecretIdResponse",
+}) as any as S.Schema<AppRoleDeleteBindSecretIdResponse>;
+
+export interface AppRoleDeleteBoundCidrListRequest {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+  /** Name of the role. Must be less than 4096 bytes. */
+  role_name: string;
+}
+export const AppRoleDeleteBoundCidrListRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    approle_mount_path: S.String.pipe(T.Label()),
+    role_name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "DELETE",
+      uri: "/auth/{approle_mount_path}/role/{role_name}/bound-cidr-list",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "AppRoleDeleteBoundCidrListRequest",
+}) as any as S.Schema<AppRoleDeleteBoundCidrListRequest>;
+
+export interface AppRoleDeleteBoundCidrListResponse {}
+export const AppRoleDeleteBoundCidrListResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "AppRoleDeleteBoundCidrListResponse",
+}) as any as S.Schema<AppRoleDeleteBoundCidrListResponse>;
+
+export interface AppRoleDeletePeriodRequest {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+  /** Name of the role. Must be less than 4096 bytes. */
+  role_name: string;
+}
+export const AppRoleDeletePeriodRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    approle_mount_path: S.String.pipe(T.Label()),
+    role_name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "DELETE",
+      uri: "/auth/{approle_mount_path}/role/{role_name}/period",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "AppRoleDeletePeriodRequest",
+}) as any as S.Schema<AppRoleDeletePeriodRequest>;
+
+export interface AppRoleDeletePeriodResponse {}
+export const AppRoleDeletePeriodResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "AppRoleDeletePeriodResponse",
+}) as any as S.Schema<AppRoleDeletePeriodResponse>;
+
+export interface AppRoleDeletePoliciesRequest {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+  /** Name of the role. Must be less than 4096 bytes. */
+  role_name: string;
+}
+export const AppRoleDeletePoliciesRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    approle_mount_path: S.String.pipe(T.Label()),
+    role_name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "DELETE",
+      uri: "/auth/{approle_mount_path}/role/{role_name}/policies",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "AppRoleDeletePoliciesRequest",
+}) as any as S.Schema<AppRoleDeletePoliciesRequest>;
+
+export interface AppRoleDeletePoliciesResponse {}
+export const AppRoleDeletePoliciesResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "AppRoleDeletePoliciesResponse",
+}) as any as S.Schema<AppRoleDeletePoliciesResponse>;
+
+export interface AppRoleDeleteRoleRequest {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+  /** Name of the role. Must be less than 4096 bytes. */
+  role_name: string;
+}
+export const AppRoleDeleteRoleRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    approle_mount_path: S.String.pipe(T.Label()),
+    role_name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "DELETE",
+      uri: "/auth/{approle_mount_path}/role/{role_name}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "AppRoleDeleteRoleRequest",
+}) as any as S.Schema<AppRoleDeleteRoleRequest>;
+
+export interface AppRoleDeleteRoleResponse {}
+export const AppRoleDeleteRoleResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "AppRoleDeleteRoleResponse",
+}) as any as S.Schema<AppRoleDeleteRoleResponse>;
+
+export interface AppRoleDeleteSecretIdBoundCidrsRequest {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+  /** Name of the role. Must be less than 4096 bytes. */
+  role_name: string;
+}
+export const AppRoleDeleteSecretIdBoundCidrsRequest = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({
+      approle_mount_path: S.String.pipe(T.Label()),
+      role_name: S.String.pipe(T.Label()),
+    }).pipe(
+      T.Http({
+        method: "DELETE",
+        uri: "/auth/{approle_mount_path}/role/{role_name}/secret-id-bound-cidrs",
+        code: 200,
+      }),
+    ),
+).annotate({
+  identifier: "AppRoleDeleteSecretIdBoundCidrsRequest",
+}) as any as S.Schema<AppRoleDeleteSecretIdBoundCidrsRequest>;
+
+export interface AppRoleDeleteSecretIdBoundCidrsResponse {}
+export const AppRoleDeleteSecretIdBoundCidrsResponse = /*@__PURE__*/ S.suspend(
+  () => S.Struct({}),
+).annotate({
+  identifier: "AppRoleDeleteSecretIdBoundCidrsResponse",
+}) as any as S.Schema<AppRoleDeleteSecretIdBoundCidrsResponse>;
+
+export interface AppRoleDeleteSecretIdNumUsesRequest {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+  /** Name of the role. Must be less than 4096 bytes. */
+  role_name: string;
+}
+export const AppRoleDeleteSecretIdNumUsesRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    approle_mount_path: S.String.pipe(T.Label()),
+    role_name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "DELETE",
+      uri: "/auth/{approle_mount_path}/role/{role_name}/secret-id-num-uses",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "AppRoleDeleteSecretIdNumUsesRequest",
+}) as any as S.Schema<AppRoleDeleteSecretIdNumUsesRequest>;
+
+export interface AppRoleDeleteSecretIdNumUsesResponse {}
+export const AppRoleDeleteSecretIdNumUsesResponse = /*@__PURE__*/ S.suspend(
+  () => S.Struct({}),
+).annotate({
+  identifier: "AppRoleDeleteSecretIdNumUsesResponse",
+}) as any as S.Schema<AppRoleDeleteSecretIdNumUsesResponse>;
+
+export interface AppRoleDeleteSecretIdTtlRequest {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+  /** Name of the role. Must be less than 4096 bytes. */
+  role_name: string;
+}
+export const AppRoleDeleteSecretIdTtlRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    approle_mount_path: S.String.pipe(T.Label()),
+    role_name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "DELETE",
+      uri: "/auth/{approle_mount_path}/role/{role_name}/secret-id-ttl",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "AppRoleDeleteSecretIdTtlRequest",
+}) as any as S.Schema<AppRoleDeleteSecretIdTtlRequest>;
+
+export interface AppRoleDeleteSecretIdTtlResponse {}
+export const AppRoleDeleteSecretIdTtlResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "AppRoleDeleteSecretIdTtlResponse",
+}) as any as S.Schema<AppRoleDeleteSecretIdTtlResponse>;
+
+export interface AppRoleDeleteTokenBoundCidrsRequest {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+  /** Name of the role. Must be less than 4096 bytes. */
+  role_name: string;
+}
+export const AppRoleDeleteTokenBoundCidrsRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    approle_mount_path: S.String.pipe(T.Label()),
+    role_name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "DELETE",
+      uri: "/auth/{approle_mount_path}/role/{role_name}/token-bound-cidrs",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "AppRoleDeleteTokenBoundCidrsRequest",
+}) as any as S.Schema<AppRoleDeleteTokenBoundCidrsRequest>;
+
+export interface AppRoleDeleteTokenBoundCidrsResponse {}
+export const AppRoleDeleteTokenBoundCidrsResponse = /*@__PURE__*/ S.suspend(
+  () => S.Struct({}),
+).annotate({
+  identifier: "AppRoleDeleteTokenBoundCidrsResponse",
+}) as any as S.Schema<AppRoleDeleteTokenBoundCidrsResponse>;
+
+export interface AppRoleDeleteTokenMaxTtlRequest {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+  /** Name of the role. Must be less than 4096 bytes. */
+  role_name: string;
+}
+export const AppRoleDeleteTokenMaxTtlRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    approle_mount_path: S.String.pipe(T.Label()),
+    role_name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "DELETE",
+      uri: "/auth/{approle_mount_path}/role/{role_name}/token-max-ttl",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "AppRoleDeleteTokenMaxTtlRequest",
+}) as any as S.Schema<AppRoleDeleteTokenMaxTtlRequest>;
+
+export interface AppRoleDeleteTokenMaxTtlResponse {}
+export const AppRoleDeleteTokenMaxTtlResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "AppRoleDeleteTokenMaxTtlResponse",
+}) as any as S.Schema<AppRoleDeleteTokenMaxTtlResponse>;
+
+export interface AppRoleDeleteTokenNumUsesRequest {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+  /** Name of the role. Must be less than 4096 bytes. */
+  role_name: string;
+}
+export const AppRoleDeleteTokenNumUsesRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    approle_mount_path: S.String.pipe(T.Label()),
+    role_name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "DELETE",
+      uri: "/auth/{approle_mount_path}/role/{role_name}/token-num-uses",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "AppRoleDeleteTokenNumUsesRequest",
+}) as any as S.Schema<AppRoleDeleteTokenNumUsesRequest>;
+
+export interface AppRoleDeleteTokenNumUsesResponse {}
+export const AppRoleDeleteTokenNumUsesResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "AppRoleDeleteTokenNumUsesResponse",
+}) as any as S.Schema<AppRoleDeleteTokenNumUsesResponse>;
+
+export interface AppRoleDeleteTokenTtlRequest {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+  /** Name of the role. Must be less than 4096 bytes. */
+  role_name: string;
+}
+export const AppRoleDeleteTokenTtlRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    approle_mount_path: S.String.pipe(T.Label()),
+    role_name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "DELETE",
+      uri: "/auth/{approle_mount_path}/role/{role_name}/token-ttl",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "AppRoleDeleteTokenTtlRequest",
+}) as any as S.Schema<AppRoleDeleteTokenTtlRequest>;
+
+export interface AppRoleDeleteTokenTtlResponse {}
+export const AppRoleDeleteTokenTtlResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "AppRoleDeleteTokenTtlResponse",
+}) as any as S.Schema<AppRoleDeleteTokenTtlResponse>;
+
+export interface AppRoleDestroySecretIdRequest {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+  /** Name of the role. Must be less than 4096 bytes. */
+  role_name: string;
+  /** SecretID attached to the role. */
+  secret_id?: string;
+}
+export const AppRoleDestroySecretIdRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    approle_mount_path: S.String.pipe(T.Label()),
+    role_name: S.String.pipe(T.Label()),
+    secret_id: S.optional(S.String),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/auth/{approle_mount_path}/role/{role_name}/secret-id/destroy",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "AppRoleDestroySecretIdRequest",
+}) as any as S.Schema<AppRoleDestroySecretIdRequest>;
+
+export interface AppRoleDestroySecretIdResponse {}
+export const AppRoleDestroySecretIdResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "AppRoleDestroySecretIdResponse",
+}) as any as S.Schema<AppRoleDestroySecretIdResponse>;
+
+export interface AppRoleDestroySecretId2Request {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+  /** Name of the role. Must be less than 4096 bytes. */
+  role_name: string;
+}
+export const AppRoleDestroySecretId2Request = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    approle_mount_path: S.String.pipe(T.Label()),
+    role_name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "DELETE",
+      uri: "/auth/{approle_mount_path}/role/{role_name}/secret-id/destroy",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "AppRoleDestroySecretId2Request",
+}) as any as S.Schema<AppRoleDestroySecretId2Request>;
+
+export interface AppRoleDestroySecretId2Response {}
+export const AppRoleDestroySecretId2Response = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "AppRoleDestroySecretId2Response",
+}) as any as S.Schema<AppRoleDestroySecretId2Response>;
+
+export interface AppRoleDestroySecretIdByAccessorRequest {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+  /** Name of the role. Must be less than 4096 bytes. */
+  role_name: string;
+  /** Accessor of the SecretID */
+  secret_id_accessor?: string;
+}
+export const AppRoleDestroySecretIdByAccessorRequest = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({
+      approle_mount_path: S.String.pipe(T.Label()),
