@homeflare/distilled-openbao 0.2.0

package/src/services/token.ts

@@ -0,0 +1,1046 @@
+// AUTO-GENERATED by scripts/generate.ts from .generated-specs (specs/spec-mirror-openbao, generated — see fetch-specs.ts). Do not edit.
+import * as S from "@distilled.cloud/core/schema";
+import * as API from "@distilled.cloud/core/api";
+import * as T from "../traits.ts";
+import {
+  OpenBaoProtocol,
+  type OpenBaoOpError,
+  type OpenBaoOpContext,
+} from "../protocol.ts";
+import * as Retry from "../retry.ts";
+
+export type { OpenBaoOpError, OpenBaoOpContext };
+
+/** List of policies for the token */
+export type CreateTokenRequestPoliciesList = Array<string>;
+export const CreateTokenRequestPoliciesList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<CreateTokenRequestPoliciesList>;
+
+export interface CreateTokenRequest {
+  /** Name to associate with this token */
+  display_name?: string;
+  /** Name of the entity alias to associate with this token */
+  entity_alias?: string;
+  /** Explicit Max TTL of this token */
+  explicit_max_ttl?: string;
+  /** Value for the token */
+  id?: string;
+  /** Use 'ttl' instead */
+  lease?: string;
+  /** Arbitrary key=value metadata to associate with the token */
+  meta?: unknown;
+  /** Do not include default policy for this token */
+  no_default_policy?: boolean;
+  /** Create the token with no parent */
+  no_parent?: boolean;
+  /** Max number of uses for this token */
+  num_uses?: number;
+  /** Renew period */
+  period?: string;
+  /** List of policies for the token */
+  policies?: CreateTokenRequestPoliciesList;
+  /** Allow token to be renewed past its initial TTL up to system/mount maximum TTL */
+  renewable?: boolean;
+  /** Time to live for this token */
+  ttl?: string;
+  /** Token type */
+  type?: string;
+}
+export const CreateTokenRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    display_name: S.optional(S.String),
+    entity_alias: S.optional(S.String),
+    explicit_max_ttl: S.optional(S.String),
+    id: S.optional(S.String),
+    lease: S.optional(S.String),
+    meta: S.optional(S.Unknown),
+    no_default_policy: S.optional(S.Boolean),
+    no_parent: S.optional(S.Boolean),
+    num_uses: S.optional(S.Number),
+    period: S.optional(S.String),
+    policies: S.optional(CreateTokenRequestPoliciesList),
+    renewable: S.optional(S.Boolean),
+    ttl: S.optional(S.String),
+    type: S.optional(S.String),
+  }).pipe(T.Http({ method: "POST", uri: "/auth/token/create", code: 200 })),
+).annotate({
+  identifier: "CreateTokenRequest",
+}) as any as S.Schema<CreateTokenRequest>;
+
+export interface CreateTokenResponse {}
+export const CreateTokenResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "CreateTokenResponse",
+}) as any as S.Schema<CreateTokenResponse>;
+
+export interface GetTokenLookUpRequest {}
+export const GetTokenLookUpRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}).pipe(
+    T.Http({ method: "GET", uri: "/auth/token/lookup", code: 200 }),
+  ),
+).annotate({
+  identifier: "GetTokenLookUpRequest",
+}) as any as S.Schema<GetTokenLookUpRequest>;
+
+/** List of CIDR blocks bound to the token */
+export type TokenLookupResponseBoundCidrsList = Array<string>;
+export const TokenLookupResponseBoundCidrsList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<TokenLookupResponseBoundCidrsList>;
+
+/** Identity policies associated with the token (present only when token has an entity and derived policies) */
+export type TokenLookupResponseIdentityPoliciesList = Array<string>;
+export const TokenLookupResponseIdentityPoliciesList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<TokenLookupResponseIdentityPoliciesList>;
+
+/** List of policies associated with the token */
+export type TokenLookupResponsePoliciesList = Array<string>;
+export const TokenLookupResponsePoliciesList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<TokenLookupResponsePoliciesList>;
+
+export interface TokenLookupResponse {
+  /** Token accessor */
+  accessor?: string;
+  /** List of CIDR blocks bound to the token */
+  bound_cidrs?: TokenLookupResponseBoundCidrsList;
+  /** Token creation time (Unix timestamp) */
+  creation_time?: number;
+  /** Token creation TTL in seconds */
+  creation_ttl?: number;
+  /** Display name of the token */
+  display_name?: string;
+  /** Entity ID associated with the token */
+  entity_id?: string;
+  /** Token expiration time */
+  expire_time?: string;
+  /** Token explicit maximum TTL in seconds */
+  explicit_max_ttl?: number;
