@homeflare/distilled-openbao 0.2.0

package/src/services/jwt.ts

@@ -0,0 +1,1838 @@
+// AUTO-GENERATED by scripts/generate.ts from .generated-specs (specs/spec-mirror-openbao, generated — see fetch-specs.ts). Do not edit.
+import * as S from "@distilled.cloud/core/schema";
+import * as API from "@distilled.cloud/core/api";
+import * as T from "../traits.ts";
+import {
+  OpenBaoProtocol,
+  type OpenBaoOpError,
+  type OpenBaoOpContext,
+} from "../protocol.ts";
+import * as Retry from "../retry.ts";
+
+export type { OpenBaoOpError, OpenBaoOpContext };
+
+/** A list of supported signing algorithms. Defaults to RS256. */
+export type JwtConfigureRequestJwtSupportedAlgsList = Array<string>;
+export const JwtConfigureRequestJwtSupportedAlgsList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<JwtConfigureRequestJwtSupportedAlgsList>;
+
+/** A list of PEM-encoded public keys to use to authenticate signatures locally. Cannot be used with "jwks_url" or "oidc_discovery_url". */
+export type JwtConfigureRequestJwtValidationPubkeysList = Array<string>;
+export const JwtConfigureRequestJwtValidationPubkeysList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<JwtConfigureRequestJwtValidationPubkeysList>;
+
+/** The response types to request. Allowed values are 'code' and 'id_token'. Defaults to 'code'. */
+export type JwtConfigureRequestOidcResponseTypesList = Array<string>;
+export const JwtConfigureRequestOidcResponseTypesList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<JwtConfigureRequestOidcResponseTypesList>;
+
+/** A list of hostnames to accept when performing TLS validation, which applies both to OIDC and JWKS. This overrides default checks that expect the TLS subject to match the hostname specified in the connection URL */
+export type JwtConfigureRequestOverrideAllowedServerNamesList = Array<string>;
+export const JwtConfigureRequestOverrideAllowedServerNamesList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<JwtConfigureRequestOverrideAllowedServerNamesList>;
+
+export interface JwtConfigureRequest {
+  /** Path that the backend was mounted at */
+  jwt_mount_path: string;
+  /** The value against which to match the 'iss' claim in a JWT. Optional. */
+  bound_issuer?: string;
+  /** The default role to use if none is provided during login. If not set, a role is required during login. */
+  default_role?: string;
+  /** The CA certificate or chain of certificates, in PEM format, to use to validate connections to the JWKS URL. If not set, system certificates are used. */
+  jwks_ca_pem?: string;
+  /** JWKS URL to use to authenticate signatures. Cannot be used with "oidc_discovery_url" or "jwt_validation_pubkeys". */
+  jwks_url?: string;
+  /** A list of supported signing algorithms. Defaults to RS256. */
+  jwt_supported_algs?: JwtConfigureRequestJwtSupportedAlgsList;
+  /** A list of PEM-encoded public keys to use to authenticate signatures locally. Cannot be used with "jwks_url" or "oidc_discovery_url". */
+  jwt_validation_pubkeys?: JwtConfigureRequestJwtValidationPubkeysList;
+  /** Pass namespace in the OIDC state parameter instead of as a separate query parameter. With this setting, the allowed redirect URL(s) in OpenBao and on the provider side should not contain a namespace query parameter. This means only one redirect URL entry needs to be maintained on the provider side for all OpenBao namespaces that will be authenticating against it. Defaults to true for new configs. */
+  namespace_in_state?: boolean;
+  /** The OAuth Client ID configured with your OIDC provider. */
+  oidc_client_id?: string;
+  /** The OAuth Client Secret configured with your OIDC provider. */
+  oidc_client_secret?: string;
+  /** The CA certificate or chain of certificates, in PEM format, to use to validate connections to the OIDC Discovery URL. If not set, system certificates are used. */
+  oidc_discovery_ca_pem?: string;
+  /** The base URL of the OIDC Discovery URL without ".well-known/openid-configuration" component. Cannot be used with "jwks_url" or "jwt_validation_pubkeys". */
+  oidc_discovery_url?: string;
+  /** The response mode to be used in the OAuth2 request. Allowed values are 'query' and 'form_post'. */
+  oidc_response_mode?: string;
+  /** The response types to request. Allowed values are 'code' and 'id_token'. Defaults to 'code'. */
+  oidc_response_types?: JwtConfigureRequestOidcResponseTypesList;
+  /** A list of hostnames to accept when performing TLS validation, which applies both to OIDC and JWKS. This overrides default checks that expect the TLS subject to match the hostname specified in the connection URL */
+  override_allowed_server_names?: JwtConfigureRequestOverrideAllowedServerNamesList;
+  /** Provider-specific configuration. Optional. */
+  provider_config?: unknown;
+  /** When true and oidc_discovery_url or jwks_url are specified, if the connection fails to load, a warning will be issued and status can be checked later by reading the config endpoint. */
+  skip_jwks_validation?: boolean;
+}
+export const JwtConfigureRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    jwt_mount_path: S.String.pipe(T.Label()),
+    bound_issuer: S.optional(S.String),
+    default_role: S.optional(S.String),
+    jwks_ca_pem: S.optional(S.String),
+    jwks_url: S.optional(S.String),
+    jwt_supported_algs: S.optional(JwtConfigureRequestJwtSupportedAlgsList),
+    jwt_validation_pubkeys: S.optional(
+      JwtConfigureRequestJwtValidationPubkeysList,
+    ),
+    namespace_in_state: S.optional(S.Boolean),
+    oidc_client_id: S.optional(S.String),
+    oidc_client_secret: S.optional(S.String),
+    oidc_discovery_ca_pem: S.optional(S.String),
+    oidc_discovery_url: S.optional(S.String),
+    oidc_response_mode: S.optional(S.String),
+    oidc_response_types: S.optional(JwtConfigureRequestOidcResponseTypesList),
+    override_allowed_server_names: S.optional(
+      JwtConfigureRequestOverrideAllowedServerNamesList,
+    ),
+    provider_config: S.optional(S.Unknown),
+    skip_jwks_validation: S.optional(S.Boolean),
+  }).pipe(
+    T.Http({ method: "POST", uri: "/auth/{jwt_mount_path}/config", code: 200 }),
+  ),
+).annotate({
+  identifier: "JwtConfigureRequest",
+}) as any as S.Schema<JwtConfigureRequest>;
+
+export interface JwtConfigureResponse {}
+export const JwtConfigureResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "JwtConfigureResponse",
+}) as any as S.Schema<JwtConfigureResponse>;
+
+/** A list of supported signing algorithms. Defaults to RS256. */
+export type JwtConfigureRequestJwtSupportedAlgsList2 = Array<string>;
+export const JwtConfigureRequestJwtSupportedAlgsList2 = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<JwtConfigureRequestJwtSupportedAlgsList2>;
+
+/** A list of PEM-encoded public keys to use to authenticate signatures locally. Cannot be used with "jwks_url" or "oidc_discovery_url". */
+export type JwtConfigureRequestJwtValidationPubkeysList2 = Array<string>;
+export const JwtConfigureRequestJwtValidationPubkeysList2 =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<JwtConfigureRequestJwtValidationPubkeysList2>;
+
+/** The response types to request. Allowed values are 'code' and 'id_token'. Defaults to 'code'. */
+export type JwtConfigureRequestOidcResponseTypesList2 = Array<string>;
+export const JwtConfigureRequestOidcResponseTypesList2 = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<JwtConfigureRequestOidcResponseTypesList2>;
+
+/** A list of hostnames to accept when performing TLS validation, which applies both to OIDC and JWKS. This overrides default checks that expect the TLS subject to match the hostname specified in the connection URL */
+export type JwtConfigureRequestOverrideAllowedServerNamesList2 = Array<string>;
+export const JwtConfigureRequestOverrideAllowedServerNamesList2 =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<JwtConfigureRequestOverrideAllowedServerNamesList2>;
+
+export interface JwtConfigureRequest2 {
+  /** Path that the backend was mounted at */
+  oidc_mount_path: string;
+  /** The value against which to match the 'iss' claim in a JWT. Optional. */
+  bound_issuer?: string;
+  /** The default role to use if none is provided during login. If not set, a role is required during login. */
+  default_role?: string;
+  /** The CA certificate or chain of certificates, in PEM format, to use to validate connections to the JWKS URL. If not set, system certificates are used. */
+  jwks_ca_pem?: string;
+  /** JWKS URL to use to authenticate signatures. Cannot be used with "oidc_discovery_url" or "jwt_validation_pubkeys". */
+  jwks_url?: string;
+  /** A list of supported signing algorithms. Defaults to RS256. */
+  jwt_supported_algs?: JwtConfigureRequestJwtSupportedAlgsList2;
+  /** A list of PEM-encoded public keys to use to authenticate signatures locally. Cannot be used with "jwks_url" or "oidc_discovery_url". */