+      role_name: S.String.pipe(T.Label()),
+      secret_id_accessor: S.optional(S.String),
+    }).pipe(
+      T.Http({
+        method: "POST",
+        uri: "/auth/{approle_mount_path}/role/{role_name}/secret-id-accessor/destroy",
+        code: 200,
+      }),
+    ),
+).annotate({
+  identifier: "AppRoleDestroySecretIdByAccessorRequest",
+}) as any as S.Schema<AppRoleDestroySecretIdByAccessorRequest>;
+
+export interface AppRoleDestroySecretIdByAccessorResponse {}
+export const AppRoleDestroySecretIdByAccessorResponse = /*@__PURE__*/ S.suspend(
+  () => S.Struct({}),
+).annotate({
+  identifier: "AppRoleDestroySecretIdByAccessorResponse",
+}) as any as S.Schema<AppRoleDestroySecretIdByAccessorResponse>;
+
+export interface AppRoleDestroySecretIdByAccessor2Request {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+  /** Name of the role. Must be less than 4096 bytes. */
+  role_name: string;
+}
+export const AppRoleDestroySecretIdByAccessor2Request = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({
+      approle_mount_path: S.String.pipe(T.Label()),
+      role_name: S.String.pipe(T.Label()),
+    }).pipe(
+      T.Http({
+        method: "DELETE",
+        uri: "/auth/{approle_mount_path}/role/{role_name}/secret-id-accessor/destroy",
+        code: 200,
+      }),
+    ),
+).annotate({
+  identifier: "AppRoleDestroySecretIdByAccessor2Request",
+}) as any as S.Schema<AppRoleDestroySecretIdByAccessor2Request>;
+
+export interface AppRoleDestroySecretIdByAccessor2Response {}
+export const AppRoleDestroySecretIdByAccessor2Response =
+  /*@__PURE__*/ S.suspend(() => S.Struct({})).annotate({
+    identifier: "AppRoleDestroySecretIdByAccessor2Response",
+  }) as any as S.Schema<AppRoleDestroySecretIdByAccessor2Response>;
+
+export type AppRoleListRolesRequestList = "true";
+export const AppRoleListRolesRequestList = S.String;
+
+export interface AppRoleListRolesRequest {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+  /** Must be set to `true` */
+  list: AppRoleListRolesRequestList | (string & {});
+}
+export const AppRoleListRolesRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    approle_mount_path: S.String.pipe(T.Label()),
+    list: AppRoleListRolesRequestList.pipe(T.Query()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/auth/{approle_mount_path}/role",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "AppRoleListRolesRequest",
+}) as any as S.Schema<AppRoleListRolesRequest>;
+
+export type AppRoleListRolesResponseKeysList = Array<string>;
+export const AppRoleListRolesResponseKeysList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<AppRoleListRolesResponseKeysList>;
+
+export interface AppRoleListRolesResponse {
+  keys?: AppRoleListRolesResponseKeysList;
+}
+export const AppRoleListRolesResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    keys: S.optional(AppRoleListRolesResponseKeysList),
+  }),
+).annotate({
+  identifier: "AppRoleListRolesResponse",
+}) as any as S.Schema<AppRoleListRolesResponse>;
+
+export type AppRoleListSecretIdsRequestList = "true";
+export const AppRoleListSecretIdsRequestList = S.String;
+
+export interface AppRoleListSecretIdsRequest {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+  /** Name of the role. Must be less than 4096 bytes. */
+  role_name: string;
+  /** Must be set to `true` */
+  list: AppRoleListSecretIdsRequestList | (string & {});
+}
+export const AppRoleListSecretIdsRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    approle_mount_path: S.String.pipe(T.Label()),
+    role_name: S.String.pipe(T.Label()),
+    list: AppRoleListSecretIdsRequestList.pipe(T.Query()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/auth/{approle_mount_path}/role/{role_name}/secret-id",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "AppRoleListSecretIdsRequest",
+}) as any as S.Schema<AppRoleListSecretIdsRequest>;
+
+export type AppRoleListSecretIdsResponseKeysList = Array<string>;
+export const AppRoleListSecretIdsResponseKeysList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<AppRoleListSecretIdsResponseKeysList>;
+
+export interface AppRoleListSecretIdsResponse {
+  keys?: AppRoleListSecretIdsResponseKeysList;
+}
+export const AppRoleListSecretIdsResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    keys: S.optional(AppRoleListSecretIdsResponseKeysList),
+  }),
+).annotate({
+  identifier: "AppRoleListSecretIdsResponse",
+}) as any as S.Schema<AppRoleListSecretIdsResponse>;
+
+export interface AppRoleLookUpSecretIdRequest {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+  /** Name of the role. Must be less than 4096 bytes. */
+  role_name: string;
+  /** SecretID attached to the role. */
+  secret_id?: string;
+}
+export const AppRoleLookUpSecretIdRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    approle_mount_path: S.String.pipe(T.Label()),
+    role_name: S.String.pipe(T.Label()),
+    secret_id: S.optional(S.String),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/auth/{approle_mount_path}/role/{role_name}/secret-id/lookup",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "AppRoleLookUpSecretIdRequest",
+}) as any as S.Schema<AppRoleLookUpSecretIdRequest>;
+
+/** List of CIDR blocks enforcing secret IDs to be used from specific set of IP addresses. If 'bound_cidr_list' is set on the role, then the list of CIDR blocks listed here should be a subset of the CIDR blocks listed on the role. */
+export type AppRoleLookUpSecretIdResponseCidrListList = Array<string>;
+export const AppRoleLookUpSecretIdResponseCidrListList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<AppRoleLookUpSecretIdResponseCidrListList>;
+
+/** List of CIDR blocks. If set, specifies the blocks of IP addresses which can use the returned token. Should be a subset of the token CIDR blocks listed on the role, if any. */
+export type AppRoleLookUpSecretIdResponseTokenBoundCidrsList = Array<string>;
+export const AppRoleLookUpSecretIdResponseTokenBoundCidrsList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<AppRoleLookUpSecretIdResponseTokenBoundCidrsList>;
+
+export interface AppRoleLookUpSecretIdResponse {
+  /** List of CIDR blocks enforcing secret IDs to be used from specific set of IP addresses. If 'bound_cidr_list' is set on the role, then the list of CIDR blocks listed here should be a subset of the CIDR blocks listed on the role. */
+  cidr_list?: AppRoleLookUpSecretIdResponseCidrListList;
+  creation_time?: string;
+  expiration_time?: string;
+  last_updated_time?: string;
+  metadata?: unknown;
+  /** Accessor of the secret ID */
+  secret_id_accessor?: string;
+  /** Number of times a secret ID can access the role, after which the secret ID will expire. */
+  secret_id_num_uses?: number;
+  /** Duration in seconds after which the issued secret ID expires. */
+  secret_id_ttl?: number;
+  /** List of CIDR blocks. If set, specifies the blocks of IP addresses which can use the returned token. Should be a subset of the token CIDR blocks listed on the role, if any. */
+  token_bound_cidrs?: AppRoleLookUpSecretIdResponseTokenBoundCidrsList;
+}
+export const AppRoleLookUpSecretIdResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    cidr_list: S.optional(AppRoleLookUpSecretIdResponseCidrListList),
+    creation_time: S.optional(S.String),
+    expiration_time: S.optional(S.String),
+    last_updated_time: S.optional(S.String),
+    metadata: S.optional(S.Unknown),
+    secret_id_accessor: S.optional(S.String),
+    secret_id_num_uses: S.optional(S.Number),
+    secret_id_ttl: S.optional(S.Number),
+    token_bound_cidrs: S.optional(
+      AppRoleLookUpSecretIdResponseTokenBoundCidrsList,
+    ),
+  }),
+).annotate({
+  identifier: "AppRoleLookUpSecretIdResponse",
+}) as any as S.Schema<AppRoleLookUpSecretIdResponse>;
+
+export interface AppRoleLookUpSecretIdByAccessorRequest {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+  /** Name of the role. Must be less than 4096 bytes. */
+  role_name: string;
+  /** Accessor of the SecretID */
+  secret_id_accessor?: string;
+}
+export const AppRoleLookUpSecretIdByAccessorRequest = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({
+      approle_mount_path: S.String.pipe(T.Label()),
+      role_name: S.String.pipe(T.Label()),
+      secret_id_accessor: S.optional(S.String),
+    }).pipe(
+      T.Http({
+        method: "POST",
+        uri: "/auth/{approle_mount_path}/role/{role_name}/secret-id-accessor/lookup",
+        code: 200,
+      }),
+    ),
+).annotate({
+  identifier: "AppRoleLookUpSecretIdByAccessorRequest",
+}) as any as S.Schema<AppRoleLookUpSecretIdByAccessorRequest>;
+
+/** List of CIDR blocks enforcing secret IDs to be used from specific set of IP addresses. If 'bound_cidr_list' is set on the role, then the list of CIDR blocks listed here should be a subset of the CIDR blocks listed on the role. */
+export type AppRoleLookUpSecretIdByAccessorResponseCidrListList = Array<string>;
+export const AppRoleLookUpSecretIdByAccessorResponseCidrListList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<AppRoleLookUpSecretIdByAccessorResponseCidrListList>;
+
+/** List of CIDR blocks. If set, specifies the blocks of IP addresses which can use the returned token. Should be a subset of the token CIDR blocks listed on the role, if any. */
+export type AppRoleLookUpSecretIdByAccessorResponseTokenBoundCidrsList =
+  Array<string>;
+export const AppRoleLookUpSecretIdByAccessorResponseTokenBoundCidrsList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<AppRoleLookUpSecretIdByAccessorResponseTokenBoundCidrsList>;
+
+export interface AppRoleLookUpSecretIdByAccessorResponse {
+  /** List of CIDR blocks enforcing secret IDs to be used from specific set of IP addresses. If 'bound_cidr_list' is set on the role, then the list of CIDR blocks listed here should be a subset of the CIDR blocks listed on the role. */
+  cidr_list?: AppRoleLookUpSecretIdByAccessorResponseCidrListList;
+  creation_time?: string;
+  expiration_time?: string;
+  last_updated_time?: string;
+  metadata?: unknown;
+  /** Accessor of the secret ID */
+  secret_id_accessor?: string;
+  /** Number of times a secret ID can access the role, after which the secret ID will expire. */
+  secret_id_num_uses?: number;
+  /** Duration in seconds after which the issued secret ID expires. */
+  secret_id_ttl?: number;
+  /** List of CIDR blocks. If set, specifies the blocks of IP addresses which can use the returned token. Should be a subset of the token CIDR blocks listed on the role, if any. */
+  token_bound_cidrs?: AppRoleLookUpSecretIdByAccessorResponseTokenBoundCidrsList;
+}
+export const AppRoleLookUpSecretIdByAccessorResponse = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({
+      cidr_list: S.optional(
+        AppRoleLookUpSecretIdByAccessorResponseCidrListList,
+      ),
+      creation_time: S.optional(S.String),
+      expiration_time: S.optional(S.String),
+      last_updated_time: S.optional(S.String),
+      metadata: S.optional(S.Unknown),
+      secret_id_accessor: S.optional(S.String),
+      secret_id_num_uses: S.optional(S.Number),
+      secret_id_ttl: S.optional(S.Number),
+      token_bound_cidrs: S.optional(
+        AppRoleLookUpSecretIdByAccessorResponseTokenBoundCidrsList,
+      ),
+    }),
+).annotate({
+  identifier: "AppRoleLookUpSecretIdByAccessorResponse",
+}) as any as S.Schema<AppRoleLookUpSecretIdByAccessorResponse>;
+
+export interface AppRoleReadBindSecretIdRequest {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+  /** Name of the role. Must be less than 4096 bytes. */
+  role_name: string;
+}
+export const AppRoleReadBindSecretIdRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    approle_mount_path: S.String.pipe(T.Label()),
+    role_name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/auth/{approle_mount_path}/role/{role_name}/bind-secret-id",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "AppRoleReadBindSecretIdRequest",
+}) as any as S.Schema<AppRoleReadBindSecretIdRequest>;
+
+export interface AppRoleReadBindSecretIdResponse {