+  /** Derived identity policies for external namespaces (present only when applicable) */
+  external_namespace_policies?: unknown;
+  /** Token ID (may be empty for self-lookup operations) */
+  id?: string;
+  /** Identity policies associated with the token (present only when token has an entity and derived policies) */
+  identity_policies?: TokenLookupResponseIdentityPoliciesList;
+  /** Token issue time */
+  issue_time?: string;
+  /** Last renewal time */
+  last_renewal?: string;
+  /** Last renewal time (Unix timestamp) */
+  last_renewal_time?: number;
+  /** Token metadata */
+  meta?: unknown;
+  /** Namespace path */
+  namespace_path?: string;
+  /** Number of uses remaining */
+  num_uses?: number;
+  /** Whether the token is an orphan */
+  orphan?: boolean;
+  /** Path where the token was created */
+  path?: string;
+  /** Token period in seconds */
+  period?: number;
+  /** List of policies associated with the token */
+  policies?: TokenLookupResponsePoliciesList;
+  /** Whether the token is renewable */
+  renewable?: boolean;
+  /** Role name used to create the token */
+  role?: string;
+  /** Token TTL in seconds */
+  ttl?: number;
+  /** Token type */
+  type?: string;
+}
+export const TokenLookupResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    accessor: S.optional(S.String),
+    bound_cidrs: S.optional(TokenLookupResponseBoundCidrsList),
+    creation_time: S.optional(S.Number),
+    creation_ttl: S.optional(S.Number),
+    display_name: S.optional(S.String),
+    entity_id: S.optional(S.String),
+    expire_time: S.optional(S.String),
+    explicit_max_ttl: S.optional(S.Number),
+    external_namespace_policies: S.optional(S.Unknown),
+    id: S.optional(S.String),
+    identity_policies: S.optional(TokenLookupResponseIdentityPoliciesList),
+    issue_time: S.optional(S.String),
+    last_renewal: S.optional(S.String),
+    last_renewal_time: S.optional(S.Number),
+    meta: S.optional(S.Unknown),
+    namespace_path: S.optional(S.String),
+    num_uses: S.optional(S.Number),
+    orphan: S.optional(S.Boolean),
+    path: S.optional(S.String),
+    period: S.optional(S.Number),
+    policies: S.optional(TokenLookupResponsePoliciesList),
+    renewable: S.optional(S.Boolean),
+    role: S.optional(S.String),
+    ttl: S.optional(S.Number),
+    type: S.optional(S.String),
+  }),
+).annotate({
+  identifier: "TokenLookupResponse",
+}) as any as S.Schema<TokenLookupResponse>;
+
+export interface GetTokenLookUpSelfRequest {}
+export const GetTokenLookUpSelfRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}).pipe(
+    T.Http({ method: "GET", uri: "/auth/token/lookup-self", code: 200 }),
+  ),
+).annotate({
+  identifier: "GetTokenLookUpSelfRequest",
+}) as any as S.Schema<GetTokenLookUpSelfRequest>;
+
+export interface RenewTokenRequest {
+  /** The desired increment in seconds to the token expiration */
+  increment?: number;
+  /** Token to renew (request body) */
+  token?: string;
+}
+export const RenewTokenRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    increment: S.optional(S.Number),
+    token: S.optional(S.String),
+  }).pipe(T.Http({ method: "POST", uri: "/auth/token/renew", code: 200 })),
+).annotate({
+  identifier: "RenewTokenRequest",
+}) as any as S.Schema<RenewTokenRequest>;
+
+export interface RenewTokenResponse {}
+export const RenewTokenResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "RenewTokenResponse",
+}) as any as S.Schema<RenewTokenResponse>;
+
+export interface RevokeTokenRequest {
+  /** Token to revoke (request body) */
+  token?: string;
+}
+export const RevokeTokenRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    token: S.optional(S.String),
+  }).pipe(T.Http({ method: "POST", uri: "/auth/token/revoke", code: 200 })),
+).annotate({
+  identifier: "RevokeTokenRequest",
+}) as any as S.Schema<RevokeTokenRequest>;
+
+export interface RevokeTokenResponse {}
+export const RevokeTokenResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "RevokeTokenResponse",
+}) as any as S.Schema<RevokeTokenResponse>;
+
+/** List of policies for the token */
+export type TokenCreateAgainstRoleRequestPoliciesList = Array<string>;
+export const TokenCreateAgainstRoleRequestPoliciesList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<TokenCreateAgainstRoleRequestPoliciesList>;
+
+export interface TokenCreateAgainstRoleRequest {
+  /** Name of the role */
+  role_name: string;
+  /** Name to associate with this token */
+  display_name?: string;