+  jwt_validation_pubkeys?: JwtConfigureRequestJwtValidationPubkeysList2;
+  /** Pass namespace in the OIDC state parameter instead of as a separate query parameter. With this setting, the allowed redirect URL(s) in OpenBao and on the provider side should not contain a namespace query parameter. This means only one redirect URL entry needs to be maintained on the provider side for all OpenBao namespaces that will be authenticating against it. Defaults to true for new configs. */
+  namespace_in_state?: boolean;
+  /** The OAuth Client ID configured with your OIDC provider. */
+  oidc_client_id?: string;
+  /** The OAuth Client Secret configured with your OIDC provider. */
+  oidc_client_secret?: string;
+  /** The CA certificate or chain of certificates, in PEM format, to use to validate connections to the OIDC Discovery URL. If not set, system certificates are used. */
+  oidc_discovery_ca_pem?: string;
+  /** The base URL of the OIDC Discovery URL without ".well-known/openid-configuration" component. Cannot be used with "jwks_url" or "jwt_validation_pubkeys". */
+  oidc_discovery_url?: string;
+  /** The response mode to be used in the OAuth2 request. Allowed values are 'query' and 'form_post'. */
+  oidc_response_mode?: string;
+  /** The response types to request. Allowed values are 'code' and 'id_token'. Defaults to 'code'. */
+  oidc_response_types?: JwtConfigureRequestOidcResponseTypesList2;
+  /** A list of hostnames to accept when performing TLS validation, which applies both to OIDC and JWKS. This overrides default checks that expect the TLS subject to match the hostname specified in the connection URL */
+  override_allowed_server_names?: JwtConfigureRequestOverrideAllowedServerNamesList2;
+  /** Provider-specific configuration. Optional. */
+  provider_config?: unknown;
+  /** When true and oidc_discovery_url or jwks_url are specified, if the connection fails to load, a warning will be issued and status can be checked later by reading the config endpoint. */
+  skip_jwks_validation?: boolean;
+}
+export const JwtConfigureRequest2 = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    oidc_mount_path: S.String.pipe(T.Label()),
+    bound_issuer: S.optional(S.String),
+    default_role: S.optional(S.String),
+    jwks_ca_pem: S.optional(S.String),
+    jwks_url: S.optional(S.String),
+    jwt_supported_algs: S.optional(JwtConfigureRequestJwtSupportedAlgsList2),
+    jwt_validation_pubkeys: S.optional(
+      JwtConfigureRequestJwtValidationPubkeysList2,
+    ),
+    namespace_in_state: S.optional(S.Boolean),
+    oidc_client_id: S.optional(S.String),
+    oidc_client_secret: S.optional(S.String),
+    oidc_discovery_ca_pem: S.optional(S.String),
+    oidc_discovery_url: S.optional(S.String),
+    oidc_response_mode: S.optional(S.String),
+    oidc_response_types: S.optional(JwtConfigureRequestOidcResponseTypesList2),
+    override_allowed_server_names: S.optional(
+      JwtConfigureRequestOverrideAllowedServerNamesList2,
+    ),
+    provider_config: S.optional(S.Unknown),
+    skip_jwks_validation: S.optional(S.Boolean),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/auth/{oidc_mount_path}/config",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "JwtConfigureRequest2",
+}) as any as S.Schema<JwtConfigureRequest2>;
+
+export interface JwtConfigure2Response {}
+export const JwtConfigure2Response = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "JwtConfigure2Response",
+}) as any as S.Schema<JwtConfigure2Response>;
+
+export interface JwtDeleteRoleRequest {
+  /** Path that the backend was mounted at */
+  jwt_mount_path: string;
+  /** Name of the cel role */
+  name: string;
+}
+export const JwtDeleteRoleRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    jwt_mount_path: S.String.pipe(T.Label()),
+    name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "DELETE",
+      uri: "/auth/{jwt_mount_path}/cel/role/{name}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "JwtDeleteRoleRequest",
+}) as any as S.Schema<JwtDeleteRoleRequest>;
+
+export interface JwtDeleteRoleResponse {}
+export const JwtDeleteRoleResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "JwtDeleteRoleResponse",
+}) as any as S.Schema<JwtDeleteRoleResponse>;
+
+export interface JwtDeleteRoleRequest2 {
+  /** Path that the backend was mounted at */
+  jwt_mount_path: string;
+  /** Name of the role. */
+  name: string;
+}
+export const JwtDeleteRoleRequest2 = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    jwt_mount_path: S.String.pipe(T.Label()),
+    name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "DELETE",
+      uri: "/auth/{jwt_mount_path}/role/{name}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "JwtDeleteRoleRequest2",
+}) as any as S.Schema<JwtDeleteRoleRequest2>;
+
+export interface JwtDeleteRole2Response {}
+export const JwtDeleteRole2Response = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "JwtDeleteRole2Response",
+}) as any as S.Schema<JwtDeleteRole2Response>;
+
+export interface JwtDeleteRoleRequest3 {
+  /** Path that the backend was mounted at */
+  oidc_mount_path: string;
+  /** Name of the cel role */
+  name: string;
+}
+export const JwtDeleteRoleRequest3 = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    oidc_mount_path: S.String.pipe(T.Label()),
+    name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "DELETE",
+      uri: "/auth/{oidc_mount_path}/cel/role/{name}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "JwtDeleteRoleRequest3",
+}) as any as S.Schema<JwtDeleteRoleRequest3>;
+
+export interface JwtDeleteRole3Response {}
+export const JwtDeleteRole3Response = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "JwtDeleteRole3Response",
+}) as any as S.Schema<JwtDeleteRole3Response>;
+
+export interface JwtDeleteRoleRequest4 {
+  /** Path that the backend was mounted at */
+  oidc_mount_path: string;
+  /** Name of the role. */
+  name: string;
+}
+export const JwtDeleteRoleRequest4 = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    oidc_mount_path: S.String.pipe(T.Label()),
+    name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "DELETE",
+      uri: "/auth/{oidc_mount_path}/role/{name}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "JwtDeleteRoleRequest4",
+}) as any as S.Schema<JwtDeleteRoleRequest4>;
+
+export interface JwtDeleteRole4Response {}
+export const JwtDeleteRole4Response = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "JwtDeleteRole4Response",
+}) as any as S.Schema<JwtDeleteRole4Response>;
+
+export type JwtListCelRequestList = "true";
+export const JwtListCelRequestList = S.String;
+
+export interface JwtListCelRequest {
+  /** Path that the backend was mounted at */
+  jwt_mount_path: string;
+  /** Must be set to `true` */
+  list: JwtListCelRequestList | (string & {});
+}
+export const JwtListCelRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    jwt_mount_path: S.String.pipe(T.Label()),
+    list: JwtListCelRequestList.pipe(T.Query()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/auth/{jwt_mount_path}/cel/role",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "JwtListCelRequest",
+}) as any as S.Schema<JwtListCelRequest>;
+
+/** List of CEL roles */
+export type JwtListCelResponseKeysList = Array<string>;
+export const JwtListCelResponseKeysList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<JwtListCelResponseKeysList>;
+
+export interface JwtListCelResponse {
+  /** List of CEL roles */
+  keys?: JwtListCelResponseKeysList;
+}
+export const JwtListCelResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    keys: S.optional(JwtListCelResponseKeysList),
+  }),
+).annotate({
+  identifier: "JwtListCelResponse",
+}) as any as S.Schema<JwtListCelResponse>;
+
+export type JwtListCelRequestList2 = "true";
+export const JwtListCelRequestList2 = S.String;
+
+export interface JwtListCelRequest2 {
+  /** Path that the backend was mounted at */
+  oidc_mount_path: string;
+  /** Must be set to `true` */
+  list: JwtListCelRequestList2 | (string & {});
+}
+export const JwtListCelRequest2 = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    oidc_mount_path: S.String.pipe(T.Label()),
+    list: JwtListCelRequestList2.pipe(T.Query()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/auth/{oidc_mount_path}/cel/role",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "JwtListCelRequest2",
+}) as any as S.Schema<JwtListCelRequest2>;
+
+export type JwtListRolesRequestList = "true";
+export const JwtListRolesRequestList = S.String;
+
+export interface JwtListRolesRequest {
+  /** Path that the backend was mounted at */
+  jwt_mount_path: string;
+  /** Must be set to `true` */
+  list: JwtListRolesRequestList | (string & {});
+}
+export const JwtListRolesRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    jwt_mount_path: S.String.pipe(T.Label()),
+    list: JwtListRolesRequestList.pipe(T.Query()),
+  }).pipe(