+  /** Impose secret_id to be presented when logging in using this role. Defaults to 'true'. */
+  bind_secret_id?: boolean;
+}
+export const AppRoleReadBindSecretIdResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    bind_secret_id: S.optional(S.Boolean),
+  }),
+).annotate({
+  identifier: "AppRoleReadBindSecretIdResponse",
+}) as any as S.Schema<AppRoleReadBindSecretIdResponse>;
+
+export interface AppRoleReadBoundCidrListRequest {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+  /** Name of the role. Must be less than 4096 bytes. */
+  role_name: string;
+}
+export const AppRoleReadBoundCidrListRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    approle_mount_path: S.String.pipe(T.Label()),
+    role_name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/auth/{approle_mount_path}/role/{role_name}/bound-cidr-list",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "AppRoleReadBoundCidrListRequest",
+}) as any as S.Schema<AppRoleReadBoundCidrListRequest>;
+
+/** Deprecated: Please use "secret_id_bound_cidrs" instead. Comma separated string or list of CIDR blocks. If set, specifies the blocks of IP addresses which can perform the login operation. */
+export type AppRoleReadBoundCidrListResponseBoundCidrListList = Array<string>;
+export const AppRoleReadBoundCidrListResponseBoundCidrListList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<AppRoleReadBoundCidrListResponseBoundCidrListList>;
+
+export interface AppRoleReadBoundCidrListResponse {
+  /** Deprecated: Please use "secret_id_bound_cidrs" instead. Comma separated string or list of CIDR blocks. If set, specifies the blocks of IP addresses which can perform the login operation. */
+  bound_cidr_list?: AppRoleReadBoundCidrListResponseBoundCidrListList;
+}
+export const AppRoleReadBoundCidrListResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    bound_cidr_list: S.optional(
+      AppRoleReadBoundCidrListResponseBoundCidrListList,
+    ),
+  }),
+).annotate({
+  identifier: "AppRoleReadBoundCidrListResponse",
+}) as any as S.Schema<AppRoleReadBoundCidrListResponse>;
+
+export interface AppRoleReadLocalSecretIdsRequest {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+  /** Name of the role. Must be less than 4096 bytes. */
+  role_name: string;
+}
+export const AppRoleReadLocalSecretIdsRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    approle_mount_path: S.String.pipe(T.Label()),
+    role_name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/auth/{approle_mount_path}/role/{role_name}/local-secret-ids",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "AppRoleReadLocalSecretIdsRequest",
+}) as any as S.Schema<AppRoleReadLocalSecretIdsRequest>;
+
+export interface AppRoleReadLocalSecretIdsResponse {
+  /** If true, the secret identifiers generated using this role will be cluster local. This can only be set during role creation and once set, it can't be reset later */
+  local_secret_ids?: boolean;
+}
+export const AppRoleReadLocalSecretIdsResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    local_secret_ids: S.optional(S.Boolean),
+  }),
+).annotate({
+  identifier: "AppRoleReadLocalSecretIdsResponse",
+}) as any as S.Schema<AppRoleReadLocalSecretIdsResponse>;
+
+export interface AppRoleReadPeriodRequest {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+  /** Name of the role. Must be less than 4096 bytes. */
+  role_name: string;
+}
+export const AppRoleReadPeriodRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    approle_mount_path: S.String.pipe(T.Label()),
+    role_name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/auth/{approle_mount_path}/role/{role_name}/period",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "AppRoleReadPeriodRequest",
+}) as any as S.Schema<AppRoleReadPeriodRequest>;
+
+export interface AppRoleReadPeriodResponse {
+  /** Use "token_period" instead. If this and "token_period" are both specified, only "token_period" will be used. */
+  period?: number;
+  /** If set, tokens created via this role will have no max lifetime; instead, their renewal period will be fixed to this value. This takes an integer number of seconds, or a string duration (e.g. "24h"). */
+  token_period?: number;
+}
+export const AppRoleReadPeriodResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    period: S.optional(S.Number),
+    token_period: S.optional(S.Number),
+  }),
+).annotate({
+  identifier: "AppRoleReadPeriodResponse",
+}) as any as S.Schema<AppRoleReadPeriodResponse>;
+
+export interface AppRoleReadPoliciesRequest {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+  /** Name of the role. Must be less than 4096 bytes. */
+  role_name: string;
+}
+export const AppRoleReadPoliciesRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    approle_mount_path: S.String.pipe(T.Label()),
+    role_name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/auth/{approle_mount_path}/role/{role_name}/policies",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "AppRoleReadPoliciesRequest",
+}) as any as S.Schema<AppRoleReadPoliciesRequest>;
+
+/** Use "token_policies" instead. If this and "token_policies" are both specified, only "token_policies" will be used. */
+export type AppRoleReadPoliciesResponsePoliciesList = Array<string>;
+export const AppRoleReadPoliciesResponsePoliciesList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<AppRoleReadPoliciesResponsePoliciesList>;
+
+/** Comma-separated list of policies */
+export type AppRoleReadPoliciesResponseTokenPoliciesList = Array<string>;
+export const AppRoleReadPoliciesResponseTokenPoliciesList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<AppRoleReadPoliciesResponseTokenPoliciesList>;
+
+export interface AppRoleReadPoliciesResponse {
+  /** Use "token_policies" instead. If this and "token_policies" are both specified, only "token_policies" will be used. */
+  policies?: AppRoleReadPoliciesResponsePoliciesList;
+  /** Comma-separated list of policies */
+  token_policies?: AppRoleReadPoliciesResponseTokenPoliciesList;
+}
+export const AppRoleReadPoliciesResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    policies: S.optional(AppRoleReadPoliciesResponsePoliciesList),
+    token_policies: S.optional(AppRoleReadPoliciesResponseTokenPoliciesList),
+  }),
+).annotate({
+  identifier: "AppRoleReadPoliciesResponse",
+}) as any as S.Schema<AppRoleReadPoliciesResponse>;
+
+export interface AppRoleReadRoleRequest {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+  /** Name of the role. Must be less than 4096 bytes. */
+  role_name: string;
+}
+export const AppRoleReadRoleRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    approle_mount_path: S.String.pipe(T.Label()),
+    role_name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/auth/{approle_mount_path}/role/{role_name}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "AppRoleReadRoleRequest",
+}) as any as S.Schema<AppRoleReadRoleRequest>;
+
+/** Use "token_policies" instead. If this and "token_policies" are both specified, only "token_policies" will be used. */
+export type AppRoleReadRoleResponsePoliciesList = Array<string>;
+export const AppRoleReadRoleResponsePoliciesList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<AppRoleReadRoleResponsePoliciesList>;
+
+/** Comma separated string or list of CIDR blocks. If set, specifies the blocks of IP addresses which can perform the login operation. */
+export type AppRoleReadRoleResponseSecretIdBoundCidrsList = Array<string>;
+export const AppRoleReadRoleResponseSecretIdBoundCidrsList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<AppRoleReadRoleResponseSecretIdBoundCidrsList>;
+
+/** Comma separated string or JSON list of CIDR blocks. If set, specifies the blocks of IP addresses which are allowed to use the generated token. */
+export type AppRoleReadRoleResponseTokenBoundCidrsList = Array<string>;
+export const AppRoleReadRoleResponseTokenBoundCidrsList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<AppRoleReadRoleResponseTokenBoundCidrsList>;
+
+/** Comma-separated list of policies */
+export type AppRoleReadRoleResponseTokenPoliciesList = Array<string>;
+export const AppRoleReadRoleResponseTokenPoliciesList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<AppRoleReadRoleResponseTokenPoliciesList>;
+
+export interface AppRoleReadRoleResponse {
+  /** Impose secret ID to be presented when logging in using this role. */
+  bind_secret_id?: boolean;
+  /** If true, the secret identifiers generated using this role will be cluster local. This can only be set during role creation and once set, it can't be reset later */
+  local_secret_ids?: boolean;
+  /** Use "token_period" instead. If this and "token_period" are both specified, only "token_period" will be used. */
+  period?: number;
+  /** Use "token_policies" instead. If this and "token_policies" are both specified, only "token_policies" will be used. */
+  policies?: AppRoleReadRoleResponsePoliciesList;
+  /** Comma separated string or list of CIDR blocks. If set, specifies the blocks of IP addresses which can perform the login operation. */
+  secret_id_bound_cidrs?: AppRoleReadRoleResponseSecretIdBoundCidrsList;
+  /** Number of times a secret ID can access the role, after which the secret ID will expire. */
+  secret_id_num_uses?: number;
+  /** Duration in seconds after which the issued secret ID expires. */
+  secret_id_ttl?: number;
+  /** Comma separated string or JSON list of CIDR blocks. If set, specifies the blocks of IP addresses which are allowed to use the generated token. */
+  token_bound_cidrs?: AppRoleReadRoleResponseTokenBoundCidrsList;
+  /** If set, tokens created via this role carry an explicit maximum TTL. During renewal, the current maximum TTL values of the role and the mount are not checked for changes, and any updates to these values will have no effect on the token being renewed. */
+  token_explicit_max_ttl?: number;
+  /** The maximum lifetime of the generated token */
+  token_max_ttl?: number;
+  /** If true, the 'default' policy will not automatically be added to generated tokens */
+  token_no_default_policy?: boolean;
+  /** The maximum number of times a token may be used, a value of zero means unlimited */
+  token_num_uses?: number;
+  /** If set, tokens created via this role will have no max lifetime; instead, their renewal period will be fixed to this value. */
+  token_period?: number;
+  /** Comma-separated list of policies */
+  token_policies?: AppRoleReadRoleResponseTokenPoliciesList;
+  /** If true, CIDRs for the token will be strictly bound to the source IP address of the login request */
+  token_strictly_bind_ip?: boolean;
+  /** The initial ttl of the token to generate */
+  token_ttl?: number;
+  /** The type of token to generate, service or batch */
+  token_type?: string;
+}
+export const AppRoleReadRoleResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    bind_secret_id: S.optional(S.Boolean),
+    local_secret_ids: S.optional(S.Boolean),
+    period: S.optional(S.Number),
+    policies: S.optional(AppRoleReadRoleResponsePoliciesList),
+    secret_id_bound_cidrs: S.optional(
+      AppRoleReadRoleResponseSecretIdBoundCidrsList,
+    ),
+    secret_id_num_uses: S.optional(S.Number),
+    secret_id_ttl: S.optional(S.Number),
+    token_bound_cidrs: S.optional(AppRoleReadRoleResponseTokenBoundCidrsList),
+    token_explicit_max_ttl: S.optional(S.Number),
+    token_max_ttl: S.optional(S.Number),
+    token_no_default_policy: S.optional(S.Boolean),
+    token_num_uses: S.optional(S.Number),
+    token_period: S.optional(S.Number),
+    token_policies: S.optional(AppRoleReadRoleResponseTokenPoliciesList),
+    token_strictly_bind_ip: S.optional(S.Boolean),
+    token_ttl: S.optional(S.Number),
+    token_type: S.optional(S.String),
+  }),
+).annotate({
+  identifier: "AppRoleReadRoleResponse",
+}) as any as S.Schema<AppRoleReadRoleResponse>;
+
+export interface AppRoleReadRoleIdRequest {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+  /** Name of the role. Must be less than 4096 bytes. */
