//! Generated by `trust-tasks-codegen` — do not edit by hand.
//!
//! Spec slug: `external/accounts/create`. Version: `0.1`.
#[allow(unused_imports)]
use serde::{Deserialize, Serialize};
/// Error types.
pub mod error {
/// Error from a `TryFrom` or `FromStr` implementation.
pub struct ConversionError(::std::borrow::Cow<'static, str>);
impl ::std::error::Error for ConversionError {}
impl ::std::fmt::Display for ConversionError {
fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> Result<(), ::std::fmt::Error> {
::std::fmt::Display::fmt(&self.0, f)
}
}
impl ::std::fmt::Debug for ConversionError {
fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> Result<(), ::std::fmt::Error> {
::std::fmt::Debug::fmt(&self.0, f)
}
}
impl From<&'static str> for ConversionError {
fn from(value: &'static str) -> Self {
Self(value.into())
}
}
impl From<String> for ConversionError {
fn from(value: String) -> Self {
Self(value.into())
}
}
}
///Who may use an account, and how far. One binding per consumer per account. A binding is checked before anything is signed: the caller must be `consumer`, proven by the request's own proof; the request must sit inside `scopeCeiling`; its TTL must not exceed `maxTtlSeconds`; and the binding's rate must not be exhausted.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "AccountBinding",
/// "description": "Who may use an account, and how far. One binding per consumer per account. A binding is checked before anything is signed: the caller must be `consumer`, proven by the request's own proof; the request must sit inside `scopeCeiling`; its TTL must not exceed `maxTtlSeconds`; and the binding's rate must not be exhausted.",
/// "type": "object",
/// "required": [
/// "consumer",
/// "maxTtlSeconds",
/// "ratePerMinute"
/// ],
/// "properties": {
/// "consumer": {
/// "description": "The DID of the integration allowed to use the account.",
/// "type": "string",
/// "maxLength": 2048,
/// "minLength": 7,
/// "pattern": "^did:[a-z0-9]+:\\S+$"
/// },
/// "grantedAt": {
/// "type": "string",
/// "format": "date-time"
/// },
/// "maxTtlSeconds": {
/// "description": "The longest credential lifetime the consumer may request. 900 (15 minutes) is RECOMMENDED; the ceiling is one hour.",
/// "type": "integer",
/// "maximum": 3600.0,
/// "minimum": 60.0
/// },
/// "ratePerMinute": {
/// "description": "Issuances or signatures per minute for this binding.",
/// "type": "integer",
/// "maximum": 600.0,
/// "minimum": 1.0
/// },
/// "scopeCeiling": {
/// "description": "Required for storage and OAuth models; absent for `sui-signer`, whose ceiling is the account's own allow-list and caps.",
/// "$ref": "#/definitions/CredentialScopeCeiling"
/// },
/// "sourceCidrs": {
/// "description": "Where the provider supports it (`aws:SourceIp`), issued credentials are pinned to these networks, so a credential lifted from the consumer is useless elsewhere.",
/// "type": "array",
/// "items": {
/// "type": "string",
/// "maxLength": 49,
/// "pattern": "^[0-9a-fA-F:.]+/[0-9]{1,3}$"
/// },
/// "maxItems": 16
/// }
/// },
/// "additionalProperties": false
///}
/// ```
/// </details>
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct AccountBinding {
///The DID of the integration allowed to use the account.
pub consumer: AccountBindingConsumer,
#[serde(
rename = "grantedAt",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
pub granted_at: ::std::option::Option<::chrono::DateTime<::chrono::offset::Utc>>,
///The longest credential lifetime the consumer may request. 900 (15 minutes) is RECOMMENDED; the ceiling is one hour.
#[serde(rename = "maxTtlSeconds")]
pub max_ttl_seconds: i64,
///Issuances or signatures per minute for this binding.
#[serde(rename = "ratePerMinute")]
pub rate_per_minute: ::std::num::NonZeroU64,
///Required for storage and OAuth models; absent for `sui-signer`, whose ceiling is the account's own allow-list and caps.
#[serde(
rename = "scopeCeiling",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
pub scope_ceiling: ::std::option::Option<CredentialScopeCeiling>,
///Where the provider supports it (`aws:SourceIp`), issued credentials are pinned to these networks, so a credential lifted from the consumer is useless elsewhere.
#[serde(
rename = "sourceCidrs",
default,
skip_serializing_if = "::std::vec::Vec::is_empty"
)]
pub source_cidrs: ::std::vec::Vec<AccountBindingSourceCidrsItem>,
}
impl AccountBinding {
pub fn builder() -> builder::AccountBinding {
Default::default()
}
}
///The DID of the integration allowed to use the account.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "description": "The DID of the integration allowed to use the account.",
/// "type": "string",
/// "maxLength": 2048,
/// "minLength": 7,
/// "pattern": "^did:[a-z0-9]+:\\S+$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountBindingConsumer(::std::string::String);
impl ::std::ops::Deref for AccountBindingConsumer {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountBindingConsumer> for ::std::string::String {
fn from(value: AccountBindingConsumer) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountBindingConsumer {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 2048usize {
return Err("longer than 2048 characters".into());
}
if value.chars().count() < 7usize {
return Err("shorter than 7 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^did:[a-z0-9]+:\\S+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^did:[a-z0-9]+:\\S+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountBindingConsumer {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountBindingConsumer {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountBindingConsumer {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountBindingConsumer {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AccountBindingSourceCidrsItem`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "maxLength": 49,
/// "pattern": "^[0-9a-fA-F:.]+/[0-9]{1,3}$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountBindingSourceCidrsItem(::std::string::String);
impl ::std::ops::Deref for AccountBindingSourceCidrsItem {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountBindingSourceCidrsItem> for ::std::string::String {
fn from(value: AccountBindingSourceCidrsItem) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountBindingSourceCidrsItem {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 49usize {
return Err("longer than 49 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| {
::regress::Regex::new("^[0-9a-fA-F:.]+/[0-9]{1,3}$").unwrap()
});
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[0-9a-fA-F:.]+/[0-9]{1,3}$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountBindingSourceCidrsItem {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountBindingSourceCidrsItem {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountBindingSourceCidrsItem {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountBindingSourceCidrsItem {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///The custodian context that owns the account. Act scope in this context decides who may manage the account and who may consume it; the account's keys are derived in this context's key space.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "AccountContextId",
/// "description": "The custodian context that owns the account. Act scope in this context decides who may manage the account and who may consume it; the account's keys are derived in this context's key space.",
/// "type": "string",
/// "maxLength": 256,
/// "minLength": 1
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountContextId(::std::string::String);
impl ::std::ops::Deref for AccountContextId {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountContextId> for ::std::string::String {
fn from(value: AccountContextId) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountContextId {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 256usize {
return Err("longer than 256 characters".into());
}
if value.chars().count() < 1usize {
return Err("shorter than 1 characters".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountContextId {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountContextId {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountContextId {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountContextId {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///The account's identifier within its context, chosen by whoever creates it. Lowercase letters, digits and hyphens, so that it can be embedded in a certificate subject, a token subject or a provider-side condition without escaping. Unique per context; never reused after deletion while anything that names it (a provider-side trust policy, an audit row) may still exist.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "AccountId",
/// "description": "The account's identifier within its context, chosen by whoever creates it. Lowercase letters, digits and hyphens, so that it can be embedded in a certificate subject, a token subject or a provider-side condition without escaping. Unique per context; never reused after deletion while anything that names it (a provider-side trust policy, an audit row) may still exist.",
/// "type": "string",
/// "maxLength": 64,
/// "minLength": 1,
/// "pattern": "^[a-z0-9][a-z0-9-]*$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountId(::std::string::String);
impl ::std::ops::Deref for AccountId {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountId> for ::std::string::String {
fn from(value: AccountId) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountId {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 64usize {
return Err("longer than 64 characters".into());
}
if value.chars().count() < 1usize {
return Err("shorter than 1 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[a-z0-9][a-z0-9-]*$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[a-z0-9][a-z0-9-]*$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountId {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountId {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountId {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountId {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AccountProbeReport`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "AccountProbeReport",
/// "type": "object",
/// "required": [
/// "at",
/// "complete",
/// "ok",
/// "steps"
/// ],
/// "properties": {
/// "at": {
/// "type": "string",
/// "format": "date-time"
/// },
/// "complete": {
/// "description": "True only when the canary steps (`put`, `get`, `delete`, or the model's equivalent) ran, so the account was exercised end to end. A probe that stopped after `exchange` because nothing named a canary prefix is `complete: false` even when `ok` is true, and does not clear `providerSetupRequired`.",
/// "type": "boolean"
/// },
/// "ok": {
/// "description": "True when every step that ran succeeded.",
/// "type": "boolean"
/// },
/// "steps": {
/// "description": "In order; the first failing step ends the probe.",
/// "type": "array",
/// "items": {
/// "type": "object",
/// "required": [
/// "ok",
/// "step"
/// ],
/// "properties": {
/// "durationMs": {
/// "type": "integer",
/// "minimum": 0.0
/// },
/// "ok": {
/// "type": "boolean"
/// },
/// "providerError": {
/// "description": "The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.",
/// "type": "string",
/// "maxLength": 2048
/// },
/// "providerRequestId": {
/// "type": "string",
/// "maxLength": 256,
/// "pattern": "^[!-~]+$"
/// },
/// "step": {
/// "$ref": "#/definitions/AccountProbeStep"
/// }
/// },
/// "additionalProperties": false
/// },
/// "maxItems": 8
/// }
/// },
/// "additionalProperties": false
///}
/// ```
/// </details>
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct AccountProbeReport {
pub at: ::chrono::DateTime<::chrono::offset::Utc>,
///True only when the canary steps (`put`, `get`, `delete`, or the model's equivalent) ran, so the account was exercised end to end. A probe that stopped after `exchange` because nothing named a canary prefix is `complete: false` even when `ok` is true, and does not clear `providerSetupRequired`.