+    T.Http({ method: "GET", uri: "/auth/{jwt_mount_path}/role", code: 200 }),
+  ),
+).annotate({
+  identifier: "JwtListRolesRequest",
+}) as any as S.Schema<JwtListRolesRequest>;
+
+export interface JwtListRolesResponse {}
+export const JwtListRolesResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "JwtListRolesResponse",
+}) as any as S.Schema<JwtListRolesResponse>;
+
+export type JwtListRolesRequestList2 = "true";
+export const JwtListRolesRequestList2 = S.String;
+
+export interface JwtListRolesRequest2 {
+  /** Path that the backend was mounted at */
+  oidc_mount_path: string;
+  /** Must be set to `true` */
+  list: JwtListRolesRequestList2 | (string & {});
+}
+export const JwtListRolesRequest2 = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    oidc_mount_path: S.String.pipe(T.Label()),
+    list: JwtListRolesRequestList2.pipe(T.Query()),
+  }).pipe(
+    T.Http({ method: "GET", uri: "/auth/{oidc_mount_path}/role", code: 200 }),
+  ),
+).annotate({
+  identifier: "JwtListRolesRequest2",
+}) as any as S.Schema<JwtListRolesRequest2>;
+
+export interface JwtListRoles2Response {}
+export const JwtListRoles2Response = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "JwtListRoles2Response",
+}) as any as S.Schema<JwtListRoles2Response>;
+
+export interface JwtOidcCallbackRequest {
+  /** Path that the backend was mounted at */
+  jwt_mount_path: string;
+  client_nonce?: string;
+  code?: string;
+  confirmation?: string;
+  error?: string;
+  error_description?: string;
+  error_uri?: string;
+  state?: string;
+}
+export const JwtOidcCallbackRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    jwt_mount_path: S.String.pipe(T.Label()),
+    client_nonce: S.optional(S.String.pipe(T.Query())),
+    code: S.optional(S.String.pipe(T.Query())),
+    confirmation: S.optional(S.String.pipe(T.Query())),
+    error: S.optional(S.String.pipe(T.Query())),
+    error_description: S.optional(S.String.pipe(T.Query())),
+    error_uri: S.optional(S.String.pipe(T.Query())),
+    state: S.optional(S.String.pipe(T.Query())),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/auth/{jwt_mount_path}/oidc/callback",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "JwtOidcCallbackRequest",
+}) as any as S.Schema<JwtOidcCallbackRequest>;
+
+export interface JwtOidcCallbackResponse {}
+export const JwtOidcCallbackResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "JwtOidcCallbackResponse",
+}) as any as S.Schema<JwtOidcCallbackResponse>;
+
+export interface JwtOidcCallbackRequest2 {
+  /** Path that the backend was mounted at */
+  oidc_mount_path: string;
+  client_nonce?: string;
+  code?: string;
+  confirmation?: string;
+  error?: string;
+  error_description?: string;
+  error_uri?: string;
+  state?: string;
+}
+export const JwtOidcCallbackRequest2 = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    oidc_mount_path: S.String.pipe(T.Label()),
+    client_nonce: S.optional(S.String.pipe(T.Query())),
+    code: S.optional(S.String.pipe(T.Query())),
+    confirmation: S.optional(S.String.pipe(T.Query())),
+    error: S.optional(S.String.pipe(T.Query())),
+    error_description: S.optional(S.String.pipe(T.Query())),
+    error_uri: S.optional(S.String.pipe(T.Query())),
+    state: S.optional(S.String.pipe(T.Query())),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/auth/{oidc_mount_path}/oidc/callback",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "JwtOidcCallbackRequest2",
+}) as any as S.Schema<JwtOidcCallbackRequest2>;
+
+export interface JwtOidcCallback2Response {}
+export const JwtOidcCallback2Response = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "JwtOidcCallback2Response",
+}) as any as S.Schema<JwtOidcCallback2Response>;
+
+export interface JwtOidcRequestAuthorizationUrlRequest {
+  /** Path that the backend was mounted at */
+  jwt_mount_path: string;
+  /** Client-provided nonce that must match during callback, if present. Required only in direct callback mode. */
+  client_nonce?: string;
+  /** The OAuth redirect_uri to use in the authorization URL. Not needed with device flow. */
+  redirect_uri?: string;
+  /** The role to issue an OIDC authorization URL against. */
+  role?: string;
+}
+export const JwtOidcRequestAuthorizationUrlRequest = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({
+      jwt_mount_path: S.String.pipe(T.Label()),
+      client_nonce: S.optional(S.String),
+      redirect_uri: S.optional(S.String),
+      role: S.optional(S.String),
+    }).pipe(
+      T.Http({
+        method: "POST",
+        uri: "/auth/{jwt_mount_path}/oidc/auth_url",
+        code: 200,
+      }),
+    ),
+).annotate({
+  identifier: "JwtOidcRequestAuthorizationUrlRequest",
+}) as any as S.Schema<JwtOidcRequestAuthorizationUrlRequest>;
+
+export interface JwtOidcRequestAuthorizationUrlResponse {}
+export const JwtOidcRequestAuthorizationUrlResponse = /*@__PURE__*/ S.suspend(
+  () => S.Struct({}),
+).annotate({
+  identifier: "JwtOidcRequestAuthorizationUrlResponse",
+}) as any as S.Schema<JwtOidcRequestAuthorizationUrlResponse>;
+
+export interface JwtOidcRequestAuthorizationUrlRequest2 {
+  /** Path that the backend was mounted at */
+  oidc_mount_path: string;
+  /** Client-provided nonce that must match during callback, if present. Required only in direct callback mode. */
+  client_nonce?: string;
+  /** The OAuth redirect_uri to use in the authorization URL. Not needed with device flow. */
+  redirect_uri?: string;
+  /** The role to issue an OIDC authorization URL against. */
+  role?: string;
+}
+export const JwtOidcRequestAuthorizationUrlRequest2 = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({
+      oidc_mount_path: S.String.pipe(T.Label()),
+      client_nonce: S.optional(S.String),
+      redirect_uri: S.optional(S.String),
+      role: S.optional(S.String),
+    }).pipe(
+      T.Http({
+        method: "POST",
+        uri: "/auth/{oidc_mount_path}/oidc/auth_url",
+        code: 200,
+      }),
+    ),
+).annotate({
+  identifier: "JwtOidcRequestAuthorizationUrlRequest2",
+}) as any as S.Schema<JwtOidcRequestAuthorizationUrlRequest2>;
+
+export interface JwtOidcRequestAuthorizationUrl2Response {}
+export const JwtOidcRequestAuthorizationUrl2Response = /*@__PURE__*/ S.suspend(
+  () => S.Struct({}),
+).annotate({
+  identifier: "JwtOidcRequestAuthorizationUrl2Response",
+}) as any as S.Schema<JwtOidcRequestAuthorizationUrl2Response>;
+
+/** Comma-separated list of 'aud' claims that are valid for login; any match is sufficient */
+export type JwtPatchRoleRequestBoundAudiencesList = Array<string>;
+export const JwtPatchRoleRequestBoundAudiencesList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<JwtPatchRoleRequestBoundAudiencesList>;
+
+export interface JwtPatchRoleRequest {
+  /** Path that the backend was mounted at */
+  jwt_mount_path: string;
+  /** Name of the cel role */
+  name: string;
+  /** Comma-separated list of 'aud' claims that are valid for login; any match is sufficient */
+  bound_audiences?: JwtPatchRoleRequestBoundAudiencesList;
+  /** CEL variables and expression defining the program for the role. This is a map with two fields: 1. 'variables', a list of objects with two fields ('name' and 'expression') defining each variable and the exact execution order. 2. 'expression', the final statement to execute and whose result is returned. For example: cel_program = { "variables": [ { "name": "condition", "expression": "len(claims.groups) > 0" }, { "name": "result", "expression": "pb.Auth{Alias: claims.aud, Groups: claims.groups}" } ], "expression": "condition ? result : false" } */
+  cel_program?: unknown;
+  /** Duration in seconds of leeway when validating all claims to account for clock skew. Defaults to 60 (1 minute) if set to 0 and can be disabled if set to -1. */
+  clock_skew_leeway?: number;
+  /** Duration in seconds of leeway when validating expiration of a token to account for clock skew. Defaults to 150 (2.5 minutes) if set to 0 and can be disabled if set to -1. */
+  expiration_leeway?: number;
+  /** Static error message if validation fails */
+  message?: string;
+  /** Duration in seconds of leeway when validating not before values of a token to account for clock skew. Defaults to 150 (2.5 minutes) if set to 0 and can be disabled if set to -1. */
+  not_before_leeway?: number;
+}
+export const JwtPatchRoleRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    jwt_mount_path: S.String.pipe(T.Label()),
+    name: S.String.pipe(T.Label()),
+    bound_audiences: S.optional(JwtPatchRoleRequestBoundAudiencesList),
+    cel_program: S.optional(S.Unknown),
+    clock_skew_leeway: S.optional(S.Number),
+    expiration_leeway: S.optional(S.Number),
+    message: S.optional(S.String),
+    not_before_leeway: S.optional(S.Number),
+  }).pipe(
+    T.Http({
+      method: "PATCH",
+      uri: "/auth/{jwt_mount_path}/cel/role/{name}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "JwtPatchRoleRequest",