+  /** Name of the entity alias to associate with this token */
+  entity_alias?: string;
+  /** Explicit Max TTL of this token */
+  explicit_max_ttl?: string;
+  /** Value for the token */
+  id?: string;
+  /** Use 'ttl' instead */
+  lease?: string;
+  /** Arbitrary key=value metadata to associate with the token */
+  meta?: unknown;
+  /** Do not include default policy for this token */
+  no_default_policy?: boolean;
+  /** Create the token with no parent */
+  no_parent?: boolean;
+  /** Max number of uses for this token */
+  num_uses?: number;
+  /** Renew period */
+  period?: string;
+  /** List of policies for the token */
+  policies?: TokenCreateAgainstRoleRequestPoliciesList;
+  /** Allow token to be renewed past its initial TTL up to system/mount maximum TTL */
+  renewable?: boolean;
+  /** Time to live for this token */
+  ttl?: string;
+  /** Token type */
+  type?: string;
+}
+export const TokenCreateAgainstRoleRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    role_name: S.String.pipe(T.Label()),
+    display_name: S.optional(S.String),
+    entity_alias: S.optional(S.String),
+    explicit_max_ttl: S.optional(S.String),
+    id: S.optional(S.String),
+    lease: S.optional(S.String),
+    meta: S.optional(S.Unknown),
+    no_default_policy: S.optional(S.Boolean),
+    no_parent: S.optional(S.Boolean),
+    num_uses: S.optional(S.Number),
+    period: S.optional(S.String),
+    policies: S.optional(TokenCreateAgainstRoleRequestPoliciesList),
+    renewable: S.optional(S.Boolean),
+    ttl: S.optional(S.String),
+    type: S.optional(S.String),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/auth/token/create/{role_name}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "TokenCreateAgainstRoleRequest",
+}) as any as S.Schema<TokenCreateAgainstRoleRequest>;
+
+export interface TokenCreateAgainstRoleResponse {}
+export const TokenCreateAgainstRoleResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "TokenCreateAgainstRoleResponse",
+}) as any as S.Schema<TokenCreateAgainstRoleResponse>;
+
+/** List of policies for the token */
+export type TokenCreateOrphanRequestPoliciesList = Array<string>;
+export const TokenCreateOrphanRequestPoliciesList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<TokenCreateOrphanRequestPoliciesList>;
+
+export interface TokenCreateOrphanRequest {
+  /** Name to associate with this token */
+  display_name?: string;
+  /** Name of the entity alias to associate with this token */
+  entity_alias?: string;
+  /** Explicit Max TTL of this token */
+  explicit_max_ttl?: string;
+  /** Value for the token */
+  id?: string;
+  /** Use 'ttl' instead */
+  lease?: string;
+  /** Arbitrary key=value metadata to associate with the token */
+  meta?: unknown;
+  /** Do not include default policy for this token */
+  no_default_policy?: boolean;
+  /** Create the token with no parent */
+  no_parent?: boolean;
+  /** Max number of uses for this token */
+  num_uses?: number;
+  /** Renew period */
+  period?: string;
+  /** List of policies for the token */
+  policies?: TokenCreateOrphanRequestPoliciesList;
+  /** Allow token to be renewed past its initial TTL up to system/mount maximum TTL */
+  renewable?: boolean;
+  /** Time to live for this token */
+  ttl?: string;
+  /** Token type */
+  type?: string;
+}
+export const TokenCreateOrphanRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    display_name: S.optional(S.String),
+    entity_alias: S.optional(S.String),
+    explicit_max_ttl: S.optional(S.String),
+    id: S.optional(S.String),
+    lease: S.optional(S.String),
+    meta: S.optional(S.Unknown),
+    no_default_policy: S.optional(S.Boolean),
+    no_parent: S.optional(S.Boolean),
+    num_uses: S.optional(S.Number),
+    period: S.optional(S.String),
+    policies: S.optional(TokenCreateOrphanRequestPoliciesList),
+    renewable: S.optional(S.Boolean),
+    ttl: S.optional(S.String),
+    type: S.optional(S.String),
+  }).pipe(
+    T.Http({ method: "POST", uri: "/auth/token/create-orphan", code: 200 }),
+  ),
+).annotate({
+  identifier: "TokenCreateOrphanRequest",
+}) as any as S.Schema<TokenCreateOrphanRequest>;
+
+export interface TokenCreateOrphanResponse {}
+export const TokenCreateOrphanResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "TokenCreateOrphanResponse",
+}) as any as S.Schema<TokenCreateOrphanResponse>;
+
+export interface TokenDeleteRoleRequest {
+  /** Name of the role */
+  role_name: string;
+}
+export const TokenDeleteRoleRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    role_name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "DELETE",