pub complete: bool,
///True when every step that ran succeeded.
pub ok: bool,
///In order; the first failing step ends the probe.
pub steps: ::std::vec::Vec<AccountProbeReportStepsItem>,
}
impl AccountProbeReport {
pub fn builder() -> builder::AccountProbeReport {
Default::default()
}
}
///`AccountProbeReportStepsItem`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "object",
/// "required": [
/// "ok",
/// "step"
/// ],
/// "properties": {
/// "durationMs": {
/// "type": "integer",
/// "minimum": 0.0
/// },
/// "ok": {
/// "type": "boolean"
/// },
/// "providerError": {
/// "description": "The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.",
/// "type": "string",
/// "maxLength": 2048
/// },
/// "providerRequestId": {
/// "type": "string",
/// "maxLength": 256,
/// "pattern": "^[!-~]+$"
/// },
/// "step": {
/// "$ref": "#/definitions/AccountProbeStep"
/// }
/// },
/// "additionalProperties": false
///}
/// ```
/// </details>
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct AccountProbeReportStepsItem {
#[serde(
rename = "durationMs",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
pub duration_ms: ::std::option::Option<u64>,
pub ok: bool,
///The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.
#[serde(
rename = "providerError",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
pub provider_error: ::std::option::Option<AccountProbeReportStepsItemProviderError>,
#[serde(
rename = "providerRequestId",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
pub provider_request_id: ::std::option::Option<AccountProbeReportStepsItemProviderRequestId>,
pub step: AccountProbeStep,
}
impl AccountProbeReportStepsItem {
pub fn builder() -> builder::AccountProbeReportStepsItem {
Default::default()
}
}
///The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "description": "The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.",
/// "type": "string",
/// "maxLength": 2048
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountProbeReportStepsItemProviderError(::std::string::String);
impl ::std::ops::Deref for AccountProbeReportStepsItemProviderError {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountProbeReportStepsItemProviderError> for ::std::string::String {
fn from(value: AccountProbeReportStepsItemProviderError) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountProbeReportStepsItemProviderError {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 2048usize {
return Err("longer than 2048 characters".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountProbeReportStepsItemProviderError {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountProbeReportStepsItemProviderError {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountProbeReportStepsItemProviderError {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountProbeReportStepsItemProviderError {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AccountProbeReportStepsItemProviderRequestId`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "maxLength": 256,
/// "pattern": "^[!-~]+$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountProbeReportStepsItemProviderRequestId(::std::string::String);
impl ::std::ops::Deref for AccountProbeReportStepsItemProviderRequestId {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountProbeReportStepsItemProviderRequestId> for ::std::string::String {
fn from(value: AccountProbeReportStepsItemProviderRequestId) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountProbeReportStepsItemProviderRequestId {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 256usize {
return Err("longer than 256 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[!-~]+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[!-~]+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountProbeReportStepsItemProviderRequestId {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String>
for AccountProbeReportStepsItemProviderRequestId
{
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String>
for AccountProbeReportStepsItemProviderRequestId
{
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountProbeReportStepsItemProviderRequestId {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`sign`: the custodian signed its assertion, session request or test transaction. `exchange`: the provider issued a credential for it. `put`, `get`, `delete`: one canary object at the narrowest scope of the account's bindings. `decode`: for `sui-signer`, a built test transaction passed the allow-list (it is never submitted).
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "AccountProbeStep",
/// "description": "`sign`: the custodian signed its assertion, session request or test transaction. `exchange`: the provider issued a credential for it. `put`, `get`, `delete`: one canary object at the narrowest scope of the account's bindings. `decode`: for `sui-signer`, a built test transaction passed the allow-list (it is never submitted).",
/// "type": "string",
/// "enum": [
/// "sign",
/// "exchange",
/// "put",
/// "get",
/// "delete",
/// "decode"
/// ]
///}
/// ```
/// </details>
#[derive(
::serde::Deserialize,
::serde::Serialize,
Clone,
Copy,
Debug,
Eq,
Hash,
Ord,
PartialEq,
PartialOrd,
)]
#[non_exhaustive]
pub enum AccountProbeStep {
#[serde(rename = "sign")]
Sign,
#[serde(rename = "exchange")]
Exchange,
#[serde(rename = "put")]
Put,
#[serde(rename = "get")]
Get,
#[serde(rename = "delete")]
Delete,
#[serde(rename = "decode")]
Decode,
}
impl ::std::fmt::Display for AccountProbeStep {
fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> ::std::fmt::Result {
match *self {
Self::Sign => f.write_str("sign"),
Self::Exchange => f.write_str("exchange"),
Self::Put => f.write_str("put"),
Self::Get => f.write_str("get"),
Self::Delete => f.write_str("delete"),
Self::Decode => f.write_str("decode"),
}
}
}
impl ::std::str::FromStr for AccountProbeStep {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
match value {
"sign" => Ok(Self::Sign),
"exchange" => Ok(Self::Exchange),
"put" => Ok(Self::Put),
"get" => Ok(Self::Get),
"delete" => Ok(Self::Delete),
"decode" => Ok(Self::Decode),
_ => Err("invalid value".into()),
}
}
}
impl ::std::convert::TryFrom<&str> for AccountProbeStep {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountProbeStep {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountProbeStep {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
///The public half of the account's key, as the provider needs it. Never a private key.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "AccountPublicMaterial",
/// "description": "The public half of the account's key, as the provider needs it. Never a private key.",
/// "type": "object",
/// "required": [
/// "algorithm",
/// "keyFingerprint"
/// ],
/// "properties": {
/// "address": {
/// "description": "`sui-signer`: the Sui address the key controls.",
/// "type": "string",
/// "pattern": "^0x[0-9a-f]{64}$"
/// },
/// "algorithm": {
/// "type": "string",
/// "enum": [
/// "ES256",
/// "RS256",
/// "Secp256r1"
/// ]
/// },
/// "certificatePem": {
/// "description": "`aws-roles-anywhere`: the trust anchor's CA certificate. `azure-cert`: the certificate uploaded to the app registration.",
/// "type": "string",
/// "maxLength": 16384,
/// "pattern": "^-----BEGIN CERTIFICATE-----[A-Za-z0-9+/=\\r\\n]+-----END CERTIFICATE-----\\s*$"
/// },
/// "keyFingerprint": {
/// "description": "Digest of the public key's SubjectPublicKeyInfo DER.",
/// "$ref": "#/definitions/DigestMultibase"
/// },
/// "pendingKeyFingerprint": {
/// "description": "During a rotation (external/accounts/keys/rotate), the staged successor key, until it is confirmed and the current key retires.",
/// "$ref": "#/definitions/DigestMultibase"
/// },
/// "publicKeyJwk": {
/// "description": "The public key as a JWK, with `kid`. Public members only: the schema admits no private member (`d`, `p`, `q`, `dp`, `dq`, `qi`), so a document carrying one fails validation.",
/// "type": "object",
/// "required": [
/// "kid",
/// "kty"
/// ],
/// "properties": {
/// "alg": {
/// "type": "string",
/// "enum": [
/// "ES256",
/// "RS256"
/// ]
/// },
/// "crv": {
/// "type": "string",
/// "enum": [
/// "P-256"
/// ]
/// },
/// "e": {
/// "type": "string",
/// "maxLength": 16,
/// "pattern": "^[A-Za-z0-9_-]+$"
/// },
/// "kid": {
/// "type": "string",
/// "maxLength": 128,
/// "pattern": "^[!-~]+$"
/// },
/// "kty": {
/// "type": "string",
/// "enum": [
/// "EC",
/// "RSA"
/// ]
/// },
/// "n": {
/// "type": "string",
/// "maxLength": 1024,
/// "pattern": "^[A-Za-z0-9_-]+$"
/// },
/// "use": {
/// "type": "string",
/// "const": "sig"
/// },
/// "x": {
/// "type": "string",
/// "maxLength": 1024,
/// "pattern": "^[A-Za-z0-9_-]+$"
/// },
/// "y": {
/// "type": "string",
/// "maxLength": 1024,
/// "pattern": "^[A-Za-z0-9_-]+$"
/// }
/// },
/// "additionalProperties": false
/// }
/// },
/// "additionalProperties": false
///}
/// ```
/// </details>
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct AccountPublicMaterial {
///`sui-signer`: the Sui address the key controls.