+}) as any as S.Schema<JwtPatchRoleRequest>;
+
+/** Comma-separated list of 'aud' claims that are valid for login; any match is sufficient */
+export type JwtPatchRoleResponseBoundAudiencesList = Array<string>;
+export const JwtPatchRoleResponseBoundAudiencesList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<JwtPatchRoleResponseBoundAudiencesList>;
+
+export interface JwtPatchRoleResponse {
+  /** Comma-separated list of 'aud' claims that are valid for login; any match is sufficient */
+  bound_audiences?: JwtPatchRoleResponseBoundAudiencesList;
+  /** CEL variables and expression defining the program for the role. This is a map with two fields: 1. 'variables', a list of objects with two fields ('name' and 'expression') defining each variable and the exact execution order. 2. 'expression', the final statement to execute and whose result is returned. For example: cel_program = { "variables": [ { "name": "condition", "expression": "len(claims.groups) > 0" }, { "name": "result", "expression": "pb.Auth{Alias: claims.aud, Groups: claims.groups}" } ], "expression": "condition ? result : false" } */
+  cel_program?: unknown;
+  /** Duration in seconds of leeway when validating all claims to account for clock skew. Defaults to 60 (1 minute) if set to 0 and can be disabled if set to -1. */
+  clock_skew_leeway?: number;
+  /** Duration in seconds of leeway when validating expiration of a token to account for clock skew. Defaults to 150 (2.5 minutes) if set to 0 and can be disabled if set to -1. */
+  expiration_leeway?: number;
+  /** Static error message if validation fails */
+  message?: string;
+  /** Name of the cel role */
+  name?: string;
+  /** Duration in seconds of leeway when validating not before values of a token to account for clock skew. Defaults to 150 (2.5 minutes) if set to 0 and can be disabled if set to -1. */
+  not_before_leeway?: number;
+}
+export const JwtPatchRoleResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    bound_audiences: S.optional(JwtPatchRoleResponseBoundAudiencesList),
+    cel_program: S.optional(S.Unknown),
+    clock_skew_leeway: S.optional(S.Number),
+    expiration_leeway: S.optional(S.Number),
+    message: S.optional(S.String),
+    name: S.optional(S.String),
+    not_before_leeway: S.optional(S.Number),
+  }),
+).annotate({
+  identifier: "JwtPatchRoleResponse",
+}) as any as S.Schema<JwtPatchRoleResponse>;
+
+/** Comma-separated list of 'aud' claims that are valid for login; any match is sufficient */
+export type JwtPatchRoleRequestBoundAudiencesList2 = Array<string>;
+export const JwtPatchRoleRequestBoundAudiencesList2 = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<JwtPatchRoleRequestBoundAudiencesList2>;
+
+export interface JwtPatchRoleRequest2 {
+  /** Path that the backend was mounted at */
+  oidc_mount_path: string;
+  /** Name of the cel role */
+  name: string;
+  /** Comma-separated list of 'aud' claims that are valid for login; any match is sufficient */
+  bound_audiences?: JwtPatchRoleRequestBoundAudiencesList2;
+  /** CEL variables and expression defining the program for the role. This is a map with two fields: 1. 'variables', a list of objects with two fields ('name' and 'expression') defining each variable and the exact execution order. 2. 'expression', the final statement to execute and whose result is returned. For example: cel_program = { "variables": [ { "name": "condition", "expression": "len(claims.groups) > 0" }, { "name": "result", "expression": "pb.Auth{Alias: claims.aud, Groups: claims.groups}" } ], "expression": "condition ? result : false" } */
+  cel_program?: unknown;
+  /** Duration in seconds of leeway when validating all claims to account for clock skew. Defaults to 60 (1 minute) if set to 0 and can be disabled if set to -1. */
+  clock_skew_leeway?: number;
+  /** Duration in seconds of leeway when validating expiration of a token to account for clock skew. Defaults to 150 (2.5 minutes) if set to 0 and can be disabled if set to -1. */
+  expiration_leeway?: number;
+  /** Static error message if validation fails */
+  message?: string;
+  /** Duration in seconds of leeway when validating not before values of a token to account for clock skew. Defaults to 150 (2.5 minutes) if set to 0 and can be disabled if set to -1. */
+  not_before_leeway?: number;
+}
+export const JwtPatchRoleRequest2 = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    oidc_mount_path: S.String.pipe(T.Label()),
+    name: S.String.pipe(T.Label()),
+    bound_audiences: S.optional(JwtPatchRoleRequestBoundAudiencesList2),
+    cel_program: S.optional(S.Unknown),
+    clock_skew_leeway: S.optional(S.Number),
+    expiration_leeway: S.optional(S.Number),
+    message: S.optional(S.String),
+    not_before_leeway: S.optional(S.Number),
+  }).pipe(
+    T.Http({
+      method: "PATCH",
+      uri: "/auth/{oidc_mount_path}/cel/role/{name}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "JwtPatchRoleRequest2",
+}) as any as S.Schema<JwtPatchRoleRequest2>;
+
+export interface JwtReadConfigurationRequest {
+  /** Path that the backend was mounted at */
+  jwt_mount_path: string;
+}
+export const JwtReadConfigurationRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    jwt_mount_path: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({ method: "GET", uri: "/auth/{jwt_mount_path}/config", code: 200 }),
+  ),
+).annotate({
+  identifier: "JwtReadConfigurationRequest",
+}) as any as S.Schema<JwtReadConfigurationRequest>;
+
+export interface JwtReadConfigurationResponse {}
+export const JwtReadConfigurationResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "JwtReadConfigurationResponse",
+}) as any as S.Schema<JwtReadConfigurationResponse>;
+
+export interface JwtReadConfigurationRequest2 {
+  /** Path that the backend was mounted at */
+  oidc_mount_path: string;
+}
+export const JwtReadConfigurationRequest2 = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    oidc_mount_path: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({ method: "GET", uri: "/auth/{oidc_mount_path}/config", code: 200 }),
+  ),
+).annotate({
+  identifier: "JwtReadConfigurationRequest2",
+}) as any as S.Schema<JwtReadConfigurationRequest2>;
+
+export interface JwtReadConfiguration2Response {}
+export const JwtReadConfiguration2Response = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "JwtReadConfiguration2Response",
+}) as any as S.Schema<JwtReadConfiguration2Response>;
+
+export interface JwtReadRoleRequest {
+  /** Path that the backend was mounted at */
+  jwt_mount_path: string;
+  /** Name of the cel role */
+  name: string;
+}
+export const JwtReadRoleRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    jwt_mount_path: S.String.pipe(T.Label()),
+    name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/auth/{jwt_mount_path}/cel/role/{name}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "JwtReadRoleRequest",
+}) as any as S.Schema<JwtReadRoleRequest>;
+
+/** Comma-separated list of 'aud' claims that are valid for login; any match is sufficient */
+export type JwtReadRoleResponseBoundAudiencesList = Array<string>;
+export const JwtReadRoleResponseBoundAudiencesList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<JwtReadRoleResponseBoundAudiencesList>;
+
+export interface JwtReadRoleResponse {
+  /** Comma-separated list of 'aud' claims that are valid for login; any match is sufficient */
+  bound_audiences?: JwtReadRoleResponseBoundAudiencesList;
+  /** CEL variables and expression defining the program for the role. This is a map with two fields: 1. 'variables', a list of objects with two fields ('name' and 'expression') defining each variable and the exact execution order. 2. 'expression', the final statement to execute and whose result is returned. For example: cel_program = { "variables": [ { "name": "condition", "expression": "len(claims.groups) > 0" }, { "name": "result", "expression": "pb.Auth{Alias: claims.aud, Groups: claims.groups}" } ], "expression": "condition ? result : false" } */
+  cel_program?: unknown;
+  /** Duration in seconds of leeway when validating all claims to account for clock skew. Defaults to 60 (1 minute) if set to 0 and can be disabled if set to -1. */
+  clock_skew_leeway?: number;
+  /** Duration in seconds of leeway when validating expiration of a token to account for clock skew. Defaults to 150 (2.5 minutes) if set to 0 and can be disabled if set to -1. */
+  expiration_leeway?: number;
+  /** Static error message if validation fails */
+  message?: string;
+  /** Name of the cel role */
+  name?: string;
+  /** Duration in seconds of leeway when validating not before values of a token to account for clock skew. Defaults to 150 (2.5 minutes) if set to 0 and can be disabled if set to -1. */
+  not_before_leeway?: number;
+}