+  role_name: string;
+}
+export const AppRoleReadRoleIdRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    approle_mount_path: S.String.pipe(T.Label()),
+    role_name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/auth/{approle_mount_path}/role/{role_name}/role-id",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "AppRoleReadRoleIdRequest",
+}) as any as S.Schema<AppRoleReadRoleIdRequest>;
+
+export interface AppRoleReadRoleIdResponse {
+  /** Identifier of the role. Defaults to a UUID. */
+  role_id?: string;
+}
+export const AppRoleReadRoleIdResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    role_id: S.optional(S.String),
+  }),
+).annotate({
+  identifier: "AppRoleReadRoleIdResponse",
+}) as any as S.Schema<AppRoleReadRoleIdResponse>;
+
+export interface AppRoleReadSecretIdBoundCidrsRequest {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+  /** Name of the role. Must be less than 4096 bytes. */
+  role_name: string;
+}
+export const AppRoleReadSecretIdBoundCidrsRequest = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({
+      approle_mount_path: S.String.pipe(T.Label()),
+      role_name: S.String.pipe(T.Label()),
+    }).pipe(
+      T.Http({
+        method: "GET",
+        uri: "/auth/{approle_mount_path}/role/{role_name}/secret-id-bound-cidrs",
+        code: 200,
+      }),
+    ),
+).annotate({
+  identifier: "AppRoleReadSecretIdBoundCidrsRequest",
+}) as any as S.Schema<AppRoleReadSecretIdBoundCidrsRequest>;
+
+/** Comma separated string or list of CIDR blocks. If set, specifies the blocks of IP addresses which can perform the login operation. */
+export type AppRoleReadSecretIdBoundCidrsResponseSecretIdBoundCidrsList =
+  Array<string>;
+export const AppRoleReadSecretIdBoundCidrsResponseSecretIdBoundCidrsList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<AppRoleReadSecretIdBoundCidrsResponseSecretIdBoundCidrsList>;
+
+export interface AppRoleReadSecretIdBoundCidrsResponse {
+  /** Comma separated string or list of CIDR blocks. If set, specifies the blocks of IP addresses which can perform the login operation. */
+  secret_id_bound_cidrs?: AppRoleReadSecretIdBoundCidrsResponseSecretIdBoundCidrsList;
+}
+export const AppRoleReadSecretIdBoundCidrsResponse = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({
+      secret_id_bound_cidrs: S.optional(
+        AppRoleReadSecretIdBoundCidrsResponseSecretIdBoundCidrsList,
+      ),
+    }),
+).annotate({
+  identifier: "AppRoleReadSecretIdBoundCidrsResponse",
+}) as any as S.Schema<AppRoleReadSecretIdBoundCidrsResponse>;
+
+export interface AppRoleReadSecretIdNumUsesRequest {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+  /** Name of the role. Must be less than 4096 bytes. */
+  role_name: string;
+}
+export const AppRoleReadSecretIdNumUsesRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    approle_mount_path: S.String.pipe(T.Label()),
+    role_name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/auth/{approle_mount_path}/role/{role_name}/secret-id-num-uses",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "AppRoleReadSecretIdNumUsesRequest",
+}) as any as S.Schema<AppRoleReadSecretIdNumUsesRequest>;
+
+export interface AppRoleReadSecretIdNumUsesResponse {
+  /** Number of times a secret ID can access the role, after which the SecretID will expire. Defaults to 0 meaning that the secret ID is of unlimited use. */
+  secret_id_num_uses?: number;
+}
+export const AppRoleReadSecretIdNumUsesResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    secret_id_num_uses: S.optional(S.Number),
+  }),
+).annotate({
+  identifier: "AppRoleReadSecretIdNumUsesResponse",
+}) as any as S.Schema<AppRoleReadSecretIdNumUsesResponse>;
+
+export interface AppRoleReadSecretIdTtlRequest {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+  /** Name of the role. Must be less than 4096 bytes. */
+  role_name: string;
+}
+export const AppRoleReadSecretIdTtlRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    approle_mount_path: S.String.pipe(T.Label()),
+    role_name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/auth/{approle_mount_path}/role/{role_name}/secret-id-ttl",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "AppRoleReadSecretIdTtlRequest",
+}) as any as S.Schema<AppRoleReadSecretIdTtlRequest>;
+
+export interface AppRoleReadSecretIdTtlResponse {
+  /** Duration in seconds after which the issued secret ID should expire. Defaults to 0, meaning no expiration. */
+  secret_id_ttl?: number;
+}
+export const AppRoleReadSecretIdTtlResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    secret_id_ttl: S.optional(S.Number),
+  }),
+).annotate({
+  identifier: "AppRoleReadSecretIdTtlResponse",
+}) as any as S.Schema<AppRoleReadSecretIdTtlResponse>;
+
+export interface AppRoleReadTokenBoundCidrsRequest {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+  /** Name of the role. Must be less than 4096 bytes. */
+  role_name: string;
+}
+export const AppRoleReadTokenBoundCidrsRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    approle_mount_path: S.String.pipe(T.Label()),
+    role_name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/auth/{approle_mount_path}/role/{role_name}/token-bound-cidrs",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "AppRoleReadTokenBoundCidrsRequest",
+}) as any as S.Schema<AppRoleReadTokenBoundCidrsRequest>;
+
+/** Comma separated string or list of CIDR blocks. If set, specifies the blocks of IP addresses which can use the returned token. Should be a subset of the token CIDR blocks listed on the role, if any. */
+export type AppRoleReadTokenBoundCidrsResponseTokenBoundCidrsList =
+  Array<string>;
+export const AppRoleReadTokenBoundCidrsResponseTokenBoundCidrsList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<AppRoleReadTokenBoundCidrsResponseTokenBoundCidrsList>;
+
+export interface AppRoleReadTokenBoundCidrsResponse {
+  /** Comma separated string or list of CIDR blocks. If set, specifies the blocks of IP addresses which can use the returned token. Should be a subset of the token CIDR blocks listed on the role, if any. */
+  token_bound_cidrs?: AppRoleReadTokenBoundCidrsResponseTokenBoundCidrsList;
+}
+export const AppRoleReadTokenBoundCidrsResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    token_bound_cidrs: S.optional(
+      AppRoleReadTokenBoundCidrsResponseTokenBoundCidrsList,
+    ),
+  }),
+).annotate({
+  identifier: "AppRoleReadTokenBoundCidrsResponse",
+}) as any as S.Schema<AppRoleReadTokenBoundCidrsResponse>;
+
+export interface AppRoleReadTokenMaxTtlRequest {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+  /** Name of the role. Must be less than 4096 bytes. */
+  role_name: string;
+}
+export const AppRoleReadTokenMaxTtlRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    approle_mount_path: S.String.pipe(T.Label()),
+    role_name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/auth/{approle_mount_path}/role/{role_name}/token-max-ttl",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "AppRoleReadTokenMaxTtlRequest",
+}) as any as S.Schema<AppRoleReadTokenMaxTtlRequest>;
+
+export interface AppRoleReadTokenMaxTtlResponse {
+  /** The maximum lifetime of the generated token */
+  token_max_ttl?: number;
+}
+export const AppRoleReadTokenMaxTtlResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    token_max_ttl: S.optional(S.Number),
+  }),
+).annotate({
+  identifier: "AppRoleReadTokenMaxTtlResponse",
+}) as any as S.Schema<AppRoleReadTokenMaxTtlResponse>;
+
+export interface AppRoleReadTokenNumUsesRequest {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+  /** Name of the role. Must be less than 4096 bytes. */
+  role_name: string;
+}
+export const AppRoleReadTokenNumUsesRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    approle_mount_path: S.String.pipe(T.Label()),
+    role_name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/auth/{approle_mount_path}/role/{role_name}/token-num-uses",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "AppRoleReadTokenNumUsesRequest",
+}) as any as S.Schema<AppRoleReadTokenNumUsesRequest>;
+
+export interface AppRoleReadTokenNumUsesResponse {
+  /** The maximum number of times a token may be used, a value of zero means unlimited */
+  token_num_uses?: number;
+}
+export const AppRoleReadTokenNumUsesResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    token_num_uses: S.optional(S.Number),
+  }),
+).annotate({
+  identifier: "AppRoleReadTokenNumUsesResponse",
+}) as any as S.Schema<AppRoleReadTokenNumUsesResponse>;
+
+export interface AppRoleReadTokenTtlRequest {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+  /** Name of the role. Must be less than 4096 bytes. */
+  role_name: string;
+}
+export const AppRoleReadTokenTtlRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    approle_mount_path: S.String.pipe(T.Label()),
+    role_name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/auth/{approle_mount_path}/role/{role_name}/token-ttl",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "AppRoleReadTokenTtlRequest",
+}) as any as S.Schema<AppRoleReadTokenTtlRequest>;
+
+export interface AppRoleReadTokenTtlResponse {
+  /** The initial ttl of the token to generate */
+  token_ttl?: number;
+}
+export const AppRoleReadTokenTtlResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    token_ttl: S.optional(S.Number),
+  }),
+).annotate({
+  identifier: "AppRoleReadTokenTtlResponse",
+}) as any as S.Schema<AppRoleReadTokenTtlResponse>;
+
+export interface AppRoleTidySecretIdRequest {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+}
+export const AppRoleTidySecretIdRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    approle_mount_path: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/auth/{approle_mount_path}/tidy/secret-id",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "AppRoleTidySecretIdRequest",
+}) as any as S.Schema<AppRoleTidySecretIdRequest>;
+
+export interface AppRoleTidySecretIdResponse {}
+export const AppRoleTidySecretIdResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "AppRoleTidySecretIdResponse",
+}) as any as S.Schema<AppRoleTidySecretIdResponse>;
+
+export interface AppRoleWriteBindSecretIdRequest {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+  /** Name of the role. Must be less than 4096 bytes. */
+  role_name: string;
+  /** Impose secret_id to be presented when logging in using this role. */
+  bind_secret_id?: boolean;
+}
+export const AppRoleWriteBindSecretIdRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    approle_mount_path: S.String.pipe(T.Label()),
+    role_name: S.String.pipe(T.Label()),
+    bind_secret_id: S.optional(S.Boolean),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/auth/{approle_mount_path}/role/{role_name}/bind-secret-id",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "AppRoleWriteBindSecretIdRequest",
+}) as any as S.Schema<AppRoleWriteBindSecretIdRequest>;
+
+export interface AppRoleWriteBindSecretIdResponse {}
+export const AppRoleWriteBindSecretIdResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "AppRoleWriteBindSecretIdResponse",
+}) as any as S.Schema<AppRoleWriteBindSecretIdResponse>;
+
+/** Comma separated string or list of CIDR blocks enforcing secret IDs to be used from specific set of IP addresses. If 'bound_cidr_list' is set on the role, then the list of CIDR blocks listed here should be a subset of the CIDR blocks listed on the role. */
+export type AppRoleWriteCustomSecretIdRequestCidrListList = Array<string>;
+export const AppRoleWriteCustomSecretIdRequestCidrListList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<AppRoleWriteCustomSecretIdRequestCidrListList>;
+
+/** Comma separated string or list of CIDR blocks. If set, specifies the blocks of IP addresses which can use the returned token. Should be a subset of the token CIDR blocks listed on the role, if any. */
+export type AppRoleWriteCustomSecretIdRequestTokenBoundCidrsList =
+  Array<string>;