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub address: ::std::option::Option<AccountPublicMaterialAddress>,
pub algorithm: AccountPublicMaterialAlgorithm,
///`aws-roles-anywhere`: the trust anchor's CA certificate. `azure-cert`: the certificate uploaded to the app registration.
#[serde(
rename = "certificatePem",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
pub certificate_pem: ::std::option::Option<AccountPublicMaterialCertificatePem>,
///Digest of the public key's SubjectPublicKeyInfo DER.
#[serde(rename = "keyFingerprint")]
pub key_fingerprint: DigestMultibase,
///During a rotation (external/accounts/keys/rotate), the staged successor key, until it is confirmed and the current key retires.
#[serde(
rename = "pendingKeyFingerprint",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
pub pending_key_fingerprint: ::std::option::Option<DigestMultibase>,
#[serde(
rename = "publicKeyJwk",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
pub public_key_jwk: ::std::option::Option<AccountPublicMaterialPublicKeyJwk>,
}
impl AccountPublicMaterial {
pub fn builder() -> builder::AccountPublicMaterial {
Default::default()
}
}
///`sui-signer`: the Sui address the key controls.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "description": "`sui-signer`: the Sui address the key controls.",
/// "type": "string",
/// "pattern": "^0x[0-9a-f]{64}$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountPublicMaterialAddress(::std::string::String);
impl ::std::ops::Deref for AccountPublicMaterialAddress {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountPublicMaterialAddress> for ::std::string::String {
fn from(value: AccountPublicMaterialAddress) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountPublicMaterialAddress {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^0x[0-9a-f]{64}$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^0x[0-9a-f]{64}$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountPublicMaterialAddress {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountPublicMaterialAddress {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountPublicMaterialAddress {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountPublicMaterialAddress {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AccountPublicMaterialAlgorithm`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "enum": [
/// "ES256",
/// "RS256",
/// "Secp256r1"
/// ]
///}
/// ```
/// </details>
#[derive(
::serde::Deserialize,
::serde::Serialize,
Clone,
Copy,
Debug,
Eq,
Hash,
Ord,
PartialEq,
PartialOrd,
)]
#[non_exhaustive]
pub enum AccountPublicMaterialAlgorithm {
#[serde(rename = "ES256")]
Es256,
#[serde(rename = "RS256")]
Rs256,
Secp256r1,
}
impl ::std::fmt::Display for AccountPublicMaterialAlgorithm {
fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> ::std::fmt::Result {
match *self {
Self::Es256 => f.write_str("ES256"),
Self::Rs256 => f.write_str("RS256"),
Self::Secp256r1 => f.write_str("Secp256r1"),
}
}
}
impl ::std::str::FromStr for AccountPublicMaterialAlgorithm {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
match value {
"ES256" => Ok(Self::Es256),
"RS256" => Ok(Self::Rs256),
"Secp256r1" => Ok(Self::Secp256r1),
_ => Err("invalid value".into()),
}
}
}
impl ::std::convert::TryFrom<&str> for AccountPublicMaterialAlgorithm {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountPublicMaterialAlgorithm {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountPublicMaterialAlgorithm {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
///`aws-roles-anywhere`: the trust anchor's CA certificate. `azure-cert`: the certificate uploaded to the app registration.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "description": "`aws-roles-anywhere`: the trust anchor's CA certificate. `azure-cert`: the certificate uploaded to the app registration.",
/// "type": "string",
/// "maxLength": 16384,
/// "pattern": "^-----BEGIN CERTIFICATE-----[A-Za-z0-9+/=\\r\\n]+-----END CERTIFICATE-----\\s*$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountPublicMaterialCertificatePem(::std::string::String);
impl ::std::ops::Deref for AccountPublicMaterialCertificatePem {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountPublicMaterialCertificatePem> for ::std::string::String {
fn from(value: AccountPublicMaterialCertificatePem) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountPublicMaterialCertificatePem {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 16384usize {
return Err("longer than 16384 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> = ::std::sync::LazyLock::new(
|| {
::regress::Regex::new(
"^-----BEGIN CERTIFICATE-----[A-Za-z0-9+/=\\r\\n]+-----END CERTIFICATE-----\\s*$",
)
.unwrap()
},
);
if PATTERN.find(value).is_none() {
return Err(
"doesn't match pattern \"^-----BEGIN CERTIFICATE-----[A-Za-z0-9+/=\\r\\n]+-----END CERTIFICATE-----\\s*$\""
.into(),
);
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountPublicMaterialCertificatePem {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountPublicMaterialCertificatePem {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountPublicMaterialCertificatePem {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountPublicMaterialCertificatePem {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///The public key as a JWK, with `kid`. Public members only: the schema admits no private member (`d`, `p`, `q`, `dp`, `dq`, `qi`), so a document carrying one fails validation.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "description": "The public key as a JWK, with `kid`. Public members only: the schema admits no private member (`d`, `p`, `q`, `dp`, `dq`, `qi`), so a document carrying one fails validation.",
/// "type": "object",
/// "required": [
/// "kid",
/// "kty"
/// ],
/// "properties": {
/// "alg": {
/// "type": "string",
/// "enum": [
/// "ES256",
/// "RS256"
/// ]
/// },
/// "crv": {
/// "type": "string",
/// "enum": [
/// "P-256"
/// ]
/// },
/// "e": {
/// "type": "string",
/// "maxLength": 16,
/// "pattern": "^[A-Za-z0-9_-]+$"
/// },
/// "kid": {
/// "type": "string",
/// "maxLength": 128,
/// "pattern": "^[!-~]+$"
/// },
/// "kty": {
/// "type": "string",
/// "enum": [
/// "EC",
/// "RSA"
/// ]
/// },
/// "n": {
/// "type": "string",
/// "maxLength": 1024,
/// "pattern": "^[A-Za-z0-9_-]+$"
/// },
/// "use": {
/// "type": "string",
/// "const": "sig"
/// },
/// "x": {
/// "type": "string",
/// "maxLength": 1024,
/// "pattern": "^[A-Za-z0-9_-]+$"
/// },
/// "y": {
/// "type": "string",
/// "maxLength": 1024,
/// "pattern": "^[A-Za-z0-9_-]+$"
/// }
/// },
/// "additionalProperties": false
///}
/// ```
/// </details>
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct AccountPublicMaterialPublicKeyJwk {
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub alg: ::std::option::Option<AccountPublicMaterialPublicKeyJwkAlg>,
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub crv: ::std::option::Option<AccountPublicMaterialPublicKeyJwkCrv>,
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub e: ::std::option::Option<AccountPublicMaterialPublicKeyJwkE>,
pub kid: AccountPublicMaterialPublicKeyJwkKid,
pub kty: AccountPublicMaterialPublicKeyJwkKty,
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub n: ::std::option::Option<AccountPublicMaterialPublicKeyJwkN>,
#[serde(
rename = "use",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
pub use_: ::std::option::Option<::std::string::String>,
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub x: ::std::option::Option<AccountPublicMaterialPublicKeyJwkX>,
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub y: ::std::option::Option<AccountPublicMaterialPublicKeyJwkY>,
}
impl AccountPublicMaterialPublicKeyJwk {
pub fn builder() -> builder::AccountPublicMaterialPublicKeyJwk {
Default::default()
}
}
///`AccountPublicMaterialPublicKeyJwkAlg`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "enum": [
/// "ES256",
/// "RS256"
/// ]
///}
/// ```
/// </details>
#[derive(
::serde::Deserialize,
::serde::Serialize,
Clone,
Copy,
Debug,
Eq,
Hash,
Ord,
PartialEq,
PartialOrd,
)]
#[non_exhaustive]
pub enum AccountPublicMaterialPublicKeyJwkAlg {
#[serde(rename = "ES256")]
Es256,
#[serde(rename = "RS256")]
Rs256,
}
impl ::std::fmt::Display for AccountPublicMaterialPublicKeyJwkAlg {
fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> ::std::fmt::Result {
match *self {
Self::Es256 => f.write_str("ES256"),
Self::Rs256 => f.write_str("RS256"),
}
}
}