+export const JwtReadRoleResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    bound_audiences: S.optional(JwtReadRoleResponseBoundAudiencesList),
+    cel_program: S.optional(S.Unknown),
+    clock_skew_leeway: S.optional(S.Number),
+    expiration_leeway: S.optional(S.Number),
+    message: S.optional(S.String),
+    name: S.optional(S.String),
+    not_before_leeway: S.optional(S.Number),
+  }),
+).annotate({
+  identifier: "JwtReadRoleResponse",
+}) as any as S.Schema<JwtReadRoleResponse>;
+
+export interface JwtReadRoleRequest2 {
+  /** Path that the backend was mounted at */
+  jwt_mount_path: string;
+  /** Name of the role. */
+  name: string;
+}
+export const JwtReadRoleRequest2 = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    jwt_mount_path: S.String.pipe(T.Label()),
+    name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/auth/{jwt_mount_path}/role/{name}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "JwtReadRoleRequest2",
+}) as any as S.Schema<JwtReadRoleRequest2>;
+
+export interface JwtReadRole2Response {}
+export const JwtReadRole2Response = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "JwtReadRole2Response",
+}) as any as S.Schema<JwtReadRole2Response>;
+
+export interface JwtReadRoleRequest3 {
+  /** Path that the backend was mounted at */
+  oidc_mount_path: string;
+  /** Name of the cel role */
+  name: string;
+}
+export const JwtReadRoleRequest3 = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    oidc_mount_path: S.String.pipe(T.Label()),
+    name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/auth/{oidc_mount_path}/cel/role/{name}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "JwtReadRoleRequest3",
+}) as any as S.Schema<JwtReadRoleRequest3>;
+
+export interface JwtReadRoleRequest4 {
+  /** Path that the backend was mounted at */
+  oidc_mount_path: string;
+  /** Name of the role. */
+  name: string;
+}
+export const JwtReadRoleRequest4 = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    oidc_mount_path: S.String.pipe(T.Label()),
+    name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/auth/{oidc_mount_path}/role/{name}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "JwtReadRoleRequest4",
+}) as any as S.Schema<JwtReadRoleRequest4>;
+
+export interface JwtReadRole4Response {}
+export const JwtReadRole4Response = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "JwtReadRole4Response",
+}) as any as S.Schema<JwtReadRole4Response>;
+
+/** Comma-separated list of 'aud' claims that are valid for login; any match is sufficient */
+export type JwtWriteRoleRequestBoundAudiencesList = Array<string>;
+export const JwtWriteRoleRequestBoundAudiencesList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<JwtWriteRoleRequestBoundAudiencesList>;
+
+export interface JwtWriteRoleRequest {
+  /** Path that the backend was mounted at */
+  jwt_mount_path: string;
+  /** Name of the cel role */
+  name: string;
+  /** Comma-separated list of 'aud' claims that are valid for login; any match is sufficient */
+  bound_audiences?: JwtWriteRoleRequestBoundAudiencesList;
+  /** CEL variables and expression defining the program for the role. This is a map with two fields: 1. 'variables', a list of objects with two fields ('name' and 'expression') defining each variable and the exact execution order. 2. 'expression', the final statement to execute and whose result is returned. For example: cel_program = { "variables": [ { "name": "condition", "expression": "len(claims.groups) > 0" }, { "name": "result", "expression": "pb.Auth{Alias: claims.aud, Groups: claims.groups}" } ], "expression": "condition ? result : false" } */
+  cel_program?: unknown;
+  /** Duration in seconds of leeway when validating all claims to account for clock skew. Defaults to 60 (1 minute) if set to 0 and can be disabled if set to -1. */
+  clock_skew_leeway?: number;
+  /** Duration in seconds of leeway when validating expiration of a token to account for clock skew. Defaults to 150 (2.5 minutes) if set to 0 and can be disabled if set to -1. */
+  expiration_leeway?: number;
+  /** Static error message if validation fails */
+  message?: string;
+  /** Duration in seconds of leeway when validating not before values of a token to account for clock skew. Defaults to 150 (2.5 minutes) if set to 0 and can be disabled if set to -1. */
+  not_before_leeway?: number;
+}
+export const JwtWriteRoleRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    jwt_mount_path: S.String.pipe(T.Label()),
+    name: S.String.pipe(T.Label()),
+    bound_audiences: S.optional(JwtWriteRoleRequestBoundAudiencesList),
+    cel_program: S.optional(S.Unknown),
+    clock_skew_leeway: S.optional(S.Number),
+    expiration_leeway: S.optional(S.Number),
+    message: S.optional(S.String),
+    not_before_leeway: S.optional(S.Number),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/auth/{jwt_mount_path}/cel/role/{name}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "JwtWriteRoleRequest",
+}) as any as S.Schema<JwtWriteRoleRequest>;
+
+/** Comma-separated list of 'aud' claims that are valid for login; any match is sufficient */
+export type JwtWriteRoleResponseBoundAudiencesList = Array<string>;
+export const JwtWriteRoleResponseBoundAudiencesList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<JwtWriteRoleResponseBoundAudiencesList>;
+
+export interface JwtWriteRoleResponse {
+  /** Comma-separated list of 'aud' claims that are valid for login; any match is sufficient */
+  bound_audiences?: JwtWriteRoleResponseBoundAudiencesList;
+  /** CEL variables and expression defining the program for the role. This is a map with two fields: 1. 'variables', a list of objects with two fields ('name' and 'expression') defining each variable and the exact execution order. 2. 'expression', the final statement to execute and whose result is returned. For example: cel_program = { "variables": [ { "name": "condition", "expression": "len(claims.groups) > 0" }, { "name": "result", "expression": "pb.Auth{Alias: claims.aud, Groups: claims.groups}" } ], "expression": "condition ? result : false" } */
+  cel_program?: unknown;
+  /** Duration in seconds of leeway when validating all claims to account for clock skew. Defaults to 60 (1 minute) if set to 0 and can be disabled if set to -1. */
+  clock_skew_leeway?: number;
+  /** Duration in seconds of leeway when validating expiration of a token to account for clock skew. Defaults to 150 (2.5 minutes) if set to 0 and can be disabled if set to -1. */
+  expiration_leeway?: number;
+  /** Static error message if validation fails */
+  message?: string;
+  /** Name of the cel role */
+  name?: string;
+  /** Duration in seconds of leeway when validating not before values of a token to account for clock skew. Defaults to 150 (2.5 minutes) if set to 0 and can be disabled if set to -1. */
+  not_before_leeway?: number;
+}
+export const JwtWriteRoleResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    bound_audiences: S.optional(JwtWriteRoleResponseBoundAudiencesList),
+    cel_program: S.optional(S.Unknown),
+    clock_skew_leeway: S.optional(S.Number),
+    expiration_leeway: S.optional(S.Number),
+    message: S.optional(S.String),
+    name: S.optional(S.String),
+    not_before_leeway: S.optional(S.Number),
+  }),
+).annotate({
+  identifier: "JwtWriteRoleResponse",
+}) as any as S.Schema<JwtWriteRoleResponse>;
+
+/** Comma-separated list of 'aud' claims that are valid for login; any match is sufficient */
+export type JwtWriteRoleRequestBoundAudiencesList2 = Array<string>;
+export const JwtWriteRoleRequestBoundAudiencesList2 = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<JwtWriteRoleRequestBoundAudiencesList2>;
+
+export interface JwtWriteRoleRequest2 {
+  /** Path that the backend was mounted at */
+  jwt_mount_path: string;
+  /** Name of the role. */
+  name: string;
+  /** Comma-separated list of 'aud' claims that are valid for login; any match is sufficient */
+  bound_audiences?: JwtWriteRoleRequestBoundAudiencesList2;
+  /** CEL variables and expression defining the program for the role. This is a map with two fields: 1. 'variables', a list of objects with two fields ('name' and 'expression') defining each variable and the exact execution order. 2. 'expression', the final statement to execute and whose result is returned. For example: cel_program = { "variables": [ { "name": "condition", "expression": "len(claims.groups) > 0" }, { "name": "result", "expression": "pb.Auth{Alias: claims.aud, Groups: claims.groups}" } ], "expression": "condition ? result : false" } */
+  cel_program?: unknown;
+  /** Duration in seconds of leeway when validating all claims to account for clock skew. Defaults to 60 (1 minute) if set to 0 and can be disabled if set to -1. */
+  clock_skew_leeway?: number;
+  /** Duration in seconds of leeway when validating expiration of a token to account for clock skew. Defaults to 150 (2.5 minutes) if set to 0 and can be disabled if set to -1. */