+      uri: "/auth/token/roles/{role_name}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "TokenDeleteRoleRequest",
+}) as any as S.Schema<TokenDeleteRoleRequest>;
+
+export interface TokenDeleteRoleResponse {}
+export const TokenDeleteRoleResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "TokenDeleteRoleResponse",
+}) as any as S.Schema<TokenDeleteRoleResponse>;
+
+export type TokenListAccessorsRequestList = "true";
+export const TokenListAccessorsRequestList = S.String;
+
+export interface TokenListAccessorsRequest {
+  /** Must be set to `true` */
+  list: TokenListAccessorsRequestList | (string & {});
+}
+export const TokenListAccessorsRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    list: TokenListAccessorsRequestList.pipe(T.Query()),
+  }).pipe(T.Http({ method: "GET", uri: "/auth/token/accessors", code: 200 })),
+).annotate({
+  identifier: "TokenListAccessorsRequest",
+}) as any as S.Schema<TokenListAccessorsRequest>;
+
+export interface TokenListAccessorsResponse {}
+export const TokenListAccessorsResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "TokenListAccessorsResponse",
+}) as any as S.Schema<TokenListAccessorsResponse>;
+
+export type TokenListRolesRequestList = "true";
+export const TokenListRolesRequestList = S.String;
+
+export interface TokenListRolesRequest {
+  /** Must be set to `true` */
+  list: TokenListRolesRequestList | (string & {});
+}
+export const TokenListRolesRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    list: TokenListRolesRequestList.pipe(T.Query()),
+  }).pipe(T.Http({ method: "GET", uri: "/auth/token/roles", code: 200 })),
+).annotate({
+  identifier: "TokenListRolesRequest",
+}) as any as S.Schema<TokenListRolesRequest>;
+
+export interface TokenListRolesResponse {}
+export const TokenListRolesResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "TokenListRolesResponse",
+}) as any as S.Schema<TokenListRolesResponse>;
+
+export interface TokenLookUpByAccessorRequest {
+  /** Accessor of the token to look up (request body) */
+  accessor?: string;
+}
+export const TokenLookUpByAccessorRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    accessor: S.optional(S.String),
+  }).pipe(
+    T.Http({ method: "POST", uri: "/auth/token/lookup-accessor", code: 200 }),
+  ),
+).annotate({
+  identifier: "TokenLookUpByAccessorRequest",
+}) as any as S.Schema<TokenLookUpByAccessorRequest>;
+
+export interface TokenReadRoleRequest {
+  /** Name of the role */
+  role_name: string;
+}
+export const TokenReadRoleRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    role_name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({ method: "GET", uri: "/auth/token/roles/{role_name}", code: 200 }),
+  ),
+).annotate({
+  identifier: "TokenReadRoleRequest",
+}) as any as S.Schema<TokenReadRoleRequest>;
+
+export interface TokenReadRoleResponse {}
+export const TokenReadRoleResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "TokenReadRoleResponse",
+}) as any as S.Schema<TokenReadRoleResponse>;
+
+export interface TokenRenewAccessorRequest {
+  /** Accessor of the token to renew (request body) */
+  accessor?: string;
+  /** The desired increment in seconds to the token expiration */
+  increment?: number;
+}
+export const TokenRenewAccessorRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    accessor: S.optional(S.String),
+    increment: S.optional(S.Number),
+  }).pipe(
+    T.Http({ method: "POST", uri: "/auth/token/renew-accessor", code: 200 }),
+  ),
+).annotate({
+  identifier: "TokenRenewAccessorRequest",
+}) as any as S.Schema<TokenRenewAccessorRequest>;
+
+export interface TokenRenewAccessorResponse {}
+export const TokenRenewAccessorResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "TokenRenewAccessorResponse",
+}) as any as S.Schema<TokenRenewAccessorResponse>;
+
+export interface TokenRenewSelfRequest {
+  /** The desired increment in seconds to the token expiration */
+  increment?: number;
+  /** Token to renew (unused, does not need to be set) */
+  token?: string;
+}
+export const TokenRenewSelfRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    increment: S.optional(S.Number),
+    token: S.optional(S.String),
+  }).pipe(T.Http({ method: "POST", uri: "/auth/token/renew-self", code: 200 })),
+).annotate({
+  identifier: "TokenRenewSelfRequest",
+}) as any as S.Schema<TokenRenewSelfRequest>;
+
+export interface TokenRenewSelfResponse {}