impl ::std::str::FromStr for AccountPublicMaterialPublicKeyJwkAlg {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
match value {
"ES256" => Ok(Self::Es256),
"RS256" => Ok(Self::Rs256),
_ => Err("invalid value".into()),
}
}
}
impl ::std::convert::TryFrom<&str> for AccountPublicMaterialPublicKeyJwkAlg {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountPublicMaterialPublicKeyJwkAlg {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountPublicMaterialPublicKeyJwkAlg {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
///`AccountPublicMaterialPublicKeyJwkCrv`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "enum": [
/// "P-256"
/// ]
///}
/// ```
/// </details>
#[derive(
::serde::Deserialize,
::serde::Serialize,
Clone,
Copy,
Debug,
Eq,
Hash,
Ord,
PartialEq,
PartialOrd,
)]
#[non_exhaustive]
pub enum AccountPublicMaterialPublicKeyJwkCrv {
#[serde(rename = "P-256")]
P256,
}
impl ::std::fmt::Display for AccountPublicMaterialPublicKeyJwkCrv {
fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> ::std::fmt::Result {
match *self {
Self::P256 => f.write_str("P-256"),
}
}
}
impl ::std::str::FromStr for AccountPublicMaterialPublicKeyJwkCrv {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
match value {
"P-256" => Ok(Self::P256),
_ => Err("invalid value".into()),
}
}
}
impl ::std::convert::TryFrom<&str> for AccountPublicMaterialPublicKeyJwkCrv {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountPublicMaterialPublicKeyJwkCrv {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountPublicMaterialPublicKeyJwkCrv {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
///`AccountPublicMaterialPublicKeyJwkE`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "maxLength": 16,
/// "pattern": "^[A-Za-z0-9_-]+$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountPublicMaterialPublicKeyJwkE(::std::string::String);
impl ::std::ops::Deref for AccountPublicMaterialPublicKeyJwkE {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountPublicMaterialPublicKeyJwkE> for ::std::string::String {
fn from(value: AccountPublicMaterialPublicKeyJwkE) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountPublicMaterialPublicKeyJwkE {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 16usize {
return Err("longer than 16 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[A-Za-z0-9_-]+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[A-Za-z0-9_-]+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountPublicMaterialPublicKeyJwkE {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountPublicMaterialPublicKeyJwkE {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountPublicMaterialPublicKeyJwkE {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountPublicMaterialPublicKeyJwkE {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AccountPublicMaterialPublicKeyJwkKid`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "maxLength": 128,
/// "pattern": "^[!-~]+$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountPublicMaterialPublicKeyJwkKid(::std::string::String);
impl ::std::ops::Deref for AccountPublicMaterialPublicKeyJwkKid {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountPublicMaterialPublicKeyJwkKid> for ::std::string::String {
fn from(value: AccountPublicMaterialPublicKeyJwkKid) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountPublicMaterialPublicKeyJwkKid {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 128usize {
return Err("longer than 128 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[!-~]+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[!-~]+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountPublicMaterialPublicKeyJwkKid {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountPublicMaterialPublicKeyJwkKid {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountPublicMaterialPublicKeyJwkKid {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountPublicMaterialPublicKeyJwkKid {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AccountPublicMaterialPublicKeyJwkKty`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "enum": [
/// "EC",
/// "RSA"
/// ]
///}
/// ```
/// </details>
#[derive(
::serde::Deserialize,
::serde::Serialize,
Clone,
Copy,
Debug,
Eq,
Hash,
Ord,
PartialEq,
PartialOrd,
)]
#[non_exhaustive]
pub enum AccountPublicMaterialPublicKeyJwkKty {
#[serde(rename = "EC")]
Ec,
#[serde(rename = "RSA")]
Rsa,
}
impl ::std::fmt::Display for AccountPublicMaterialPublicKeyJwkKty {
fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> ::std::fmt::Result {
match *self {
Self::Ec => f.write_str("EC"),
Self::Rsa => f.write_str("RSA"),
}
}
}
impl ::std::str::FromStr for AccountPublicMaterialPublicKeyJwkKty {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
match value {
"EC" => Ok(Self::Ec),
"RSA" => Ok(Self::Rsa),
_ => Err("invalid value".into()),
}
}
}
impl ::std::convert::TryFrom<&str> for AccountPublicMaterialPublicKeyJwkKty {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountPublicMaterialPublicKeyJwkKty {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountPublicMaterialPublicKeyJwkKty {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
///`AccountPublicMaterialPublicKeyJwkN`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "maxLength": 1024,
/// "pattern": "^[A-Za-z0-9_-]+$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountPublicMaterialPublicKeyJwkN(::std::string::String);
impl ::std::ops::Deref for AccountPublicMaterialPublicKeyJwkN {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountPublicMaterialPublicKeyJwkN> for ::std::string::String {
fn from(value: AccountPublicMaterialPublicKeyJwkN) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountPublicMaterialPublicKeyJwkN {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 1024usize {
return Err("longer than 1024 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[A-Za-z0-9_-]+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[A-Za-z0-9_-]+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountPublicMaterialPublicKeyJwkN {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountPublicMaterialPublicKeyJwkN {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountPublicMaterialPublicKeyJwkN {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountPublicMaterialPublicKeyJwkN {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AccountPublicMaterialPublicKeyJwkX`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "maxLength": 1024,
/// "pattern": "^[A-Za-z0-9_-]+$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountPublicMaterialPublicKeyJwkX(::std::string::String);
impl ::std::ops::Deref for AccountPublicMaterialPublicKeyJwkX {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountPublicMaterialPublicKeyJwkX> for ::std::string::String {
fn from(value: AccountPublicMaterialPublicKeyJwkX) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountPublicMaterialPublicKeyJwkX {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 1024usize {
return Err("longer than 1024 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[A-Za-z0-9_-]+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[A-Za-z0-9_-]+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountPublicMaterialPublicKeyJwkX {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountPublicMaterialPublicKeyJwkX {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountPublicMaterialPublicKeyJwkX {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountPublicMaterialPublicKeyJwkX {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AccountPublicMaterialPublicKeyJwkY`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "maxLength": 1024,
/// "pattern": "^[A-Za-z0-9_-]+$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountPublicMaterialPublicKeyJwkY(::std::string::String);
impl ::std::ops::Deref for AccountPublicMaterialPublicKeyJwkY {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountPublicMaterialPublicKeyJwkY> for ::std::string::String {
fn from(value: AccountPublicMaterialPublicKeyJwkY) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountPublicMaterialPublicKeyJwkY {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 1024usize {
return Err("longer than 1024 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[A-Za-z0-9_-]+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[A-Za-z0-9_-]+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountPublicMaterialPublicKeyJwkY {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountPublicMaterialPublicKeyJwkY {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountPublicMaterialPublicKeyJwkY {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountPublicMaterialPublicKeyJwkY {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///That a static model's secret is set, and which one. Never its value.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "AccountSecretInfo",