+export const AppRoleWriteCustomSecretIdRequestTokenBoundCidrsList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<AppRoleWriteCustomSecretIdRequestTokenBoundCidrsList>;
+
+export interface AppRoleWriteCustomSecretIdRequest {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+  /** Name of the role. Must be less than 4096 bytes. */
+  role_name: string;
+  /** Comma separated string or list of CIDR blocks enforcing secret IDs to be used from specific set of IP addresses. If 'bound_cidr_list' is set on the role, then the list of CIDR blocks listed here should be a subset of the CIDR blocks listed on the role. */
+  cidr_list?: AppRoleWriteCustomSecretIdRequestCidrListList;
+  /** Metadata to be tied to the SecretID. This should be a JSON formatted string containing metadata in key value pairs. */
+  metadata?: string;
+  /** Number of times this SecretID can be used, after which the SecretID expires. Overrides secret_id_num_uses role option when supplied. May not be higher than role's secret_id_num_uses. */
+  num_uses?: number;
+  /** SecretID to be attached to the role. */
+  secret_id?: string;
+  /** Comma separated string or list of CIDR blocks. If set, specifies the blocks of IP addresses which can use the returned token. Should be a subset of the token CIDR blocks listed on the role, if any. */
+  token_bound_cidrs?: AppRoleWriteCustomSecretIdRequestTokenBoundCidrsList;
+  /** Duration in seconds after which this SecretID expires. Overrides secret_id_ttl role option when supplied. May not be longer than role's secret_id_ttl. */
+  ttl?: number;
+}
+export const AppRoleWriteCustomSecretIdRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    approle_mount_path: S.String.pipe(T.Label()),
+    role_name: S.String.pipe(T.Label()),
+    cidr_list: S.optional(AppRoleWriteCustomSecretIdRequestCidrListList),
+    metadata: S.optional(S.String),
+    num_uses: S.optional(S.Number),
+    secret_id: S.optional(S.String),
+    token_bound_cidrs: S.optional(
+      AppRoleWriteCustomSecretIdRequestTokenBoundCidrsList,
+    ),
+    ttl: S.optional(S.Number),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/auth/{approle_mount_path}/role/{role_name}/custom-secret-id",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "AppRoleWriteCustomSecretIdRequest",
+}) as any as S.Schema<AppRoleWriteCustomSecretIdRequest>;
+
+export interface AppRoleWriteCustomSecretIdResponse {
+  /** Secret ID attached to the role. */
+  secret_id?: string;
+  /** Accessor of the secret ID */
+  secret_id_accessor?: string;
+  /** Number of times a secret ID can access the role, after which the secret ID will expire. */
+  secret_id_num_uses?: number;
+  /** Duration in seconds after which the issued secret ID expires. */
+  secret_id_ttl?: number;
+}
+export const AppRoleWriteCustomSecretIdResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    secret_id: S.optional(S.String),
+    secret_id_accessor: S.optional(S.String),
+    secret_id_num_uses: S.optional(S.Number),
+    secret_id_ttl: S.optional(S.Number),
+  }),
+).annotate({
+  identifier: "AppRoleWriteCustomSecretIdResponse",
+}) as any as S.Schema<AppRoleWriteCustomSecretIdResponse>;
+
+export interface AppRoleWritePeriodRequest {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+  /** Name of the role. Must be less than 4096 bytes. */
+  role_name: string;
+  /** Use "token_period" instead. If this and "token_period" are both specified, only "token_period" will be used. */
+  period?: number;
+  /** If set, tokens created via this role will have no max lifetime; instead, their renewal period will be fixed to this value. This takes an integer number of seconds, or a string duration (e.g. "24h"). */
+  token_period?: number;
+}
+export const AppRoleWritePeriodRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    approle_mount_path: S.String.pipe(T.Label()),
+    role_name: S.String.pipe(T.Label()),
+    period: S.optional(S.Number),
+    token_period: S.optional(S.Number),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/auth/{approle_mount_path}/role/{role_name}/period",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "AppRoleWritePeriodRequest",
+}) as any as S.Schema<AppRoleWritePeriodRequest>;
+
+export interface AppRoleWritePeriodResponse {}
+export const AppRoleWritePeriodResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "AppRoleWritePeriodResponse",
+}) as any as S.Schema<AppRoleWritePeriodResponse>;
+
+/** Use "token_policies" instead. If this and "token_policies" are both specified, only "token_policies" will be used. */
+export type AppRoleWritePoliciesRequestPoliciesList = Array<string>;
+export const AppRoleWritePoliciesRequestPoliciesList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<AppRoleWritePoliciesRequestPoliciesList>;
+
+/** Comma-separated list of policies */
+export type AppRoleWritePoliciesRequestTokenPoliciesList = Array<string>;
+export const AppRoleWritePoliciesRequestTokenPoliciesList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<AppRoleWritePoliciesRequestTokenPoliciesList>;
+
+export interface AppRoleWritePoliciesRequest {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+  /** Name of the role. Must be less than 4096 bytes. */
+  role_name: string;
+  /** Use "token_policies" instead. If this and "token_policies" are both specified, only "token_policies" will be used. */
+  policies?: AppRoleWritePoliciesRequestPoliciesList;
+  /** Comma-separated list of policies */
+  token_policies?: AppRoleWritePoliciesRequestTokenPoliciesList;
+}
+export const AppRoleWritePoliciesRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    approle_mount_path: S.String.pipe(T.Label()),
+    role_name: S.String.pipe(T.Label()),
+    policies: S.optional(AppRoleWritePoliciesRequestPoliciesList),
+    token_policies: S.optional(AppRoleWritePoliciesRequestTokenPoliciesList),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/auth/{approle_mount_path}/role/{role_name}/policies",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "AppRoleWritePoliciesRequest",
+}) as any as S.Schema<AppRoleWritePoliciesRequest>;
+
+export interface AppRoleWritePoliciesResponse {}
+export const AppRoleWritePoliciesResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "AppRoleWritePoliciesResponse",
+}) as any as S.Schema<AppRoleWritePoliciesResponse>;
+
+/** Use "secret_id_bound_cidrs" instead. */
+export type AppRoleWriteRoleRequestBoundCidrListList = Array<string>;
+export const AppRoleWriteRoleRequestBoundCidrListList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<AppRoleWriteRoleRequestBoundCidrListList>;
+
+/** Use "token_policies" instead. If this and "token_policies" are both specified, only "token_policies" will be used. */
+export type AppRoleWriteRoleRequestPoliciesList = Array<string>;
+export const AppRoleWriteRoleRequestPoliciesList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<AppRoleWriteRoleRequestPoliciesList>;
+
+/** Comma separated string or list of CIDR blocks. If set, specifies the blocks of IP addresses which can perform the login operation. */
+export type AppRoleWriteRoleRequestSecretIdBoundCidrsList = Array<string>;
+export const AppRoleWriteRoleRequestSecretIdBoundCidrsList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<AppRoleWriteRoleRequestSecretIdBoundCidrsList>;
+
+/** Comma separated string or JSON list of CIDR blocks. If set, specifies the blocks of IP addresses which are allowed to use the generated token. */
+export type AppRoleWriteRoleRequestTokenBoundCidrsList = Array<string>;
+export const AppRoleWriteRoleRequestTokenBoundCidrsList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<AppRoleWriteRoleRequestTokenBoundCidrsList>;
+
+/** Comma-separated list of policies */
+export type AppRoleWriteRoleRequestTokenPoliciesList = Array<string>;
+export const AppRoleWriteRoleRequestTokenPoliciesList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<AppRoleWriteRoleRequestTokenPoliciesList>;
+
+export interface AppRoleWriteRoleRequest {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+  /** Name of the role. Must be less than 4096 bytes. */
+  role_name: string;
+  /** Impose secret_id to be presented when logging in using this role. Defaults to 'true'. */
+  bind_secret_id?: boolean;
+  /** Use "secret_id_bound_cidrs" instead. */
+  bound_cidr_list?: AppRoleWriteRoleRequestBoundCidrListList;
+  /** If set, the secret IDs generated using this role will be cluster local. This can only be set during role creation and once set, it can't be reset later. */
+  local_secret_ids?: boolean;
+  /** Use "token_period" instead. If this and "token_period" are both specified, only "token_period" will be used. */
+  period?: number;
+  /** Use "token_policies" instead. If this and "token_policies" are both specified, only "token_policies" will be used. */
+  policies?: AppRoleWriteRoleRequestPoliciesList;
+  /** Identifier of the role. Defaults to a UUID. */
+  role_id?: string;
+  /** Comma separated string or list of CIDR blocks. If set, specifies the blocks of IP addresses which can perform the login operation. */
+  secret_id_bound_cidrs?: AppRoleWriteRoleRequestSecretIdBoundCidrsList;
+  /** Number of times a SecretID can access the role, after which the SecretID will expire. Defaults to 0 meaning that the the secret_id is of unlimited use. */
+  secret_id_num_uses?: number;
+  /** Duration in seconds after which the issued SecretID should expire. Defaults to 0, meaning no expiration. */
+  secret_id_ttl?: number;
+  /** Comma separated string or JSON list of CIDR blocks. If set, specifies the blocks of IP addresses which are allowed to use the generated token. */
+  token_bound_cidrs?: AppRoleWriteRoleRequestTokenBoundCidrsList;
+  /** If set, tokens created via this role carry an explicit maximum TTL. During renewal, the current maximum TTL values of the role and the mount are not checked for changes, and any updates to these values will have no effect on the token being renewed. */
+  token_explicit_max_ttl?: number;
+  /** The maximum lifetime of the generated token */
+  token_max_ttl?: number;
+  /** If true, the 'default' policy will not automatically be added to generated tokens */
+  token_no_default_policy?: boolean;
+  /** The maximum number of times a token may be used, a value of zero means unlimited */
+  token_num_uses?: number;
+  /** If set, tokens created via this role will have no max lifetime; instead, their renewal period will be fixed to this value. This takes an integer number of seconds, or a string duration (e.g. "24h"). */
+  token_period?: number;
+  /** Comma-separated list of policies */
+  token_policies?: AppRoleWriteRoleRequestTokenPoliciesList;
+  /** If true, CIDRs for the token will be strictly bound to the source IP address of the login request */
+  token_strictly_bind_ip?: boolean;
+  /** The initial ttl of the token to generate */
+  token_ttl?: number;
+  /** The type of token to generate, service or batch */
+  token_type?: string;
+}
+export const AppRoleWriteRoleRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    approle_mount_path: S.String.pipe(T.Label()),
+    role_name: S.String.pipe(T.Label()),
+    bind_secret_id: S.optional(S.Boolean),
+    bound_cidr_list: S.optional(AppRoleWriteRoleRequestBoundCidrListList),
+    local_secret_ids: S.optional(S.Boolean),
+    period: S.optional(S.Number),
+    policies: S.optional(AppRoleWriteRoleRequestPoliciesList),
+    role_id: S.optional(S.String),
+    secret_id_bound_cidrs: S.optional(
+      AppRoleWriteRoleRequestSecretIdBoundCidrsList,
+    ),
+    secret_id_num_uses: S.optional(S.Number),
+    secret_id_ttl: S.optional(S.Number),
+    token_bound_cidrs: S.optional(AppRoleWriteRoleRequestTokenBoundCidrsList),
+    token_explicit_max_ttl: S.optional(S.Number),
+    token_max_ttl: S.optional(S.Number),
+    token_no_default_policy: S.optional(S.Boolean),
+    token_num_uses: S.optional(S.Number),
+    token_period: S.optional(S.Number),
+    token_policies: S.optional(AppRoleWriteRoleRequestTokenPoliciesList),
+    token_strictly_bind_ip: S.optional(S.Boolean),