+export const TokenRenewSelfResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "TokenRenewSelfResponse",
+}) as any as S.Schema<TokenRenewSelfResponse>;
+
+export interface TokenRevokeAccessorRequest {
+  /** Accessor of the token (request body) */
+  accessor?: string;
+}
+export const TokenRevokeAccessorRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    accessor: S.optional(S.String),
+  }).pipe(
+    T.Http({ method: "POST", uri: "/auth/token/revoke-accessor", code: 200 }),
+  ),
+).annotate({
+  identifier: "TokenRevokeAccessorRequest",
+}) as any as S.Schema<TokenRevokeAccessorRequest>;
+
+export interface TokenRevokeAccessorResponse {}
+export const TokenRevokeAccessorResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "TokenRevokeAccessorResponse",
+}) as any as S.Schema<TokenRevokeAccessorResponse>;
+
+export interface TokenRevokeOrphanRequest {
+  /** Token to revoke (request body) */
+  token?: string;
+}
+export const TokenRevokeOrphanRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    token: S.optional(S.String),
+  }).pipe(
+    T.Http({ method: "POST", uri: "/auth/token/revoke-orphan", code: 200 }),
+  ),
+).annotate({
+  identifier: "TokenRevokeOrphanRequest",
+}) as any as S.Schema<TokenRevokeOrphanRequest>;
+
+export interface TokenRevokeOrphanResponse {}
+export const TokenRevokeOrphanResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "TokenRevokeOrphanResponse",
+}) as any as S.Schema<TokenRevokeOrphanResponse>;
+
+export interface TokenRevokeSelfRequest {}
+export const TokenRevokeSelfRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}).pipe(
+    T.Http({ method: "POST", uri: "/auth/token/revoke-self", code: 200 }),
+  ),
+).annotate({
+  identifier: "TokenRevokeSelfRequest",
+}) as any as S.Schema<TokenRevokeSelfRequest>;
+
+export interface TokenRevokeSelfResponse {}
+export const TokenRevokeSelfResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "TokenRevokeSelfResponse",
+}) as any as S.Schema<TokenRevokeSelfResponse>;
+
+export interface TokenTidyRequest {}
+export const TokenTidyRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}).pipe(
+    T.Http({ method: "POST", uri: "/auth/token/tidy", code: 200 }),
+  ),
+).annotate({
+  identifier: "TokenTidyRequest",
+}) as any as S.Schema<TokenTidyRequest>;
+
+export interface TokenTidyResponse {}
+export const TokenTidyResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "TokenTidyResponse",
+}) as any as S.Schema<TokenTidyResponse>;
+
+/** String or JSON list of allowed entity aliases. If set, specifies the entity aliases which are allowed to be used during token generation. This field supports globbing. */
+export type TokenWriteRoleRequestAllowedEntityAliasesList = Array<string>;
+export const TokenWriteRoleRequestAllowedEntityAliasesList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<TokenWriteRoleRequestAllowedEntityAliasesList>;
+
+/** If set, tokens can be created with any subset of the policies in this list, rather than the normal semantics of tokens being a subset of the calling token's policies. The parameter is a comma-delimited string of policy names. */
+export type TokenWriteRoleRequestAllowedPoliciesList = Array<string>;
+export const TokenWriteRoleRequestAllowedPoliciesList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<TokenWriteRoleRequestAllowedPoliciesList>;
+
+/** If set, tokens can be created with any subset of glob matched policies in this list, rather than the normal semantics of tokens being a subset of the calling token's policies. The parameter is a comma-delimited string of policy name globs. */
+export type TokenWriteRoleRequestAllowedPoliciesGlobList = Array<string>;
+export const TokenWriteRoleRequestAllowedPoliciesGlobList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<TokenWriteRoleRequestAllowedPoliciesGlobList>;
+
+/** Use 'token_bound_cidrs' instead. */
+export type TokenWriteRoleRequestBoundCidrsList = Array<string>;
+export const TokenWriteRoleRequestBoundCidrsList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<TokenWriteRoleRequestBoundCidrsList>;
+
+/** If set, successful token creation via this role will require that no policies in the given list are requested. The parameter is a comma-delimited string of policy names. */
+export type TokenWriteRoleRequestDisallowedPoliciesList = Array<string>;
+export const TokenWriteRoleRequestDisallowedPoliciesList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<TokenWriteRoleRequestDisallowedPoliciesList>;
+