/// "description": "That a static model's secret is set, and which one. Never its value.",
/// "type": "object",
/// "required": [
/// "fingerprint",
/// "setAt"
/// ],
/// "properties": {
/// "fingerprint": {
/// "$ref": "#/definitions/SecretFingerprint"
/// },
/// "setAt": {
/// "type": "string",
/// "format": "date-time"
/// }
/// },
/// "additionalProperties": false
///}
/// ```
/// </details>
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct AccountSecretInfo {
pub fingerprint: SecretFingerprint,
#[serde(rename = "setAt")]
pub set_at: ::chrono::DateTime<::chrono::offset::Utc>,
}
impl AccountSecretInfo {
pub fn builder() -> builder::AccountSecretInfo {
Default::default()
}
}
///Per-model account settings, discriminated by `model`: every branch is an object whose `model` member is a `const`, which is what lets each generated binding emit a tagged union, so an unusable setting is answered as `external:invalidSettings` naming the member rather than as an unparseable payload. Never a secret: every value here is returned to anyone who may read the account. Branches are referred to by their `model` ("the `sui-signer` settings"). They carry no `title`, so that every binding renders each as a plain variant of this union.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "AccountSettings",
/// "description": "Per-model account settings, discriminated by `model`: every branch is an object whose `model` member is a `const`, which is what lets each generated binding emit a tagged union, so an unusable setting is answered as `external:invalidSettings` naming the member rather than as an unparseable payload. Never a secret: every value here is returned to anyone who may read the account. Branches are referred to by their `model` (\"the `sui-signer` settings\"). They carry no `title`, so that every binding renders each as a plain variant of this union.",
/// "oneOf": [
/// {
/// "description": "Egress: `rolesanywhere.<region>.amazonaws.com`, plus `sts.<region>.amazonaws.com` when `chainedRoleArn` is set.",
/// "type": "object",
/// "required": [
/// "model",
/// "profileArn",
/// "region",
/// "roleArn",
/// "trustAnchorArn"
/// ],
/// "properties": {
/// "bucket": {
/// "description": "The S3 bucket issuances are scoped within. Required for an account whose bindings issue storage scopes.",
/// "$ref": "#/definitions/ProviderBucketName"
/// },
/// "chainedRoleArn": {
/// "description": "When set, every issuance chains an AssumeRole into this role carrying the downscoping session policy, for deployments whose Roles Anywhere profile cannot carry one per request. Caps a credential at one hour.",
/// "$ref": "#/definitions/AwsArn"
/// },
/// "model": {
/// "type": "string",
/// "const": "aws-roles-anywhere"
/// },
/// "probePrefix": {
/// "description": "Where external/accounts/probe writes its canary when no binding names a narrower prefix. Lets a new account be probed before anything is bound to it. Absent, a probe of an account with no bindings stops after `exchange` and reports `complete: false`.",
/// "$ref": "#/definitions/ProviderObjectPrefix"
/// },
/// "profileArn": {
/// "$ref": "#/definitions/AwsArn"
/// },
/// "region": {
/// "$ref": "#/definitions/AwsRegion"
/// },
/// "roleArn": {
/// "$ref": "#/definitions/AwsArn"
/// },
/// "trustAnchorArn": {
/// "description": "The trust anchor holding the custodian's CA certificate. Recorded after the administrator creates it from external/accounts/setup.",
/// "$ref": "#/definitions/AwsArn"
/// }
/// },
/// "additionalProperties": false
/// },
/// {
/// "description": "Egress: `sts.googleapis.com`, plus `iamcredentials.googleapis.com` when `serviceAccount` is set.",
/// "type": "object",
/// "required": [
/// "model",
/// "poolId",
/// "projectNumber",
/// "providerId"
/// ],
/// "properties": {
/// "bucket": {
/// "description": "The GCS bucket issuances are scoped within, by a Credential Access Boundary.",
/// "$ref": "#/definitions/ProviderBucketName"
/// },
/// "model": {
/// "type": "string",
/// "const": "gcp-wif-pinned"
/// },
/// "poolId": {
/// "type": "string",
/// "pattern": "^[a-z0-9-]{4,32}$"
/// },
/// "probePrefix": {
/// "description": "Where external/accounts/probe writes its canary when no binding names a narrower prefix. Lets a new account be probed before anything is bound to it. Absent, a probe of an account with no bindings stops after `exchange` and reports `complete: false`.",
/// "$ref": "#/definitions/ProviderObjectPrefix"
/// },
/// "projectNumber": {
/// "type": "string",
/// "pattern": "^[0-9]{1,20}$"
/// },
/// "providerId": {
/// "type": "string",
/// "pattern": "^[a-z0-9-]{4,32}$"
/// },
/// "serviceAccount": {
/// "description": "When set, the federated token is exchanged for this service account's access token.",
/// "type": "string",
/// "maxLength": 254,
/// "pattern": "^[a-z0-9-]+@[a-z0-9-]+\\.iam\\.gserviceaccount\\.com$"
/// },
/// "signingAlgorithm": {
/// "description": "The ID-token algorithm. ES256 unless the provider refuses it. Absent means ES256.",
/// "type": "string",
/// "enum": [
/// "ES256",
/// "RS256"
/// ]
/// }
/// },
/// "additionalProperties": false
/// },
/// {
/// "description": "Egress: `login.microsoftonline.com`, or the sovereign-cloud authority named in `authorityHost`.",
/// "type": "object",
/// "required": [
/// "clientId",
/// "model",
/// "tenantId",
/// "tokenScope"
/// ],
/// "properties": {
/// "authorityHost": {
/// "description": "Absent means `login.microsoftonline.com`.",
/// "type": "string",
/// "maxLength": 253,
/// "pattern": "^[a-z0-9.-]+$"
/// },
/// "clientId": {
/// "type": "string",
/// "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
/// },
/// "model": {
/// "type": "string",
/// "const": "azure-cert"
/// },
/// "tenantId": {
/// "type": "string",
/// "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
/// },
/// "tokenScope": {
/// "description": "The `scope` requested at the token endpoint, such as `https://storage.azure.com/.default`.",
/// "type": "string",
/// "maxLength": 512,
/// "pattern": "^[A-Za-z0-9:/._-]+$"
/// }
/// },
/// "additionalProperties": false
/// },
/// {
/// "description": "Egress: the host of `tokenEndpoint`, and nothing else.",
/// "type": "object",
/// "required": [
/// "clientId",
/// "model",
/// "tokenEndpoint"
/// ],
/// "properties": {
/// "audience": {
/// "description": "The assertion's `aud`. Absent means `tokenEndpoint`.",
/// "type": "string",
/// "maxLength": 2048,
/// "pattern": "^[!-~]+$"
/// },
/// "clientId": {
/// "type": "string",
/// "maxLength": 512,
/// "minLength": 1,
/// "pattern": "^[!-~]+$"
/// },
/// "model": {
/// "type": "string",
/// "const": "oauth2-private-key-jwt"
/// },
/// "scopes": {
/// "description": "The scopes a binding may request, the ceiling for every issuance.",
/// "type": "array",
/// "items": {
/// "type": "string",
/// "maxLength": 256,
/// "pattern": "^[!#-\\[\\]-~]+$"
/// },
/// "maxItems": 64,
/// "uniqueItems": true
/// },
/// "signingAlgorithm": {
/// "type": "string",
/// "enum": [
/// "ES256",
/// "RS256"
/// ]
/// },
/// "tokenEndpoint": {
/// "$ref": "#/definitions/ProviderHttpsUrl"
/// }
/// },
/// "additionalProperties": false
/// },
/// {
/// "description": "Issuance needs no egress: presigning is a computation inside the custodian, and the consumer uses the URL itself. The probe connects to the host of `endpoint`, which `egressHosts` therefore lists.",
/// "type": "object",
/// "required": [
/// "accessKeyId",
/// "bucket",
/// "endpoint",
/// "model",
/// "region"
/// ],
/// "properties": {
/// "accessKeyId": {
/// "description": "The access key's identifier. Not a secret: it appears in every presigned URL. The secret half is set with external/accounts/secret/set and never returned.",
/// "type": "string",
/// "maxLength": 128,
/// "pattern": "^[A-Za-z0-9]+$"
/// },
/// "bucket": {
/// "$ref": "#/definitions/ProviderBucketName"
/// },
/// "endpoint": {
/// "$ref": "#/definitions/ProviderHttpsUrl"
/// },
/// "model": {
/// "type": "string",
/// "const": "s3-static-presign"
/// },
/// "pathStyle": {
/// "description": "Address the bucket in the path rather than the host name, as MinIO usually needs.",
/// "type": "boolean"
/// },
/// "probePrefix": {