+    token_ttl: S.optional(S.Number),
+    token_type: S.optional(S.String),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/auth/{approle_mount_path}/role/{role_name}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "AppRoleWriteRoleRequest",
+}) as any as S.Schema<AppRoleWriteRoleRequest>;
+
+export interface AppRoleWriteRoleResponse {}
+export const AppRoleWriteRoleResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "AppRoleWriteRoleResponse",
+}) as any as S.Schema<AppRoleWriteRoleResponse>;
+
+export interface AppRoleWriteRoleIdRequest {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+  /** Name of the role. Must be less than 4096 bytes. */
+  role_name: string;
+  /** Identifier of the role. Defaults to a UUID. */
+  role_id?: string;
+}
+export const AppRoleWriteRoleIdRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    approle_mount_path: S.String.pipe(T.Label()),
+    role_name: S.String.pipe(T.Label()),
+    role_id: S.optional(S.String),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/auth/{approle_mount_path}/role/{role_name}/role-id",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "AppRoleWriteRoleIdRequest",
+}) as any as S.Schema<AppRoleWriteRoleIdRequest>;
+
+export interface AppRoleWriteRoleIdResponse {}
+export const AppRoleWriteRoleIdResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "AppRoleWriteRoleIdResponse",
+}) as any as S.Schema<AppRoleWriteRoleIdResponse>;
+
+/** Comma separated string or list of CIDR blocks enforcing secret IDs to be used from specific set of IP addresses. If 'bound_cidr_list' is set on the role, then the list of CIDR blocks listed here should be a subset of the CIDR blocks listed on the role. */
+export type AppRoleWriteSecretIdRequestCidrListList = Array<string>;
+export const AppRoleWriteSecretIdRequestCidrListList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<AppRoleWriteSecretIdRequestCidrListList>;
+
+/** Comma separated string or JSON list of CIDR blocks. If set, specifies the blocks of IP addresses which are allowed to use the generated token. */
+export type AppRoleWriteSecretIdRequestTokenBoundCidrsList = Array<string>;
+export const AppRoleWriteSecretIdRequestTokenBoundCidrsList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<AppRoleWriteSecretIdRequestTokenBoundCidrsList>;
+
+export interface AppRoleWriteSecretIdRequest {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+  /** Name of the role. Must be less than 4096 bytes. */
+  role_name: string;
+  /** Optional entry to list begin listing after, not required to exist. Only used in list operations. */
+  after?: string;
+  /** Comma separated string or list of CIDR blocks enforcing secret IDs to be used from specific set of IP addresses. If 'bound_cidr_list' is set on the role, then the list of CIDR blocks listed here should be a subset of the CIDR blocks listed on the role. */
+  cidr_list?: AppRoleWriteSecretIdRequestCidrListList;
+  /** Optional number of entries to return; defaults to all entries. Only used in list operations. */
+  limit?: number;
+  /** Metadata to be tied to the SecretID. This should be a JSON formatted string containing the metadata in key value pairs. */
+  metadata?: string;
+  /** Number of times this SecretID can be used, after which the SecretID expires. Overrides secret_id_num_uses role option when supplied. May not be higher than role's secret_id_num_uses. */
+  num_uses?: number;
+  /** Comma separated string or JSON list of CIDR blocks. If set, specifies the blocks of IP addresses which are allowed to use the generated token. */
+  token_bound_cidrs?: AppRoleWriteSecretIdRequestTokenBoundCidrsList;
+  /** Duration in seconds after which this SecretID expires. Overrides secret_id_ttl role option when supplied. May not be longer than role's secret_id_ttl. */
+  ttl?: number;
+}
+export const AppRoleWriteSecretIdRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    approle_mount_path: S.String.pipe(T.Label()),
+    role_name: S.String.pipe(T.Label()),
+    after: S.optional(S.String),
+    cidr_list: S.optional(AppRoleWriteSecretIdRequestCidrListList),
+    limit: S.optional(S.Number),
+    metadata: S.optional(S.String),
+    num_uses: S.optional(S.Number),
+    token_bound_cidrs: S.optional(
+      AppRoleWriteSecretIdRequestTokenBoundCidrsList,
+    ),
+    ttl: S.optional(S.Number),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/auth/{approle_mount_path}/role/{role_name}/secret-id",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "AppRoleWriteSecretIdRequest",
+}) as any as S.Schema<AppRoleWriteSecretIdRequest>;
+
+export interface AppRoleWriteSecretIdResponse {
+  /** Secret ID attached to the role. */
+  secret_id?: string;
+  /** Accessor of the secret ID */
+  secret_id_accessor?: string;
+  /** Number of times a secret ID can access the role, after which the secret ID will expire. */
+  secret_id_num_uses?: number;
+  /** Duration in seconds after which the issued secret ID expires. */
+  secret_id_ttl?: number;
+}
+export const AppRoleWriteSecretIdResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    secret_id: S.optional(S.String),
+    secret_id_accessor: S.optional(S.String),
+    secret_id_num_uses: S.optional(S.Number),
+    secret_id_ttl: S.optional(S.Number),
+  }),
+).annotate({
+  identifier: "AppRoleWriteSecretIdResponse",
+}) as any as S.Schema<AppRoleWriteSecretIdResponse>;
+
+/** Comma separated string or list of CIDR blocks. If set, specifies the blocks of IP addresses which can perform the login operation. */
+export type AppRoleWriteSecretIdBoundCidrsRequestSecretIdBoundCidrsList =
+  Array<string>;
+export const AppRoleWriteSecretIdBoundCidrsRequestSecretIdBoundCidrsList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<AppRoleWriteSecretIdBoundCidrsRequestSecretIdBoundCidrsList>;
+
+export interface AppRoleWriteSecretIdBoundCidrsRequest {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+  /** Name of the role. Must be less than 4096 bytes. */
+  role_name: string;
+  /** Comma separated string or list of CIDR blocks. If set, specifies the blocks of IP addresses which can perform the login operation. */
+  secret_id_bound_cidrs?: AppRoleWriteSecretIdBoundCidrsRequestSecretIdBoundCidrsList;
+}
+export const AppRoleWriteSecretIdBoundCidrsRequest = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({
+      approle_mount_path: S.String.pipe(T.Label()),
+      role_name: S.String.pipe(T.Label()),
+      secret_id_bound_cidrs: S.optional(
+        AppRoleWriteSecretIdBoundCidrsRequestSecretIdBoundCidrsList,
+      ),
+    }).pipe(
+      T.Http({
+        method: "POST",
+        uri: "/auth/{approle_mount_path}/role/{role_name}/secret-id-bound-cidrs",
+        code: 200,
+      }),
+    ),
+).annotate({
+  identifier: "AppRoleWriteSecretIdBoundCidrsRequest",
+}) as any as S.Schema<AppRoleWriteSecretIdBoundCidrsRequest>;
+
+export interface AppRoleWriteSecretIdBoundCidrsResponse {}
+export const AppRoleWriteSecretIdBoundCidrsResponse = /*@__PURE__*/ S.suspend(
+  () => S.Struct({}),
+).annotate({
+  identifier: "AppRoleWriteSecretIdBoundCidrsResponse",
+}) as any as S.Schema<AppRoleWriteSecretIdBoundCidrsResponse>;
+
+export interface AppRoleWriteSecretIdNumUsesRequest {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+  /** Name of the role. Must be less than 4096 bytes. */
+  role_name: string;
+  /** Number of times a SecretID can access the role, after which the SecretID will expire. */
+  secret_id_num_uses?: number;
+}
+export const AppRoleWriteSecretIdNumUsesRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    approle_mount_path: S.String.pipe(T.Label()),
+    role_name: S.String.pipe(T.Label()),
+    secret_id_num_uses: S.optional(S.Number),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/auth/{approle_mount_path}/role/{role_name}/secret-id-num-uses",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "AppRoleWriteSecretIdNumUsesRequest",
+}) as any as S.Schema<AppRoleWriteSecretIdNumUsesRequest>;
+
+export interface AppRoleWriteSecretIdNumUsesResponse {}
+export const AppRoleWriteSecretIdNumUsesResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "AppRoleWriteSecretIdNumUsesResponse",
+}) as any as S.Schema<AppRoleWriteSecretIdNumUsesResponse>;
+
+export interface AppRoleWriteSecretIdTtlRequest {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+  /** Name of the role. Must be less than 4096 bytes. */
+  role_name: string;
+  /** Duration in seconds after which the issued SecretID should expire. Defaults to 0, meaning no expiration. */
+  secret_id_ttl?: number;
+}
+export const AppRoleWriteSecretIdTtlRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    approle_mount_path: S.String.pipe(T.Label()),
+    role_name: S.String.pipe(T.Label()),
+    secret_id_ttl: S.optional(S.Number),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/auth/{approle_mount_path}/role/{role_name}/secret-id-ttl",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "AppRoleWriteSecretIdTtlRequest",
+}) as any as S.Schema<AppRoleWriteSecretIdTtlRequest>;
+
+export interface AppRoleWriteSecretIdTtlResponse {}
+export const AppRoleWriteSecretIdTtlResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "AppRoleWriteSecretIdTtlResponse",
+}) as any as S.Schema<AppRoleWriteSecretIdTtlResponse>;
+
+/** Comma separated string or JSON list of CIDR blocks. If set, specifies the blocks of IP addresses which are allowed to use the generated token. */
+export type AppRoleWriteTokenBoundCidrsRequestTokenBoundCidrsList =
+  Array<string>;
+export const AppRoleWriteTokenBoundCidrsRequestTokenBoundCidrsList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<AppRoleWriteTokenBoundCidrsRequestTokenBoundCidrsList>;
+
+export interface AppRoleWriteTokenBoundCidrsRequest {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+  /** Name of the role. Must be less than 4096 bytes. */
+  role_name: string;
+  /** Comma separated string or JSON list of CIDR blocks. If set, specifies the blocks of IP addresses which are allowed to use the generated token. */
+  token_bound_cidrs?: AppRoleWriteTokenBoundCidrsRequestTokenBoundCidrsList;
+}
+export const AppRoleWriteTokenBoundCidrsRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    approle_mount_path: S.String.pipe(T.Label()),
+    role_name: S.String.pipe(T.Label()),
+    token_bound_cidrs: S.optional(
+      AppRoleWriteTokenBoundCidrsRequestTokenBoundCidrsList,
+    ),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/auth/{approle_mount_path}/role/{role_name}/token-bound-cidrs",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "AppRoleWriteTokenBoundCidrsRequest",
+}) as any as S.Schema<AppRoleWriteTokenBoundCidrsRequest>;
+
+export interface AppRoleWriteTokenBoundCidrsResponse {}
+export const AppRoleWriteTokenBoundCidrsResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "AppRoleWriteTokenBoundCidrsResponse",
+}) as any as S.Schema<AppRoleWriteTokenBoundCidrsResponse>;
+
+export interface AppRoleWriteTokenMaxTtlRequest {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+  /** Name of the role. Must be less than 4096 bytes. */
+  role_name: string;
+  /** The maximum lifetime of the generated token */
+  token_max_ttl?: number;
+}
+export const AppRoleWriteTokenMaxTtlRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    approle_mount_path: S.String.pipe(T.Label()),
+    role_name: S.String.pipe(T.Label()),
+    token_max_ttl: S.optional(S.Number),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/auth/{approle_mount_path}/role/{role_name}/token-max-ttl",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "AppRoleWriteTokenMaxTtlRequest",
+}) as any as S.Schema<AppRoleWriteTokenMaxTtlRequest>;
+
+export interface AppRoleWriteTokenMaxTtlResponse {}
+export const AppRoleWriteTokenMaxTtlResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "AppRoleWriteTokenMaxTtlResponse",
+}) as any as S.Schema<AppRoleWriteTokenMaxTtlResponse>;
+