+/** If set, successful token creation via this role will require that no requested policies glob match any of policies in this list. The parameter is a comma-delimited string of policy name globs. */
+export type TokenWriteRoleRequestDisallowedPoliciesGlobList = Array<string>;
+export const TokenWriteRoleRequestDisallowedPoliciesGlobList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<TokenWriteRoleRequestDisallowedPoliciesGlobList>;
+
+/** Comma separated string or JSON list of CIDR blocks. If set, specifies the blocks of IP addresses which are allowed to use the generated token. */
+export type TokenWriteRoleRequestTokenBoundCidrsList = Array<string>;
+export const TokenWriteRoleRequestTokenBoundCidrsList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<TokenWriteRoleRequestTokenBoundCidrsList>;
+
+export interface TokenWriteRoleRequest {
+  /** Name of the role */
+  role_name: string;
+  /** String or JSON list of allowed entity aliases. If set, specifies the entity aliases which are allowed to be used during token generation. This field supports globbing. */
+  allowed_entity_aliases?: TokenWriteRoleRequestAllowedEntityAliasesList;
+  /** If set, tokens can be created with any subset of the policies in this list, rather than the normal semantics of tokens being a subset of the calling token's policies. The parameter is a comma-delimited string of policy names. */
+  allowed_policies?: TokenWriteRoleRequestAllowedPoliciesList;
+  /** If set, tokens can be created with any subset of glob matched policies in this list, rather than the normal semantics of tokens being a subset of the calling token's policies. The parameter is a comma-delimited string of policy name globs. */
+  allowed_policies_glob?: TokenWriteRoleRequestAllowedPoliciesGlobList;
+  /** Use 'token_bound_cidrs' instead. */
+  bound_cidrs?: TokenWriteRoleRequestBoundCidrsList;
+  /** If set, successful token creation via this role will require that no policies in the given list are requested. The parameter is a comma-delimited string of policy names. */
+  disallowed_policies?: TokenWriteRoleRequestDisallowedPoliciesList;
+  /** If set, successful token creation via this role will require that no requested policies glob match any of policies in this list. The parameter is a comma-delimited string of policy name globs. */
+  disallowed_policies_glob?: TokenWriteRoleRequestDisallowedPoliciesGlobList;
+  /** Use 'token_explicit_max_ttl' instead. */
+  explicit_max_ttl?: number;
+  /** If true, tokens created via this role will be orphan tokens (have no parent) */
+  orphan?: boolean;
+  /** If set, tokens created via this role will contain the given suffix as a part of their path. This can be used to assist use of the 'revoke-prefix' endpoint later on. The given suffix must match the regular expression.\w[\w-.]+\w */
+  path_suffix?: string;
+  /** Use 'token_period' instead. */
+  period?: number;
+  /** Tokens created via this role will be renewable or not according to this value. Defaults to "true". */
+  renewable?: boolean;
+  /** Comma separated string or JSON list of CIDR blocks. If set, specifies the blocks of IP addresses which are allowed to use the generated token. */
+  token_bound_cidrs?: TokenWriteRoleRequestTokenBoundCidrsList;
+  /** If set, tokens created via this role carry an explicit maximum TTL. During renewal, the current maximum TTL values of the role and the mount are not checked for changes, and any updates to these values will have no effect on the token being renewed. */
+  token_explicit_max_ttl?: number;
+  /** If true, the 'default' policy will not automatically be added to generated tokens */
+  token_no_default_policy?: boolean;
+  /** The maximum number of times a token may be used, a value of zero means unlimited */
+  token_num_uses?: number;
+  /** If set, tokens created via this role will have no max lifetime; instead, their renewal period will be fixed to this value. This takes an integer number of seconds, or a string duration (e.g. "24h"). */
+  token_period?: number;
+  /** The type of token to generate, service or batch */
+  token_type?: string;
+}
+export const TokenWriteRoleRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    role_name: S.String.pipe(T.Label()),
+    allowed_entity_aliases: S.optional(
+      TokenWriteRoleRequestAllowedEntityAliasesList,
+    ),
+    allowed_policies: S.optional(TokenWriteRoleRequestAllowedPoliciesList),
+    allowed_policies_glob: S.optional(
+      TokenWriteRoleRequestAllowedPoliciesGlobList,
+    ),
+    bound_cidrs: S.optional(TokenWriteRoleRequestBoundCidrsList),