+  expiration_leeway?: number;
+  /** Static error message if validation fails */
+  message?: string;
+  /** Duration in seconds of leeway when validating not before values of a token to account for clock skew. Defaults to 150 (2.5 minutes) if set to 0 and can be disabled if set to -1. */
+  not_before_leeway?: number;
+}
+export const JwtWriteRoleRequest2 = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    jwt_mount_path: S.String.pipe(T.Label()),
+    name: S.String.pipe(T.Label()),
+    bound_audiences: S.optional(JwtWriteRoleRequestBoundAudiencesList2),
+    cel_program: S.optional(S.Unknown),
+    clock_skew_leeway: S.optional(S.Number),
+    expiration_leeway: S.optional(S.Number),
+    message: S.optional(S.String),
+    not_before_leeway: S.optional(S.Number),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/auth/{jwt_mount_path}/role/{name}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "JwtWriteRoleRequest2",
+}) as any as S.Schema<JwtWriteRoleRequest2>;
+
+export interface JwtWriteRole2Response {}
+export const JwtWriteRole2Response = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "JwtWriteRole2Response",
+}) as any as S.Schema<JwtWriteRole2Response>;
+
+/** Comma-separated list of 'aud' claims that are valid for login; any match is sufficient */
+export type JwtWriteRoleRequestBoundAudiencesList3 = Array<string>;
+export const JwtWriteRoleRequestBoundAudiencesList3 = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<JwtWriteRoleRequestBoundAudiencesList3>;
+
+export interface JwtWriteRoleRequest3 {
+  /** Path that the backend was mounted at */
+  oidc_mount_path: string;
+  /** Name of the cel role */
+  name: string;
+  /** Comma-separated list of 'aud' claims that are valid for login; any match is sufficient */
+  bound_audiences?: JwtWriteRoleRequestBoundAudiencesList3;
+  /** CEL variables and expression defining the program for the role. This is a map with two fields: 1. 'variables', a list of objects with two fields ('name' and 'expression') defining each variable and the exact execution order. 2. 'expression', the final statement to execute and whose result is returned. For example: cel_program = { "variables": [ { "name": "condition", "expression": "len(claims.groups) > 0" }, { "name": "result", "expression": "pb.Auth{Alias: claims.aud, Groups: claims.groups}" } ], "expression": "condition ? result : false" } */
+  cel_program?: unknown;
+  /** Duration in seconds of leeway when validating all claims to account for clock skew. Defaults to 60 (1 minute) if set to 0 and can be disabled if set to -1. */
+  clock_skew_leeway?: number;
+  /** Duration in seconds of leeway when validating expiration of a token to account for clock skew. Defaults to 150 (2.5 minutes) if set to 0 and can be disabled if set to -1. */
+  expiration_leeway?: number;
+  /** Static error message if validation fails */
+  message?: string;
+  /** Duration in seconds of leeway when validating not before values of a token to account for clock skew. Defaults to 150 (2.5 minutes) if set to 0 and can be disabled if set to -1. */
+  not_before_leeway?: number;
+}
+export const JwtWriteRoleRequest3 = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    oidc_mount_path: S.String.pipe(T.Label()),
+    name: S.String.pipe(T.Label()),
+    bound_audiences: S.optional(JwtWriteRoleRequestBoundAudiencesList3),
+    cel_program: S.optional(S.Unknown),
+    clock_skew_leeway: S.optional(S.Number),
+    expiration_leeway: S.optional(S.Number),
+    message: S.optional(S.String),
+    not_before_leeway: S.optional(S.Number),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/auth/{oidc_mount_path}/cel/role/{name}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "JwtWriteRoleRequest3",
+}) as any as S.Schema<JwtWriteRoleRequest3>;
+
+/** Comma-separated list of 'aud' claims that are valid for login; any match is sufficient */
+export type JwtWriteRoleRequestBoundAudiencesList4 = Array<string>;
+export const JwtWriteRoleRequestBoundAudiencesList4 = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<JwtWriteRoleRequestBoundAudiencesList4>;
+
+export interface JwtWriteRoleRequest4 {
+  /** Path that the backend was mounted at */
+  oidc_mount_path: string;
+  /** Name of the role. */
+  name: string;
+  /** Comma-separated list of 'aud' claims that are valid for login; any match is sufficient */
+  bound_audiences?: JwtWriteRoleRequestBoundAudiencesList4;
+  /** CEL variables and expression defining the program for the role. This is a map with two fields: 1. 'variables', a list of objects with two fields ('name' and 'expression') defining each variable and the exact execution order. 2. 'expression', the final statement to execute and whose result is returned. For example: cel_program = { "variables": [ { "name": "condition", "expression": "len(claims.groups) > 0" }, { "name": "result", "expression": "pb.Auth{Alias: claims.aud, Groups: claims.groups}" } ], "expression": "condition ? result : false" } */
+  cel_program?: unknown;
+  /** Duration in seconds of leeway when validating all claims to account for clock skew. Defaults to 60 (1 minute) if set to 0 and can be disabled if set to -1. */
+  clock_skew_leeway?: number;
+  /** Duration in seconds of leeway when validating expiration of a token to account for clock skew. Defaults to 150 (2.5 minutes) if set to 0 and can be disabled if set to -1. */
+  expiration_leeway?: number;
+  /** Static error message if validation fails */
+  message?: string;
+  /** Duration in seconds of leeway when validating not before values of a token to account for clock skew. Defaults to 150 (2.5 minutes) if set to 0 and can be disabled if set to -1. */
+  not_before_leeway?: number;
+}
+export const JwtWriteRoleRequest4 = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    oidc_mount_path: S.String.pipe(T.Label()),
+    name: S.String.pipe(T.Label()),
+    bound_audiences: S.optional(JwtWriteRoleRequestBoundAudiencesList4),
+    cel_program: S.optional(S.Unknown),
+    clock_skew_leeway: S.optional(S.Number),
+    expiration_leeway: S.optional(S.Number),
+    message: S.optional(S.String),
+    not_before_leeway: S.optional(S.Number),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/auth/{oidc_mount_path}/role/{name}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "JwtWriteRoleRequest4",
+}) as any as S.Schema<JwtWriteRoleRequest4>;
+
+export interface JwtWriteRole4Response {}
+export const JwtWriteRole4Response = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "JwtWriteRole4Response",
+}) as any as S.Schema<JwtWriteRole4Response>;
+
+export interface LoginJwtRequest {
+  /** Path that the backend was mounted at */
+  jwt_mount_path: string;
+  /** The signed JWT to validate. */
+  jwt?: string;
+  /** The CEL role to log in against. */
+  role?: string;
+}
+export const LoginJwtRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    jwt_mount_path: S.String.pipe(T.Label()),
+    jwt: S.optional(S.String),
+    role: S.optional(S.String),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/auth/{jwt_mount_path}/cel/login",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "LoginJwtRequest",
+}) as any as S.Schema<LoginJwtRequest>;
+
+export interface LoginJwtResponse {}
+export const LoginJwtResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "LoginJwtResponse",
+}) as any as S.Schema<LoginJwtResponse>;
+
+export interface LoginJwtRequest2 {
+  /** Path that the backend was mounted at */
+  jwt_mount_path: string;
+  /** The signed JWT to validate. */
+  jwt?: string;
+  /** The CEL role to log in against. */
+  role?: string;
+}
+export const LoginJwtRequest2 = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    jwt_mount_path: S.String.pipe(T.Label()),
+    jwt: S.optional(S.String),
+    role: S.optional(S.String),
+  }).pipe(
+    T.Http({ method: "POST", uri: "/auth/{jwt_mount_path}/login", code: 200 }),
+  ),
+).annotate({
+  identifier: "LoginJwtRequest2",
+}) as any as S.Schema<LoginJwtRequest2>;
+
+export interface LoginJwt2Response {}
+export const LoginJwt2Response = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "LoginJwt2Response",
+}) as any as S.Schema<LoginJwt2Response>;
+
+export interface LoginJwtRequest3 {
+  /** Path that the backend was mounted at */
+  oidc_mount_path: string;
+  /** The signed JWT to validate. */
+  jwt?: string;
+  /** The CEL role to log in against. */
+  role?: string;
+}
+export const LoginJwtRequest3 = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    oidc_mount_path: S.String.pipe(T.Label()),
+    jwt: S.optional(S.String),
+    role: S.optional(S.String),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/auth/{oidc_mount_path}/cel/login",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "LoginJwtRequest3",
+}) as any as S.Schema<LoginJwtRequest3>;
+
+export interface LoginJwt3Response {}