+export interface AppRoleWriteTokenNumUsesRequest {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+  /** Name of the role. Must be less than 4096 bytes. */
+  role_name: string;
+  /** The maximum number of times a token may be used, a value of zero means unlimited */
+  token_num_uses?: number;
+}
+export const AppRoleWriteTokenNumUsesRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    approle_mount_path: S.String.pipe(T.Label()),
+    role_name: S.String.pipe(T.Label()),
+    token_num_uses: S.optional(S.Number),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/auth/{approle_mount_path}/role/{role_name}/token-num-uses",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "AppRoleWriteTokenNumUsesRequest",
+}) as any as S.Schema<AppRoleWriteTokenNumUsesRequest>;
+
+export interface AppRoleWriteTokenNumUsesResponse {}
+export const AppRoleWriteTokenNumUsesResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "AppRoleWriteTokenNumUsesResponse",
+}) as any as S.Schema<AppRoleWriteTokenNumUsesResponse>;
+
+export interface AppRoleWriteTokenTtlRequest {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+  /** Name of the role. Must be less than 4096 bytes. */
+  role_name: string;
+  /** The initial ttl of the token to generate */
+  token_ttl?: number;
+}
+export const AppRoleWriteTokenTtlRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    approle_mount_path: S.String.pipe(T.Label()),
+    role_name: S.String.pipe(T.Label()),
+    token_ttl: S.optional(S.Number),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/auth/{approle_mount_path}/role/{role_name}/token-ttl",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "AppRoleWriteTokenTtlRequest",
+}) as any as S.Schema<AppRoleWriteTokenTtlRequest>;
+
+export interface AppRoleWriteTokenTtlResponse {}
+export const AppRoleWriteTokenTtlResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "AppRoleWriteTokenTtlResponse",
+}) as any as S.Schema<AppRoleWriteTokenTtlResponse>;
+
+/** Deprecated: Please use "secret_id_bound_cidrs" instead. Comma separated string or list of CIDR blocks. If set, specifies the blocks of IP addresses which can perform the login operation. */
+export type ListAppRoleWriteBoundCidrRequestBoundCidrListList = Array<string>;
+export const ListAppRoleWriteBoundCidrRequestBoundCidrListList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<ListAppRoleWriteBoundCidrRequestBoundCidrListList>;
+
+export interface ListAppRoleWriteBoundCidrRequest {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+  /** Name of the role. Must be less than 4096 bytes. */
+  role_name: string;
+  /** Deprecated: Please use "secret_id_bound_cidrs" instead. Comma separated string or list of CIDR blocks. If set, specifies the blocks of IP addresses which can perform the login operation. */
+  bound_cidr_list?: ListAppRoleWriteBoundCidrRequestBoundCidrListList;
+}
+export const ListAppRoleWriteBoundCidrRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    approle_mount_path: S.String.pipe(T.Label()),
+    role_name: S.String.pipe(T.Label()),
+    bound_cidr_list: S.optional(
+      ListAppRoleWriteBoundCidrRequestBoundCidrListList,
+    ),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/auth/{approle_mount_path}/role/{role_name}/bound-cidr-list",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "ListAppRoleWriteBoundCidrRequest",
+}) as any as S.Schema<ListAppRoleWriteBoundCidrRequest>;
+
+export interface ListAppRoleWriteBoundCidrResponse {}
+export const ListAppRoleWriteBoundCidrResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "ListAppRoleWriteBoundCidrResponse",
+}) as any as S.Schema<ListAppRoleWriteBoundCidrResponse>;
+
+export interface LoginAppRoleRequest {
+  /** Path that the backend was mounted at */
+  approle_mount_path: string;
+  /** Unique identifier of the Role. Required to be supplied when the 'bind_secret_id' constraint is set. */
+  role_id?: string;
+  /** SecretID belong to the App role */
+  secret_id?: string;
+}
+export const LoginAppRoleRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    approle_mount_path: S.String.pipe(T.Label()),
+    role_id: S.optional(S.String),
+    secret_id: S.optional(S.String),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/auth/{approle_mount_path}/login",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "LoginAppRoleRequest",
+}) as any as S.Schema<LoginAppRoleRequest>;
+
+export interface LoginAppRoleResponse {}
+export const LoginAppRoleResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "LoginAppRoleResponse",
+}) as any as S.Schema<LoginAppRoleResponse>;
+
+export type AppRoleDeleteBindSecretIdError = OpenBaoOpError;
+export const appRoleDeleteBindSecretId: API.OperationMethod<
+  AppRoleDeleteBindSecretIdRequest,
+  AppRoleDeleteBindSecretIdResponse,
+  AppRoleDeleteBindSecretIdError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AppRoleDeleteBindSecretIdRequest,
+  output: AppRoleDeleteBindSecretIdResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AppRoleDeleteBoundCidrListError = OpenBaoOpError;
+export const appRoleDeleteBoundCidrList: API.OperationMethod<
+  AppRoleDeleteBoundCidrListRequest,
+  AppRoleDeleteBoundCidrListResponse,
+  AppRoleDeleteBoundCidrListError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AppRoleDeleteBoundCidrListRequest,
+  output: AppRoleDeleteBoundCidrListResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AppRoleDeletePeriodError = OpenBaoOpError;
+export const appRoleDeletePeriod: API.OperationMethod<
+  AppRoleDeletePeriodRequest,
+  AppRoleDeletePeriodResponse,
+  AppRoleDeletePeriodError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AppRoleDeletePeriodRequest,
+  output: AppRoleDeletePeriodResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AppRoleDeletePoliciesError = OpenBaoOpError;
+export const appRoleDeletePolicies: API.OperationMethod<
+  AppRoleDeletePoliciesRequest,
+  AppRoleDeletePoliciesResponse,
+  AppRoleDeletePoliciesError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AppRoleDeletePoliciesRequest,
+  output: AppRoleDeletePoliciesResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AppRoleDeleteRoleError = OpenBaoOpError;
+export const appRoleDeleteRole: API.OperationMethod<
+  AppRoleDeleteRoleRequest,
+  AppRoleDeleteRoleResponse,
+  AppRoleDeleteRoleError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AppRoleDeleteRoleRequest,
+  output: AppRoleDeleteRoleResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AppRoleDeleteSecretIdBoundCidrsError = OpenBaoOpError;
+export const appRoleDeleteSecretIdBoundCidrs: API.OperationMethod<
+  AppRoleDeleteSecretIdBoundCidrsRequest,
+  AppRoleDeleteSecretIdBoundCidrsResponse,
+  AppRoleDeleteSecretIdBoundCidrsError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AppRoleDeleteSecretIdBoundCidrsRequest,
+  output: AppRoleDeleteSecretIdBoundCidrsResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AppRoleDeleteSecretIdNumUsesError = OpenBaoOpError;
+export const appRoleDeleteSecretIdNumUses: API.OperationMethod<
+  AppRoleDeleteSecretIdNumUsesRequest,
+  AppRoleDeleteSecretIdNumUsesResponse,
+  AppRoleDeleteSecretIdNumUsesError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AppRoleDeleteSecretIdNumUsesRequest,
+  output: AppRoleDeleteSecretIdNumUsesResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AppRoleDeleteSecretIdTtlError = OpenBaoOpError;
+export const appRoleDeleteSecretIdTtl: API.OperationMethod<
+  AppRoleDeleteSecretIdTtlRequest,
+  AppRoleDeleteSecretIdTtlResponse,
+  AppRoleDeleteSecretIdTtlError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AppRoleDeleteSecretIdTtlRequest,
+  output: AppRoleDeleteSecretIdTtlResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AppRoleDeleteTokenBoundCidrsError = OpenBaoOpError;
+export const appRoleDeleteTokenBoundCidrs: API.OperationMethod<
+  AppRoleDeleteTokenBoundCidrsRequest,
+  AppRoleDeleteTokenBoundCidrsResponse,
+  AppRoleDeleteTokenBoundCidrsError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AppRoleDeleteTokenBoundCidrsRequest,
+  output: AppRoleDeleteTokenBoundCidrsResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AppRoleDeleteTokenMaxTtlError = OpenBaoOpError;
+export const appRoleDeleteTokenMaxTtl: API.OperationMethod<
+  AppRoleDeleteTokenMaxTtlRequest,
+  AppRoleDeleteTokenMaxTtlResponse,
+  AppRoleDeleteTokenMaxTtlError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AppRoleDeleteTokenMaxTtlRequest,
+  output: AppRoleDeleteTokenMaxTtlResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AppRoleDeleteTokenNumUsesError = OpenBaoOpError;
+export const appRoleDeleteTokenNumUses: API.OperationMethod<
+  AppRoleDeleteTokenNumUsesRequest,
+  AppRoleDeleteTokenNumUsesResponse,
+  AppRoleDeleteTokenNumUsesError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AppRoleDeleteTokenNumUsesRequest,
+  output: AppRoleDeleteTokenNumUsesResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AppRoleDeleteTokenTtlError = OpenBaoOpError;
+export const appRoleDeleteTokenTtl: API.OperationMethod<
+  AppRoleDeleteTokenTtlRequest,
+  AppRoleDeleteTokenTtlResponse,
+  AppRoleDeleteTokenTtlError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AppRoleDeleteTokenTtlRequest,
+  output: AppRoleDeleteTokenTtlResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AppRoleDestroySecretIdError = OpenBaoOpError;
+export const appRoleDestroySecretId: API.OperationMethod<
+  AppRoleDestroySecretIdRequest,
+  AppRoleDestroySecretIdResponse,
+  AppRoleDestroySecretIdError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AppRoleDestroySecretIdRequest,
+  output: AppRoleDestroySecretIdResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AppRoleDestroySecretId2Error = OpenBaoOpError;
+export const appRoleDestroySecretId2: API.OperationMethod<
+  AppRoleDestroySecretId2Request,
+  AppRoleDestroySecretId2Response,
+  AppRoleDestroySecretId2Error,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AppRoleDestroySecretId2Request,
+  output: AppRoleDestroySecretId2Response,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AppRoleDestroySecretIdByAccessorError = OpenBaoOpError;
+export const appRoleDestroySecretIdByAccessor: API.OperationMethod<
+  AppRoleDestroySecretIdByAccessorRequest,
+  AppRoleDestroySecretIdByAccessorResponse,
+  AppRoleDestroySecretIdByAccessorError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AppRoleDestroySecretIdByAccessorRequest,
+  output: AppRoleDestroySecretIdByAccessorResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AppRoleDestroySecretIdByAccessor2Error = OpenBaoOpError;
+export const appRoleDestroySecretIdByAccessor2: API.OperationMethod<
+  AppRoleDestroySecretIdByAccessor2Request,
+  AppRoleDestroySecretIdByAccessor2Response,
+  AppRoleDestroySecretIdByAccessor2Error,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AppRoleDestroySecretIdByAccessor2Request,
+  output: AppRoleDestroySecretIdByAccessor2Response,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AppRoleListRolesError = OpenBaoOpError;
+export const appRoleListRoles: API.OperationMethod<
+  AppRoleListRolesRequest,
+  AppRoleListRolesResponse,
+  AppRoleListRolesError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AppRoleListRolesRequest,
+  output: AppRoleListRolesResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AppRoleListSecretIdsError = OpenBaoOpError;
+export const appRoleListSecretIds: API.OperationMethod<
+  AppRoleListSecretIdsRequest,
+  AppRoleListSecretIdsResponse,
+  AppRoleListSecretIdsError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AppRoleListSecretIdsRequest,
+  output: AppRoleListSecretIdsResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AppRoleLookUpSecretIdError = OpenBaoOpError;
+export const appRoleLookUpSecretId: API.OperationMethod<
+  AppRoleLookUpSecretIdRequest,
+  AppRoleLookUpSecretIdResponse,
+  AppRoleLookUpSecretIdError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AppRoleLookUpSecretIdRequest,
+  output: AppRoleLookUpSecretIdResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AppRoleLookUpSecretIdByAccessorError = OpenBaoOpError;