+    disallowed_policies: S.optional(
+      TokenWriteRoleRequestDisallowedPoliciesList,
+    ),
+    disallowed_policies_glob: S.optional(
+      TokenWriteRoleRequestDisallowedPoliciesGlobList,
+    ),
+    explicit_max_ttl: S.optional(S.Number),
+    orphan: S.optional(S.Boolean),
+    path_suffix: S.optional(S.String),
+    period: S.optional(S.Number),
+    renewable: S.optional(S.Boolean),
+    token_bound_cidrs: S.optional(TokenWriteRoleRequestTokenBoundCidrsList),
+    token_explicit_max_ttl: S.optional(S.Number),
+    token_no_default_policy: S.optional(S.Boolean),
+    token_num_uses: S.optional(S.Number),
+    token_period: S.optional(S.Number),
+    token_type: S.optional(S.String),
+  }).pipe(
+    T.Http({ method: "POST", uri: "/auth/token/roles/{role_name}", code: 200 }),
+  ),
+).annotate({
+  identifier: "TokenWriteRoleRequest",
+}) as any as S.Schema<TokenWriteRoleRequest>;
+
+export interface TokenWriteRoleResponse {}
+export const TokenWriteRoleResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "TokenWriteRoleResponse",
+}) as any as S.Schema<TokenWriteRoleResponse>;
+
+export interface UpdateTokenLookUpRequest {
+  /** Token to lookup (POST request body) */
+  token?: string;
+}
+export const UpdateTokenLookUpRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    token: S.optional(S.String),
+  }).pipe(T.Http({ method: "POST", uri: "/auth/token/lookup", code: 200 })),
+).annotate({
+  identifier: "UpdateTokenLookUpRequest",
+}) as any as S.Schema<UpdateTokenLookUpRequest>;
+
+export interface UpdateTokenLookUpSelfRequest {
+  /** Token to look up (unused, does not need to be set) */
+  token?: string;
+}
+export const UpdateTokenLookUpSelfRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    token: S.optional(S.String),
+  }).pipe(
+    T.Http({ method: "POST", uri: "/auth/token/lookup-self", code: 200 }),
+  ),
+).annotate({
+  identifier: "UpdateTokenLookUpSelfRequest",
+}) as any as S.Schema<UpdateTokenLookUpSelfRequest>;
+
+export type CreateTokenError = OpenBaoOpError;
+export const createToken: API.OperationMethod<
+  CreateTokenRequest,
+  CreateTokenResponse,
+  CreateTokenError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: CreateTokenRequest,
+  output: CreateTokenResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type GetTokenLookUpError = OpenBaoOpError;
+export const getTokenLookUp: API.OperationMethod<
+  GetTokenLookUpRequest,
+  TokenLookupResponse,
+  GetTokenLookUpError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: GetTokenLookUpRequest,
+  output: TokenLookupResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type GetTokenLookUpSelfError = OpenBaoOpError;
+export const getTokenLookUpSelf: API.OperationMethod<
+  GetTokenLookUpSelfRequest,
+  TokenLookupResponse,
+  GetTokenLookUpSelfError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: GetTokenLookUpSelfRequest,
+  output: TokenLookupResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type RenewTokenError = OpenBaoOpError;
+export const renewToken: API.OperationMethod<
+  RenewTokenRequest,
+  RenewTokenResponse,
+  RenewTokenError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: RenewTokenRequest,
+  output: RenewTokenResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type RevokeTokenError = OpenBaoOpError;
+export const revokeToken: API.OperationMethod<
+  RevokeTokenRequest,
+  RevokeTokenResponse,
+  RevokeTokenError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: RevokeTokenRequest,
+  output: RevokeTokenResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type TokenCreateAgainstRoleError = OpenBaoOpError;
+export const tokenCreateAgainstRole: API.OperationMethod<
+  TokenCreateAgainstRoleRequest,
+  TokenCreateAgainstRoleResponse,
+  TokenCreateAgainstRoleError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: TokenCreateAgainstRoleRequest,
+  output: TokenCreateAgainstRoleResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type TokenCreateOrphanError = OpenBaoOpError;
+export const tokenCreateOrphan: API.OperationMethod<
+  TokenCreateOrphanRequest,
+  TokenCreateOrphanResponse,
+  TokenCreateOrphanError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: TokenCreateOrphanRequest,
+  output: TokenCreateOrphanResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type TokenDeleteRoleError = OpenBaoOpError;
+export const tokenDeleteRole: API.OperationMethod<
+  TokenDeleteRoleRequest,
+  TokenDeleteRoleResponse,
+  TokenDeleteRoleError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: TokenDeleteRoleRequest,