/// "description": "Where external/accounts/probe writes its canary when no binding names a narrower prefix. Lets a new account be probed before anything is bound to it. Absent, a probe of an account with no bindings stops after `exchange` and reports `complete: false`.",
/// "$ref": "#/definitions/ProviderObjectPrefix"
/// },
/// "region": {
/// "description": "The SigV4 signing region; `auto` for Cloudflare R2.",
/// "type": "string",
/// "maxLength": 64,
/// "pattern": "^[a-z0-9-]+$"
/// }
/// },
/// "additionalProperties": false
/// },
/// {
/// "description": "No egress: the custodian signs and the consumer submits the transaction. The allow-list, the gas caps and the coin caps are the account's whole authority; a transaction outside them is refused before anything is signed.",
/// "type": "object",
/// "required": [
/// "allowedCalls",
/// "maxGasBudgetMist",
/// "maxGasPerDayMist",
/// "model",
/// "network"
/// ],
/// "properties": {
/// "allowedCalls": {
/// "description": "Every MoveCall command in a signed transaction must name one of these. For Walrus storage: the system package's `register_blob`, `certify_blob`, `extend_blob` and `delete_blob`, and the coin calls needed to pay for them.",
/// "type": "array",
/// "items": {
/// "$ref": "#/definitions/SuiMoveCall"
/// },
/// "maxItems": 32,
/// "minItems": 1
/// },
/// "allowedObjects": {
/// "description": "Shared objects a transaction may take as input, such as the Walrus system and staking objects. Absent means any object the allowed calls accept.",
/// "type": "array",
/// "items": {
/// "type": "string",
/// "pattern": "^0x[0-9a-f]{64}$"
/// },
/// "maxItems": 32
/// },
/// "maxCoinOutPerTx": {
/// "description": "Per coin type, the most a single transaction may spend or transfer out of the account's address, in the coin's smallest unit. A coin type not listed may not leave the address at all.",
/// "type": "array",
/// "items": {
/// "type": "object",
/// "required": [
/// "amount",
/// "coinType"
/// ],
/// "properties": {
/// "amount": {
/// "type": "integer",
/// "minimum": 0.0
/// },
/// "coinType": {
/// "type": "string",
/// "maxLength": 512,
/// "pattern": "^0x[0-9a-f]{1,64}::[A-Za-z0-9_]+::[A-Za-z0-9_]+$"
/// }
/// },
/// "additionalProperties": false
/// },
/// "maxItems": 8
/// },
/// "maxGasBudgetMist": {
/// "description": "The largest gas budget one transaction may declare.",
/// "type": "integer",
/// "minimum": 1.0
/// },
/// "maxGasPerDayMist": {
/// "description": "The total gas budget signed per rolling 24 hours.",
/// "type": "integer",
/// "minimum": 1.0
/// },
/// "model": {
/// "type": "string",
/// "const": "sui-signer"
/// },
/// "network": {
/// "type": "string",
/// "enum": [
/// "mainnet",
/// "testnet",
/// "devnet"
/// ]
/// }
/// },
/// "additionalProperties": false
/// },
/// {
/// "description": "Egress: the host of `baseUrl`. The secret is set with external/accounts/secret/set and used only inside the custodian by `driver`; a provider reachable only by handing the consumer the raw key is not supported.",
/// "type": "object",
/// "required": [
/// "baseUrl",
/// "driver",
/// "model"
/// ],
/// "properties": {
/// "baseUrl": {
/// "$ref": "#/definitions/ProviderHttpsUrl"
/// },
/// "driver": {
/// "description": "The custodian's driver that uses the secret: performs a login or token exchange and returns a short-lived result. A custodian refuses a driver it does not implement.",
/// "type": "string",
/// "maxLength": 64,
/// "pattern": "^[a-z0-9][a-z0-9-]*$"
/// },
/// "model": {
/// "type": "string",
/// "const": "static-secret"
/// }
/// },
/// "additionalProperties": false
/// }
/// ]
///}
/// ```
/// </details>
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(tag = "model", deny_unknown_fields)]
#[non_exhaustive]
pub enum AccountSettings {
///Egress: `rolesanywhere.<region>.amazonaws.com`, plus `sts.<region>.amazonaws.com` when `chainedRoleArn` is set.
#[serde(rename = "aws-roles-anywhere")]
AwsRolesAnywhere {
///The S3 bucket issuances are scoped within. Required for an account whose bindings issue storage scopes.
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
bucket: ::std::option::Option<ProviderBucketName>,
///When set, every issuance chains an AssumeRole into this role carrying the downscoping session policy, for deployments whose Roles Anywhere profile cannot carry one per request. Caps a credential at one hour.
#[serde(
rename = "chainedRoleArn",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
chained_role_arn: ::std::option::Option<AwsArn>,
///Where external/accounts/probe writes its canary when no binding names a narrower prefix. Lets a new account be probed before anything is bound to it. Absent, a probe of an account with no bindings stops after `exchange` and reports `complete: false`.
#[serde(
rename = "probePrefix",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
probe_prefix: ::std::option::Option<ProviderObjectPrefix>,
#[serde(rename = "profileArn")]
profile_arn: AwsArn,
region: AwsRegion,
#[serde(rename = "roleArn")]
role_arn: AwsArn,
///The trust anchor holding the custodian's CA certificate. Recorded after the administrator creates it from external/accounts/setup.
#[serde(rename = "trustAnchorArn")]
trust_anchor_arn: AwsArn,
},
///Egress: `sts.googleapis.com`, plus `iamcredentials.googleapis.com` when `serviceAccount` is set.
#[serde(rename = "gcp-wif-pinned")]
GcpWifPinned {
///The GCS bucket issuances are scoped within, by a Credential Access Boundary.
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
bucket: ::std::option::Option<ProviderBucketName>,
#[serde(rename = "poolId")]
pool_id: AccountSettingsPoolId,
///Where external/accounts/probe writes its canary when no binding names a narrower prefix. Lets a new account be probed before anything is bound to it. Absent, a probe of an account with no bindings stops after `exchange` and reports `complete: false`.
#[serde(
rename = "probePrefix",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
probe_prefix: ::std::option::Option<ProviderObjectPrefix>,
#[serde(rename = "projectNumber")]
project_number: AccountSettingsProjectNumber,
#[serde(rename = "providerId")]
provider_id: AccountSettingsProviderId,
///When set, the federated token is exchanged for this service account's access token.
#[serde(
rename = "serviceAccount",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
service_account: ::std::option::Option<AccountSettingsServiceAccount>,
///The ID-token algorithm. ES256 unless the provider refuses it. Absent means ES256.
#[serde(
rename = "signingAlgorithm",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
signing_algorithm: ::std::option::Option<AccountSettingsSigningAlgorithm>,
},
///Egress: `login.microsoftonline.com`, or the sovereign-cloud authority named in `authorityHost`.
#[serde(rename = "azure-cert")]
AzureCert {
///Absent means `login.microsoftonline.com`.
#[serde(
rename = "authorityHost",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
authority_host: ::std::option::Option<AccountSettingsAuthorityHost>,
#[serde(rename = "clientId")]
client_id: AccountSettingsClientId,
#[serde(rename = "tenantId")]
tenant_id: AccountSettingsTenantId,
///The `scope` requested at the token endpoint, such as `https://storage.azure.com/.default`.
#[serde(rename = "tokenScope")]
token_scope: AccountSettingsTokenScope,
},
///Egress: the host of `tokenEndpoint`, and nothing else.
#[serde(rename = "oauth2-private-key-jwt")]
Oauth2PrivateKeyJwt {
///The assertion's `aud`. Absent means `tokenEndpoint`.
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
audience: ::std::option::Option<AccountSettingsAudience>,
#[serde(rename = "clientId")]
client_id: AccountSettingsClientId,
///The scopes a binding may request, the ceiling for every issuance.
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
scopes: ::std::option::Option<Vec<AccountSettingsScopesItem>>,
#[serde(
rename = "signingAlgorithm",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
signing_algorithm: ::std::option::Option<AccountSettingsSigningAlgorithm>,
#[serde(rename = "tokenEndpoint")]
token_endpoint: ProviderHttpsUrl,
},
///Issuance needs no egress: presigning is a computation inside the custodian, and the consumer uses the URL itself. The probe connects to the host of `endpoint`, which `egressHosts` therefore lists.
#[serde(rename = "s3-static-presign")]
S3StaticPresign {
///The access key's identifier. Not a secret: it appears in every presigned URL. The secret half is set with external/accounts/secret/set and never returned.