+export const appRoleLookUpSecretIdByAccessor: API.OperationMethod<
+  AppRoleLookUpSecretIdByAccessorRequest,
+  AppRoleLookUpSecretIdByAccessorResponse,
+  AppRoleLookUpSecretIdByAccessorError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AppRoleLookUpSecretIdByAccessorRequest,
+  output: AppRoleLookUpSecretIdByAccessorResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AppRoleReadBindSecretIdError = OpenBaoOpError;
+export const appRoleReadBindSecretId: API.OperationMethod<
+  AppRoleReadBindSecretIdRequest,
+  AppRoleReadBindSecretIdResponse,
+  AppRoleReadBindSecretIdError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AppRoleReadBindSecretIdRequest,
+  output: AppRoleReadBindSecretIdResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AppRoleReadBoundCidrListError = OpenBaoOpError;
+export const appRoleReadBoundCidrList: API.OperationMethod<
+  AppRoleReadBoundCidrListRequest,
+  AppRoleReadBoundCidrListResponse,
+  AppRoleReadBoundCidrListError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AppRoleReadBoundCidrListRequest,
+  output: AppRoleReadBoundCidrListResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AppRoleReadLocalSecretIdsError = OpenBaoOpError;
+export const appRoleReadLocalSecretIds: API.OperationMethod<
+  AppRoleReadLocalSecretIdsRequest,
+  AppRoleReadLocalSecretIdsResponse,
+  AppRoleReadLocalSecretIdsError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AppRoleReadLocalSecretIdsRequest,
+  output: AppRoleReadLocalSecretIdsResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AppRoleReadPeriodError = OpenBaoOpError;
+export const appRoleReadPeriod: API.OperationMethod<
+  AppRoleReadPeriodRequest,
+  AppRoleReadPeriodResponse,
+  AppRoleReadPeriodError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AppRoleReadPeriodRequest,
+  output: AppRoleReadPeriodResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AppRoleReadPoliciesError = OpenBaoOpError;
+export const appRoleReadPolicies: API.OperationMethod<
+  AppRoleReadPoliciesRequest,
+  AppRoleReadPoliciesResponse,
+  AppRoleReadPoliciesError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AppRoleReadPoliciesRequest,
+  output: AppRoleReadPoliciesResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AppRoleReadRoleError = OpenBaoOpError;
+export const appRoleReadRole: API.OperationMethod<
+  AppRoleReadRoleRequest,
+  AppRoleReadRoleResponse,
+  AppRoleReadRoleError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AppRoleReadRoleRequest,
+  output: AppRoleReadRoleResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AppRoleReadRoleIdError = OpenBaoOpError;
+export const appRoleReadRoleId: API.OperationMethod<
+  AppRoleReadRoleIdRequest,
+  AppRoleReadRoleIdResponse,
+  AppRoleReadRoleIdError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AppRoleReadRoleIdRequest,
+  output: AppRoleReadRoleIdResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AppRoleReadSecretIdBoundCidrsError = OpenBaoOpError;
+export const appRoleReadSecretIdBoundCidrs: API.OperationMethod<
+  AppRoleReadSecretIdBoundCidrsRequest,
+  AppRoleReadSecretIdBoundCidrsResponse,
+  AppRoleReadSecretIdBoundCidrsError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AppRoleReadSecretIdBoundCidrsRequest,
+  output: AppRoleReadSecretIdBoundCidrsResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AppRoleReadSecretIdNumUsesError = OpenBaoOpError;
+export const appRoleReadSecretIdNumUses: API.OperationMethod<
+  AppRoleReadSecretIdNumUsesRequest,
+  AppRoleReadSecretIdNumUsesResponse,
+  AppRoleReadSecretIdNumUsesError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AppRoleReadSecretIdNumUsesRequest,
+  output: AppRoleReadSecretIdNumUsesResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AppRoleReadSecretIdTtlError = OpenBaoOpError;
+export const appRoleReadSecretIdTtl: API.OperationMethod<
+  AppRoleReadSecretIdTtlRequest,
+  AppRoleReadSecretIdTtlResponse,
+  AppRoleReadSecretIdTtlError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AppRoleReadSecretIdTtlRequest,
+  output: AppRoleReadSecretIdTtlResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AppRoleReadTokenBoundCidrsError = OpenBaoOpError;
+export const appRoleReadTokenBoundCidrs: API.OperationMethod<
+  AppRoleReadTokenBoundCidrsRequest,
+  AppRoleReadTokenBoundCidrsResponse,
+  AppRoleReadTokenBoundCidrsError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AppRoleReadTokenBoundCidrsRequest,
+  output: AppRoleReadTokenBoundCidrsResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AppRoleReadTokenMaxTtlError = OpenBaoOpError;
+export const appRoleReadTokenMaxTtl: API.OperationMethod<
+  AppRoleReadTokenMaxTtlRequest,
+  AppRoleReadTokenMaxTtlResponse,
+  AppRoleReadTokenMaxTtlError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AppRoleReadTokenMaxTtlRequest,
+  output: AppRoleReadTokenMaxTtlResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AppRoleReadTokenNumUsesError = OpenBaoOpError;
+export const appRoleReadTokenNumUses: API.OperationMethod<
+  AppRoleReadTokenNumUsesRequest,
+  AppRoleReadTokenNumUsesResponse,
+  AppRoleReadTokenNumUsesError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AppRoleReadTokenNumUsesRequest,
+  output: AppRoleReadTokenNumUsesResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AppRoleReadTokenTtlError = OpenBaoOpError;
+export const appRoleReadTokenTtl: API.OperationMethod<
+  AppRoleReadTokenTtlRequest,
+  AppRoleReadTokenTtlResponse,
+  AppRoleReadTokenTtlError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AppRoleReadTokenTtlRequest,
+  output: AppRoleReadTokenTtlResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AppRoleTidySecretIdError = OpenBaoOpError;
+export const appRoleTidySecretId: API.OperationMethod<
+  AppRoleTidySecretIdRequest,
+  AppRoleTidySecretIdResponse,
+  AppRoleTidySecretIdError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AppRoleTidySecretIdRequest,
+  output: AppRoleTidySecretIdResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AppRoleWriteBindSecretIdError = OpenBaoOpError;
+export const appRoleWriteBindSecretId: API.OperationMethod<
+  AppRoleWriteBindSecretIdRequest,
+  AppRoleWriteBindSecretIdResponse,
+  AppRoleWriteBindSecretIdError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AppRoleWriteBindSecretIdRequest,
+  output: AppRoleWriteBindSecretIdResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AppRoleWriteCustomSecretIdError = OpenBaoOpError;
+export const appRoleWriteCustomSecretId: API.OperationMethod<
+  AppRoleWriteCustomSecretIdRequest,
+  AppRoleWriteCustomSecretIdResponse,
+  AppRoleWriteCustomSecretIdError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AppRoleWriteCustomSecretIdRequest,
+  output: AppRoleWriteCustomSecretIdResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AppRoleWritePeriodError = OpenBaoOpError;
+export const appRoleWritePeriod: API.OperationMethod<
+  AppRoleWritePeriodRequest,
+  AppRoleWritePeriodResponse,
+  AppRoleWritePeriodError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AppRoleWritePeriodRequest,
+  output: AppRoleWritePeriodResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AppRoleWritePoliciesError = OpenBaoOpError;
+export const appRoleWritePolicies: API.OperationMethod<
+  AppRoleWritePoliciesRequest,
+  AppRoleWritePoliciesResponse,
+  AppRoleWritePoliciesError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AppRoleWritePoliciesRequest,
+  output: AppRoleWritePoliciesResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AppRoleWriteRoleError = OpenBaoOpError;
+export const appRoleWriteRole: API.OperationMethod<
+  AppRoleWriteRoleRequest,
+  AppRoleWriteRoleResponse,
+  AppRoleWriteRoleError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AppRoleWriteRoleRequest,
+  output: AppRoleWriteRoleResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AppRoleWriteRoleIdError = OpenBaoOpError;
+export const appRoleWriteRoleId: API.OperationMethod<
+  AppRoleWriteRoleIdRequest,
+  AppRoleWriteRoleIdResponse,
+  AppRoleWriteRoleIdError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AppRoleWriteRoleIdRequest,
+  output: AppRoleWriteRoleIdResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AppRoleWriteSecretIdError = OpenBaoOpError;
+export const appRoleWriteSecretId: API.OperationMethod<
+  AppRoleWriteSecretIdRequest,
+  AppRoleWriteSecretIdResponse,
+  AppRoleWriteSecretIdError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AppRoleWriteSecretIdRequest,
+  output: AppRoleWriteSecretIdResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AppRoleWriteSecretIdBoundCidrsError = OpenBaoOpError;
+export const appRoleWriteSecretIdBoundCidrs: API.OperationMethod<
+  AppRoleWriteSecretIdBoundCidrsRequest,
+  AppRoleWriteSecretIdBoundCidrsResponse,
+  AppRoleWriteSecretIdBoundCidrsError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AppRoleWriteSecretIdBoundCidrsRequest,
+  output: AppRoleWriteSecretIdBoundCidrsResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AppRoleWriteSecretIdNumUsesError = OpenBaoOpError;
+export const appRoleWriteSecretIdNumUses: API.OperationMethod<
+  AppRoleWriteSecretIdNumUsesRequest,
+  AppRoleWriteSecretIdNumUsesResponse,
+  AppRoleWriteSecretIdNumUsesError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AppRoleWriteSecretIdNumUsesRequest,
+  output: AppRoleWriteSecretIdNumUsesResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AppRoleWriteSecretIdTtlError = OpenBaoOpError;
+export const appRoleWriteSecretIdTtl: API.OperationMethod<
+  AppRoleWriteSecretIdTtlRequest,
+  AppRoleWriteSecretIdTtlResponse,
+  AppRoleWriteSecretIdTtlError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AppRoleWriteSecretIdTtlRequest,
+  output: AppRoleWriteSecretIdTtlResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AppRoleWriteTokenBoundCidrsError = OpenBaoOpError;
+export const appRoleWriteTokenBoundCidrs: API.OperationMethod<
+  AppRoleWriteTokenBoundCidrsRequest,
+  AppRoleWriteTokenBoundCidrsResponse,
+  AppRoleWriteTokenBoundCidrsError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AppRoleWriteTokenBoundCidrsRequest,
+  output: AppRoleWriteTokenBoundCidrsResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AppRoleWriteTokenMaxTtlError = OpenBaoOpError;
+export const appRoleWriteTokenMaxTtl: API.OperationMethod<
+  AppRoleWriteTokenMaxTtlRequest,
+  AppRoleWriteTokenMaxTtlResponse,
+  AppRoleWriteTokenMaxTtlError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AppRoleWriteTokenMaxTtlRequest,
+  output: AppRoleWriteTokenMaxTtlResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AppRoleWriteTokenNumUsesError = OpenBaoOpError;
+export const appRoleWriteTokenNumUses: API.OperationMethod<
+  AppRoleWriteTokenNumUsesRequest,
+  AppRoleWriteTokenNumUsesResponse,
+  AppRoleWriteTokenNumUsesError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AppRoleWriteTokenNumUsesRequest,
+  output: AppRoleWriteTokenNumUsesResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AppRoleWriteTokenTtlError = OpenBaoOpError;
+export const appRoleWriteTokenTtl: API.OperationMethod<
+  AppRoleWriteTokenTtlRequest,
+  AppRoleWriteTokenTtlResponse,
+  AppRoleWriteTokenTtlError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AppRoleWriteTokenTtlRequest,
+  output: AppRoleWriteTokenTtlResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type ListAppRoleWriteBoundCidrError = OpenBaoOpError;
+export const listAppRoleWriteBoundCidr: API.OperationMethod<
+  ListAppRoleWriteBoundCidrRequest,
+  ListAppRoleWriteBoundCidrResponse,
+  ListAppRoleWriteBoundCidrError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: ListAppRoleWriteBoundCidrRequest,
+  output: ListAppRoleWriteBoundCidrResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type LoginAppRoleError = OpenBaoOpError;
+export const loginAppRole: API.OperationMethod<
+  LoginAppRoleRequest,
+  LoginAppRoleResponse,
+  LoginAppRoleError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: LoginAppRoleRequest,
+  output: LoginAppRoleResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));