+export const LoginJwt3Response = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "LoginJwt3Response",
+}) as any as S.Schema<LoginJwt3Response>;
+
+export interface LoginJwtRequest4 {
+  /** Path that the backend was mounted at */
+  oidc_mount_path: string;
+  /** The signed JWT to validate. */
+  jwt?: string;
+  /** The CEL role to log in against. */
+  role?: string;
+}
+export const LoginJwtRequest4 = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    oidc_mount_path: S.String.pipe(T.Label()),
+    jwt: S.optional(S.String),
+    role: S.optional(S.String),
+  }).pipe(
+    T.Http({ method: "POST", uri: "/auth/{oidc_mount_path}/login", code: 200 }),
+  ),
+).annotate({
+  identifier: "LoginJwtRequest4",
+}) as any as S.Schema<LoginJwtRequest4>;
+
+export interface LoginJwt4Response {}
+export const LoginJwt4Response = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "LoginJwt4Response",
+}) as any as S.Schema<LoginJwt4Response>;
+
+export interface PollJwtWriteOidcRequest {
+  /** Path that the backend was mounted at */
+  jwt_mount_path: string;
+  client_nonce?: string;
+  state?: string;
+}
+export const PollJwtWriteOidcRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    jwt_mount_path: S.String.pipe(T.Label()),
+    client_nonce: S.optional(S.String),
+    state: S.optional(S.String),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/auth/{jwt_mount_path}/oidc/poll",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "PollJwtWriteOidcRequest",
+}) as any as S.Schema<PollJwtWriteOidcRequest>;
+
+export interface PollJwtWriteOidcResponse {}
+export const PollJwtWriteOidcResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "PollJwtWriteOidcResponse",
+}) as any as S.Schema<PollJwtWriteOidcResponse>;
+
+export interface PostJwtOidcCallbackFormRequest {
+  /** Path that the backend was mounted at */
+  jwt_mount_path: string;
+  client_nonce?: string;
+  code?: string;
+  confirmation?: string;
+  error?: string;
+  error_description?: string;
+  error_uri?: string;
+  state?: string;
+  id_token?: string;
+}
+export const PostJwtOidcCallbackFormRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    jwt_mount_path: S.String.pipe(T.Label()),
+    client_nonce: S.optional(S.String.pipe(T.Query())),
+    code: S.optional(S.String.pipe(T.Query())),
+    confirmation: S.optional(S.String.pipe(T.Query())),
+    error: S.optional(S.String.pipe(T.Query())),
+    error_description: S.optional(S.String.pipe(T.Query())),
+    error_uri: S.optional(S.String.pipe(T.Query())),
+    state: S.optional(S.String.pipe(T.Query())),
+    id_token: S.optional(S.String),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/auth/{jwt_mount_path}/oidc/callback",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "PostJwtOidcCallbackFormRequest",
+}) as any as S.Schema<PostJwtOidcCallbackFormRequest>;
+
+export interface PostJwtOidcCallbackFormResponse {}
+export const PostJwtOidcCallbackFormResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "PostJwtOidcCallbackFormResponse",
+}) as any as S.Schema<PostJwtOidcCallbackFormResponse>;
+
+export interface PostJwtOidcCallbackFormRequest2 {
+  /** Path that the backend was mounted at */
+  oidc_mount_path: string;
+  client_nonce?: string;
+  code?: string;
+  confirmation?: string;
+  error?: string;
+  error_description?: string;
+  error_uri?: string;
+  state?: string;
+  id_token?: string;
+}
+export const PostJwtOidcCallbackFormRequest2 = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    oidc_mount_path: S.String.pipe(T.Label()),
+    client_nonce: S.optional(S.String.pipe(T.Query())),
+    code: S.optional(S.String.pipe(T.Query())),
+    confirmation: S.optional(S.String.pipe(T.Query())),
+    error: S.optional(S.String.pipe(T.Query())),
+    error_description: S.optional(S.String.pipe(T.Query())),
+    error_uri: S.optional(S.String.pipe(T.Query())),
+    state: S.optional(S.String.pipe(T.Query())),
+    id_token: S.optional(S.String),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/auth/{oidc_mount_path}/oidc/callback",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "PostJwtOidcCallbackFormRequest2",
+}) as any as S.Schema<PostJwtOidcCallbackFormRequest2>;
+
+export interface PostJwtOidcCallbackForm2Response {}
+export const PostJwtOidcCallbackForm2Response = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "PostJwtOidcCallbackForm2Response",
+}) as any as S.Schema<PostJwtOidcCallbackForm2Response>;
+
+export type JwtConfigureError = OpenBaoOpError;
+/** Configure the JWT authentication backend. The JWT authentication backend validates JWTs (or OIDC) using the configured credentials. If using OIDC Discovery, the URL must be provided, along with (optionally) the CA cert to use for the connection. If performing JWT validation locally, a set of public keys must be provided. */
+export const jwtConfigure: API.OperationMethod<
+  JwtConfigureRequest,
+  JwtConfigureResponse,
+  JwtConfigureError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: JwtConfigureRequest,
+  output: JwtConfigureResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type JwtConfigure2Error = OpenBaoOpError;
+/** Configure the JWT authentication backend. The JWT authentication backend validates JWTs (or OIDC) using the configured credentials. If using OIDC Discovery, the URL must be provided, along with (optionally) the CA cert to use for the connection. If performing JWT validation locally, a set of public keys must be provided. */
+export const jwtConfigure2: API.OperationMethod<
+  JwtConfigureRequest2,
+  JwtConfigure2Response,
+  JwtConfigure2Error,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: JwtConfigureRequest2,
+  output: JwtConfigure2Response,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type JwtDeleteRoleError = OpenBaoOpError;
+export const jwtDeleteRole: API.OperationMethod<
+  JwtDeleteRoleRequest,
+  JwtDeleteRoleResponse,
+  JwtDeleteRoleError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: JwtDeleteRoleRequest,
+  output: JwtDeleteRoleResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type JwtDeleteRole2Error = OpenBaoOpError;
+/** Delete an existing role. */
+export const jwtDeleteRole2: API.OperationMethod<
+  JwtDeleteRoleRequest2,
+  JwtDeleteRole2Response,
+  JwtDeleteRole2Error,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: JwtDeleteRoleRequest2,
+  output: JwtDeleteRole2Response,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type JwtDeleteRole3Error = OpenBaoOpError;
+export const jwtDeleteRole3: API.OperationMethod<
+  JwtDeleteRoleRequest3,
+  JwtDeleteRole3Response,
+  JwtDeleteRole3Error,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: JwtDeleteRoleRequest3,
+  output: JwtDeleteRole3Response,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type JwtDeleteRole4Error = OpenBaoOpError;
+/** Delete an existing role. */
+export const jwtDeleteRole4: API.OperationMethod<
+  JwtDeleteRoleRequest4,
+  JwtDeleteRole4Response,
+  JwtDeleteRole4Error,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: JwtDeleteRoleRequest4,
+  output: JwtDeleteRole4Response,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type JwtListCelError = OpenBaoOpError;
+export const jwtListCel: API.OperationMethod<
+  JwtListCelRequest,
+  JwtListCelResponse,
+  JwtListCelError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: JwtListCelRequest,
+  output: JwtListCelResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type JwtListCel2Error = OpenBaoOpError;
+export const jwtListCel2: API.OperationMethod<
+  JwtListCelRequest2,
+  JwtListCelResponse,
+  JwtListCel2Error,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: JwtListCelRequest2,
+  output: JwtListCelResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type JwtListRolesError = OpenBaoOpError;
+/** Lists all the roles registered with the backend. The list will contain the names of the roles. */
+export const jwtListRoles: API.OperationMethod<
+  JwtListRolesRequest,
+  JwtListRolesResponse,
+  JwtListRolesError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: JwtListRolesRequest,
+  output: JwtListRolesResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type JwtListRoles2Error = OpenBaoOpError;
+/** Lists all the roles registered with the backend. The list will contain the names of the roles. */
+export const jwtListRoles2: API.OperationMethod<
+  JwtListRolesRequest2,
+  JwtListRoles2Response,
+  JwtListRoles2Error,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: JwtListRolesRequest2,
+  output: JwtListRoles2Response,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type JwtOidcCallbackError = OpenBaoOpError;
+/** Callback endpoint to complete an OIDC login. */
+export const jwtOidcCallback: API.OperationMethod<
+  JwtOidcCallbackRequest,
+  JwtOidcCallbackResponse,
+  JwtOidcCallbackError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: JwtOidcCallbackRequest,