+  output: TokenDeleteRoleResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type TokenListAccessorsError = OpenBaoOpError;
+export const tokenListAccessors: API.OperationMethod<
+  TokenListAccessorsRequest,
+  TokenListAccessorsResponse,
+  TokenListAccessorsError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: TokenListAccessorsRequest,
+  output: TokenListAccessorsResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type TokenListRolesError = OpenBaoOpError;
+export const tokenListRoles: API.OperationMethod<
+  TokenListRolesRequest,
+  TokenListRolesResponse,
+  TokenListRolesError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: TokenListRolesRequest,
+  output: TokenListRolesResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type TokenLookUpByAccessorError = OpenBaoOpError;
+export const tokenLookUpByAccessor: API.OperationMethod<
+  TokenLookUpByAccessorRequest,
+  TokenLookupResponse,
+  TokenLookUpByAccessorError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: TokenLookUpByAccessorRequest,
+  output: TokenLookupResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type TokenReadRoleError = OpenBaoOpError;
+export const tokenReadRole: API.OperationMethod<
+  TokenReadRoleRequest,
+  TokenReadRoleResponse,
+  TokenReadRoleError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: TokenReadRoleRequest,
+  output: TokenReadRoleResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type TokenRenewAccessorError = OpenBaoOpError;
+export const tokenRenewAccessor: API.OperationMethod<
+  TokenRenewAccessorRequest,
+  TokenRenewAccessorResponse,
+  TokenRenewAccessorError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: TokenRenewAccessorRequest,
+  output: TokenRenewAccessorResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type TokenRenewSelfError = OpenBaoOpError;
+export const tokenRenewSelf: API.OperationMethod<
+  TokenRenewSelfRequest,
+  TokenRenewSelfResponse,
+  TokenRenewSelfError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: TokenRenewSelfRequest,
+  output: TokenRenewSelfResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type TokenRevokeAccessorError = OpenBaoOpError;
+export const tokenRevokeAccessor: API.OperationMethod<
+  TokenRevokeAccessorRequest,
+  TokenRevokeAccessorResponse,
+  TokenRevokeAccessorError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: TokenRevokeAccessorRequest,
+  output: TokenRevokeAccessorResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type TokenRevokeOrphanError = OpenBaoOpError;
+export const tokenRevokeOrphan: API.OperationMethod<
+  TokenRevokeOrphanRequest,
+  TokenRevokeOrphanResponse,
+  TokenRevokeOrphanError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: TokenRevokeOrphanRequest,
+  output: TokenRevokeOrphanResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type TokenRevokeSelfError = OpenBaoOpError;
+export const tokenRevokeSelf: API.OperationMethod<
+  TokenRevokeSelfRequest,
+  TokenRevokeSelfResponse,
+  TokenRevokeSelfError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: TokenRevokeSelfRequest,
+  output: TokenRevokeSelfResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type TokenTidyError = OpenBaoOpError;
+export const tokenTidy: API.OperationMethod<
+  TokenTidyRequest,
+  TokenTidyResponse,
+  TokenTidyError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: TokenTidyRequest,
+  output: TokenTidyResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type TokenWriteRoleError = OpenBaoOpError;
+export const tokenWriteRole: API.OperationMethod<
+  TokenWriteRoleRequest,
+  TokenWriteRoleResponse,
+  TokenWriteRoleError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: TokenWriteRoleRequest,
+  output: TokenWriteRoleResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type UpdateTokenLookUpError = OpenBaoOpError;
+export const updateTokenLookUp: API.OperationMethod<
+  UpdateTokenLookUpRequest,
+  TokenLookupResponse,
+  UpdateTokenLookUpError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: UpdateTokenLookUpRequest,
+  output: TokenLookupResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type UpdateTokenLookUpSelfError = OpenBaoOpError;
+export const updateTokenLookUpSelf: API.OperationMethod<
+  UpdateTokenLookUpSelfRequest,
+  TokenLookupResponse,
+  UpdateTokenLookUpSelfError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: UpdateTokenLookUpSelfRequest,
+  output: TokenLookupResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));