#[serde(rename = "accessKeyId")]
access_key_id: AccountSettingsAccessKeyId,
bucket: ProviderBucketName,
endpoint: ProviderHttpsUrl,
///Address the bucket in the path rather than the host name, as MinIO usually needs.
#[serde(
rename = "pathStyle",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
path_style: ::std::option::Option<bool>,
///Where external/accounts/probe writes its canary when no binding names a narrower prefix. Lets a new account be probed before anything is bound to it. Absent, a probe of an account with no bindings stops after `exchange` and reports `complete: false`.
#[serde(
rename = "probePrefix",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
probe_prefix: ::std::option::Option<ProviderObjectPrefix>,
///The SigV4 signing region; `auto` for Cloudflare R2.
region: AccountSettingsRegion,
},
///No egress: the custodian signs and the consumer submits the transaction. The allow-list, the gas caps and the coin caps are the account's whole authority; a transaction outside them is refused before anything is signed.
#[serde(rename = "sui-signer")]
SuiSigner {
///Every MoveCall command in a signed transaction must name one of these. For Walrus storage: the system package's `register_blob`, `certify_blob`, `extend_blob` and `delete_blob`, and the coin calls needed to pay for them.
#[serde(rename = "allowedCalls")]
allowed_calls: ::std::vec::Vec<SuiMoveCall>,
///Shared objects a transaction may take as input, such as the Walrus system and staking objects. Absent means any object the allowed calls accept.
#[serde(
rename = "allowedObjects",
default,
skip_serializing_if = "::std::vec::Vec::is_empty"
)]
allowed_objects: ::std::vec::Vec<AccountSettingsAllowedObjectsItem>,
///Per coin type, the most a single transaction may spend or transfer out of the account's address, in the coin's smallest unit. A coin type not listed may not leave the address at all.
#[serde(
rename = "maxCoinOutPerTx",
default,
skip_serializing_if = "::std::vec::Vec::is_empty"
)]
max_coin_out_per_tx: ::std::vec::Vec<AccountSettingsMaxCoinOutPerTxItem>,
///The largest gas budget one transaction may declare.
#[serde(rename = "maxGasBudgetMist")]
max_gas_budget_mist: ::std::num::NonZeroU64,
///The total gas budget signed per rolling 24 hours.
#[serde(rename = "maxGasPerDayMist")]
max_gas_per_day_mist: ::std::num::NonZeroU64,
network: AccountSettingsNetwork,
},
///Egress: the host of `baseUrl`. The secret is set with external/accounts/secret/set and used only inside the custodian by `driver`; a provider reachable only by handing the consumer the raw key is not supported.
#[serde(rename = "static-secret")]
StaticSecret {
#[serde(rename = "baseUrl")]
base_url: ProviderHttpsUrl,
///The custodian's driver that uses the secret: performs a login or token exchange and returns a short-lived result. A custodian refuses a driver it does not implement.
driver: AccountSettingsDriver,
},
}
///The access key's identifier. Not a secret: it appears in every presigned URL. The secret half is set with external/accounts/secret/set and never returned.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "description": "The access key's identifier. Not a secret: it appears in every presigned URL. The secret half is set with external/accounts/secret/set and never returned.",
/// "type": "string",
/// "maxLength": 128,
/// "pattern": "^[A-Za-z0-9]+$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountSettingsAccessKeyId(::std::string::String);
impl ::std::ops::Deref for AccountSettingsAccessKeyId {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountSettingsAccessKeyId> for ::std::string::String {
fn from(value: AccountSettingsAccessKeyId) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountSettingsAccessKeyId {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 128usize {
return Err("longer than 128 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[A-Za-z0-9]+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[A-Za-z0-9]+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsAccessKeyId {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSettingsAccessKeyId {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsAccessKeyId {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountSettingsAccessKeyId {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AccountSettingsAllowedObjectsItem`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "pattern": "^0x[0-9a-f]{64}$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountSettingsAllowedObjectsItem(::std::string::String);
impl ::std::ops::Deref for AccountSettingsAllowedObjectsItem {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountSettingsAllowedObjectsItem> for ::std::string::String {
fn from(value: AccountSettingsAllowedObjectsItem) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountSettingsAllowedObjectsItem {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^0x[0-9a-f]{64}$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^0x[0-9a-f]{64}$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsAllowedObjectsItem {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSettingsAllowedObjectsItem {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsAllowedObjectsItem {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountSettingsAllowedObjectsItem {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///The assertion's `aud`. Absent means `tokenEndpoint`.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "description": "The assertion's `aud`. Absent means `tokenEndpoint`.",
/// "type": "string",
/// "maxLength": 2048,
/// "pattern": "^[!-~]+$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountSettingsAudience(::std::string::String);
impl ::std::ops::Deref for AccountSettingsAudience {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountSettingsAudience> for ::std::string::String {
fn from(value: AccountSettingsAudience) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountSettingsAudience {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 2048usize {
return Err("longer than 2048 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[!-~]+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[!-~]+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsAudience {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSettingsAudience {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsAudience {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountSettingsAudience {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///Absent means `login.microsoftonline.com`.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "description": "Absent means `login.microsoftonline.com`.",
/// "type": "string",
/// "maxLength": 253,
/// "pattern": "^[a-z0-9.-]+$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountSettingsAuthorityHost(::std::string::String);
impl ::std::ops::Deref for AccountSettingsAuthorityHost {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountSettingsAuthorityHost> for ::std::string::String {
fn from(value: AccountSettingsAuthorityHost) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountSettingsAuthorityHost {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 253usize {
return Err("longer than 253 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[a-z0-9.-]+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[a-z0-9.-]+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsAuthorityHost {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSettingsAuthorityHost {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsAuthorityHost {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountSettingsAuthorityHost {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AccountSettingsClientId`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountSettingsClientId(::std::string::String);
impl ::std::ops::Deref for AccountSettingsClientId {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountSettingsClientId> for ::std::string::String {
fn from(value: AccountSettingsClientId) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountSettingsClientId {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| {
::regress::Regex::new(
"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$",
)
.unwrap()
});
if PATTERN.find(value).is_none() {
return Err(
"doesn't match pattern \"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$\""
.into(),
);
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsClientId {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSettingsClientId {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsClientId {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountSettingsClientId {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///The custodian's driver that uses the secret: performs a login or token exchange and returns a short-lived result. A custodian refuses a driver it does not implement.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "description": "The custodian's driver that uses the secret: performs a login or token exchange and returns a short-lived result. A custodian refuses a driver it does not implement.",
/// "type": "string",
/// "maxLength": 64,
/// "pattern": "^[a-z0-9][a-z0-9-]*$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountSettingsDriver(::std::string::String);
impl ::std::ops::Deref for AccountSettingsDriver {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountSettingsDriver> for ::std::string::String {
fn from(value: AccountSettingsDriver) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountSettingsDriver {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 64usize {
return Err("longer than 64 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[a-z0-9][a-z0-9-]*$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[a-z0-9][a-z0-9-]*$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsDriver {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSettingsDriver {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsDriver {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountSettingsDriver {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AccountSettingsMaxCoinOutPerTxItem`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "object",
/// "required": [
/// "amount",
/// "coinType"
/// ],
/// "properties": {
/// "amount": {
/// "type": "integer",
/// "minimum": 0.0
/// },
/// "coinType": {
/// "type": "string",
/// "maxLength": 512,
/// "pattern": "^0x[0-9a-f]{1,64}::[A-Za-z0-9_]+::[A-Za-z0-9_]+$"
/// }
/// },
/// "additionalProperties": false
///}
/// ```
/// </details>
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct AccountSettingsMaxCoinOutPerTxItem {
pub amount: u64,
#[serde(rename = "coinType")]
pub coin_type: AccountSettingsMaxCoinOutPerTxItemCoinType,
}
impl AccountSettingsMaxCoinOutPerTxItem {
pub fn builder() -> builder::AccountSettingsMaxCoinOutPerTxItem {
Default::default()
}
}
///`AccountSettingsMaxCoinOutPerTxItemCoinType`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "maxLength": 512,
/// "pattern": "^0x[0-9a-f]{1,64}::[A-Za-z0-9_]+::[A-Za-z0-9_]+$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountSettingsMaxCoinOutPerTxItemCoinType(::std::string::String);
impl ::std::ops::Deref for AccountSettingsMaxCoinOutPerTxItemCoinType {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountSettingsMaxCoinOutPerTxItemCoinType> for ::std::string::String {
fn from(value: AccountSettingsMaxCoinOutPerTxItemCoinType) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountSettingsMaxCoinOutPerTxItemCoinType {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 512usize {
return Err("longer than 512 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| {
::regress::Regex::new("^0x[0-9a-f]{1,64}::[A-Za-z0-9_]+::[A-Za-z0-9_]+$").unwrap()
});
if PATTERN.find(value).is_none() {
return Err(
"doesn't match pattern \"^0x[0-9a-f]{1,64}::[A-Za-z0-9_]+::[A-Za-z0-9_]+$\"".into(),