+  output: JwtOidcCallbackResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type JwtOidcCallback2Error = OpenBaoOpError;
+/** Callback endpoint to complete an OIDC login. */
+export const jwtOidcCallback2: API.OperationMethod<
+  JwtOidcCallbackRequest2,
+  JwtOidcCallback2Response,
+  JwtOidcCallback2Error,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: JwtOidcCallbackRequest2,
+  output: JwtOidcCallback2Response,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type JwtOidcRequestAuthorizationUrlError = OpenBaoOpError;
+/** Request an authorization URL to start an OIDC login flow. */
+export const jwtOidcRequestAuthorizationUrl: API.OperationMethod<
+  JwtOidcRequestAuthorizationUrlRequest,
+  JwtOidcRequestAuthorizationUrlResponse,
+  JwtOidcRequestAuthorizationUrlError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: JwtOidcRequestAuthorizationUrlRequest,
+  output: JwtOidcRequestAuthorizationUrlResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type JwtOidcRequestAuthorizationUrl2Error = OpenBaoOpError;
+/** Request an authorization URL to start an OIDC login flow. */
+export const jwtOidcRequestAuthorizationUrl2: API.OperationMethod<
+  JwtOidcRequestAuthorizationUrlRequest2,
+  JwtOidcRequestAuthorizationUrl2Response,
+  JwtOidcRequestAuthorizationUrl2Error,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: JwtOidcRequestAuthorizationUrlRequest2,
+  output: JwtOidcRequestAuthorizationUrl2Response,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type JwtPatchRoleError = OpenBaoOpError;
+export const jwtPatchRole: API.OperationMethod<
+  JwtPatchRoleRequest,
+  JwtPatchRoleResponse,
+  JwtPatchRoleError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: JwtPatchRoleRequest,
+  output: JwtPatchRoleResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type JwtPatchRole2Error = OpenBaoOpError;
+export const jwtPatchRole2: API.OperationMethod<
+  JwtPatchRoleRequest2,
+  JwtPatchRoleResponse,
+  JwtPatchRole2Error,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: JwtPatchRoleRequest2,
+  output: JwtPatchRoleResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type JwtReadConfigurationError = OpenBaoOpError;
+/** Read the current JWT authentication backend configuration. */
+export const jwtReadConfiguration: API.OperationMethod<
+  JwtReadConfigurationRequest,
+  JwtReadConfigurationResponse,
+  JwtReadConfigurationError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: JwtReadConfigurationRequest,
+  output: JwtReadConfigurationResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type JwtReadConfiguration2Error = OpenBaoOpError;
+/** Read the current JWT authentication backend configuration. */
+export const jwtReadConfiguration2: API.OperationMethod<
+  JwtReadConfigurationRequest2,
+  JwtReadConfiguration2Response,
+  JwtReadConfiguration2Error,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: JwtReadConfigurationRequest2,
+  output: JwtReadConfiguration2Response,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type JwtReadRoleError = OpenBaoOpError;
+export const jwtReadRole: API.OperationMethod<
+  JwtReadRoleRequest,
+  JwtReadRoleResponse,
+  JwtReadRoleError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: JwtReadRoleRequest,
+  output: JwtReadRoleResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type JwtReadRole2Error = OpenBaoOpError;
+/** Read an existing role. */
+export const jwtReadRole2: API.OperationMethod<
+  JwtReadRoleRequest2,
+  JwtReadRole2Response,
+  JwtReadRole2Error,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: JwtReadRoleRequest2,
+  output: JwtReadRole2Response,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type JwtReadRole3Error = OpenBaoOpError;
+export const jwtReadRole3: API.OperationMethod<
+  JwtReadRoleRequest3,
+  JwtReadRoleResponse,
+  JwtReadRole3Error,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: JwtReadRoleRequest3,
+  output: JwtReadRoleResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type JwtReadRole4Error = OpenBaoOpError;
+/** Read an existing role. */
+export const jwtReadRole4: API.OperationMethod<
+  JwtReadRoleRequest4,
+  JwtReadRole4Response,
+  JwtReadRole4Error,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: JwtReadRoleRequest4,
+  output: JwtReadRole4Response,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type JwtWriteRoleError = OpenBaoOpError;
+export const jwtWriteRole: API.OperationMethod<
+  JwtWriteRoleRequest,
+  JwtWriteRoleResponse,
+  JwtWriteRoleError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: JwtWriteRoleRequest,
+  output: JwtWriteRoleResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type JwtWriteRole2Error = OpenBaoOpError;
+/** Register an role with the backend. A role is required to authenticate with this backend. The role binds JWT token information with token policies and settings. The bindings, token polices and token settings can all be configured using this endpoint */
+export const jwtWriteRole2: API.OperationMethod<
+  JwtWriteRoleRequest2,
+  JwtWriteRole2Response,
+  JwtWriteRole2Error,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: JwtWriteRoleRequest2,
+  output: JwtWriteRole2Response,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type JwtWriteRole3Error = OpenBaoOpError;
+export const jwtWriteRole3: API.OperationMethod<
+  JwtWriteRoleRequest3,
+  JwtWriteRoleResponse,
+  JwtWriteRole3Error,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: JwtWriteRoleRequest3,
+  output: JwtWriteRoleResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type JwtWriteRole4Error = OpenBaoOpError;
+/** Register an role with the backend. A role is required to authenticate with this backend. The role binds JWT token information with token policies and settings. The bindings, token polices and token settings can all be configured using this endpoint */
+export const jwtWriteRole4: API.OperationMethod<
+  JwtWriteRoleRequest4,
+  JwtWriteRole4Response,
+  JwtWriteRole4Error,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: JwtWriteRoleRequest4,
+  output: JwtWriteRole4Response,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type LoginJwtError = OpenBaoOpError;
+/** Authenticates to OpenBao using a JWT (or OIDC) token against a CEL role. */
+export const loginJwt: API.OperationMethod<
+  LoginJwtRequest,
+  LoginJwtResponse,
+  LoginJwtError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: LoginJwtRequest,
+  output: LoginJwtResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type LoginJwt2Error = OpenBaoOpError;
+/** Authenticates to OpenBao using a JWT (or OIDC) token. */
+export const loginJwt2: API.OperationMethod<
+  LoginJwtRequest2,
+  LoginJwt2Response,
+  LoginJwt2Error,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: LoginJwtRequest2,
+  output: LoginJwt2Response,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type LoginJwt3Error = OpenBaoOpError;
+/** Authenticates to OpenBao using a JWT (or OIDC) token against a CEL role. */
+export const loginJwt3: API.OperationMethod<
+  LoginJwtRequest3,
+  LoginJwt3Response,
+  LoginJwt3Error,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: LoginJwtRequest3,
+  output: LoginJwt3Response,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type LoginJwt4Error = OpenBaoOpError;
+/** Authenticates to OpenBao using a JWT (or OIDC) token. */
+export const loginJwt4: API.OperationMethod<
+  LoginJwtRequest4,
+  LoginJwt4Response,
+  LoginJwt4Error,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: LoginJwtRequest4,
+  output: LoginJwt4Response,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type PollJwtWriteOidcError = OpenBaoOpError;
+/** Poll endpoint to complete an OIDC login. */
+export const pollJwtWriteOidc: API.OperationMethod<
+  PollJwtWriteOidcRequest,
+  PollJwtWriteOidcResponse,
+  PollJwtWriteOidcError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: PollJwtWriteOidcRequest,
+  output: PollJwtWriteOidcResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type PostJwtOidcCallbackFormError = OpenBaoOpError;
+/** Callback endpoint to handle form_posts. */
+export const postJwtOidcCallbackForm: API.OperationMethod<
+  PostJwtOidcCallbackFormRequest,
+  PostJwtOidcCallbackFormResponse,
+  PostJwtOidcCallbackFormError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: PostJwtOidcCallbackFormRequest,
+  output: PostJwtOidcCallbackFormResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type PostJwtOidcCallbackForm2Error = OpenBaoOpError;
+/** Callback endpoint to handle form_posts. */
+export const postJwtOidcCallbackForm2: API.OperationMethod<
+  PostJwtOidcCallbackFormRequest2,
+  PostJwtOidcCallbackForm2Response,
+  PostJwtOidcCallbackForm2Error,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: PostJwtOidcCallbackFormRequest2,
+  output: PostJwtOidcCallbackForm2Response,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));