);
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsMaxCoinOutPerTxItemCoinType {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String>
for AccountSettingsMaxCoinOutPerTxItemCoinType
{
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsMaxCoinOutPerTxItemCoinType {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountSettingsMaxCoinOutPerTxItemCoinType {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AccountSettingsNetwork`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "enum": [
/// "mainnet",
/// "testnet",
/// "devnet"
/// ]
///}
/// ```
/// </details>
#[derive(
::serde::Deserialize,
::serde::Serialize,
Clone,
Copy,
Debug,
Eq,
Hash,
Ord,
PartialEq,
PartialOrd,
)]
#[non_exhaustive]
pub enum AccountSettingsNetwork {
#[serde(rename = "mainnet")]
Mainnet,
#[serde(rename = "testnet")]
Testnet,
#[serde(rename = "devnet")]
Devnet,
}
impl ::std::fmt::Display for AccountSettingsNetwork {
fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> ::std::fmt::Result {
match *self {
Self::Mainnet => f.write_str("mainnet"),
Self::Testnet => f.write_str("testnet"),
Self::Devnet => f.write_str("devnet"),
}
}
}
impl ::std::str::FromStr for AccountSettingsNetwork {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
match value {
"mainnet" => Ok(Self::Mainnet),
"testnet" => Ok(Self::Testnet),
"devnet" => Ok(Self::Devnet),
_ => Err("invalid value".into()),
}
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsNetwork {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSettingsNetwork {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsNetwork {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
///`AccountSettingsPoolId`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "pattern": "^[a-z0-9-]{4,32}$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountSettingsPoolId(::std::string::String);
impl ::std::ops::Deref for AccountSettingsPoolId {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountSettingsPoolId> for ::std::string::String {
fn from(value: AccountSettingsPoolId) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountSettingsPoolId {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[a-z0-9-]{4,32}$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[a-z0-9-]{4,32}$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsPoolId {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSettingsPoolId {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsPoolId {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountSettingsPoolId {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AccountSettingsProjectNumber`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "pattern": "^[0-9]{1,20}$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountSettingsProjectNumber(::std::string::String);
impl ::std::ops::Deref for AccountSettingsProjectNumber {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountSettingsProjectNumber> for ::std::string::String {
fn from(value: AccountSettingsProjectNumber) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountSettingsProjectNumber {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[0-9]{1,20}$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[0-9]{1,20}$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsProjectNumber {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSettingsProjectNumber {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsProjectNumber {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountSettingsProjectNumber {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AccountSettingsProviderId`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "pattern": "^[a-z0-9-]{4,32}$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountSettingsProviderId(::std::string::String);
impl ::std::ops::Deref for AccountSettingsProviderId {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountSettingsProviderId> for ::std::string::String {
fn from(value: AccountSettingsProviderId) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountSettingsProviderId {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[a-z0-9-]{4,32}$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[a-z0-9-]{4,32}$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsProviderId {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSettingsProviderId {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsProviderId {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountSettingsProviderId {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///The SigV4 signing region; `auto` for Cloudflare R2.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "description": "The SigV4 signing region; `auto` for Cloudflare R2.",
/// "type": "string",
/// "maxLength": 64,
/// "pattern": "^[a-z0-9-]+$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountSettingsRegion(::std::string::String);
impl ::std::ops::Deref for AccountSettingsRegion {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountSettingsRegion> for ::std::string::String {
fn from(value: AccountSettingsRegion) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountSettingsRegion {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 64usize {
return Err("longer than 64 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[a-z0-9-]+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[a-z0-9-]+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsRegion {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSettingsRegion {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsRegion {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountSettingsRegion {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AccountSettingsScopesItem`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "maxLength": 256,
/// "pattern": "^[!#-\\[\\]-~]+$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountSettingsScopesItem(::std::string::String);
impl ::std::ops::Deref for AccountSettingsScopesItem {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountSettingsScopesItem> for ::std::string::String {
fn from(value: AccountSettingsScopesItem) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountSettingsScopesItem {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 256usize {
return Err("longer than 256 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[!#-\\[\\]-~]+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[!#-\\[\\]-~]+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsScopesItem {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSettingsScopesItem {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsScopesItem {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountSettingsScopesItem {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///When set, the federated token is exchanged for this service account's access token.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "description": "When set, the federated token is exchanged for this service account's access token.",
/// "type": "string",
/// "maxLength": 254,
/// "pattern": "^[a-z0-9-]+@[a-z0-9-]+\\.iam\\.gserviceaccount\\.com$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountSettingsServiceAccount(::std::string::String);
impl ::std::ops::Deref for AccountSettingsServiceAccount {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountSettingsServiceAccount> for ::std::string::String {
fn from(value: AccountSettingsServiceAccount) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountSettingsServiceAccount {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 254usize {
return Err("longer than 254 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| {
::regress::Regex::new("^[a-z0-9-]+@[a-z0-9-]+\\.iam\\.gserviceaccount\\.com$")
.unwrap()
});
if PATTERN.find(value).is_none() {
return Err(
"doesn't match pattern \"^[a-z0-9-]+@[a-z0-9-]+\\.iam\\.gserviceaccount\\.com$\""
.into(),
);
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsServiceAccount {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSettingsServiceAccount {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsServiceAccount {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountSettingsServiceAccount {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///The ID-token algorithm. ES256 unless the provider refuses it. Absent means ES256.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "description": "The ID-token algorithm. ES256 unless the provider refuses it. Absent means ES256.",
/// "type": "string",
/// "enum": [
/// "ES256",
/// "RS256"
/// ]
///}
/// ```
/// </details>
#[derive(
::serde::Deserialize,
::serde::Serialize,
Clone,
Copy,
Debug,
Eq,
Hash,
Ord,
PartialEq,
PartialOrd,
)]
#[non_exhaustive]
pub enum AccountSettingsSigningAlgorithm {
#[serde(rename = "ES256")]
Es256,
#[serde(rename = "RS256")]
Rs256,
}
impl ::std::fmt::Display for AccountSettingsSigningAlgorithm {
fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> ::std::fmt::Result {
match *self {
Self::Es256 => f.write_str("ES256"),
Self::Rs256 => f.write_str("RS256"),
}
}
}
impl ::std::str::FromStr for AccountSettingsSigningAlgorithm {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
match value {
"ES256" => Ok(Self::Es256),
"RS256" => Ok(Self::Rs256),
_ => Err("invalid value".into()),
}
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsSigningAlgorithm {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSettingsSigningAlgorithm {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsSigningAlgorithm {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
///`AccountSettingsTenantId`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountSettingsTenantId(::std::string::String);
impl ::std::ops::Deref for AccountSettingsTenantId {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountSettingsTenantId> for ::std::string::String {
fn from(value: AccountSettingsTenantId) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountSettingsTenantId {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| {
::regress::Regex::new(
"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$",
)
.unwrap()
});
if PATTERN.find(value).is_none() {
return Err(
"doesn't match pattern \"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$\""
.into(),
);
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsTenantId {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSettingsTenantId {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsTenantId {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountSettingsTenantId {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///The `scope` requested at the token endpoint, such as `https://storage.azure.com/.default`.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "description": "The `scope` requested at the token endpoint, such as `https://storage.azure.com/.default`.",
/// "type": "string",
/// "maxLength": 512,
/// "pattern": "^[A-Za-z0-9:/._-]+$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountSettingsTokenScope(::std::string::String);
impl ::std::ops::Deref for AccountSettingsTokenScope {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountSettingsTokenScope> for ::std::string::String {
fn from(value: AccountSettingsTokenScope) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountSettingsTokenScope {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 512usize {
return Err("longer than 512 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[A-Za-z0-9:/._-]+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[A-Za-z0-9:/._-]+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsTokenScope {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSettingsTokenScope {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsTokenScope {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountSettingsTokenScope {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`active`: usable by its bindings. `suspended`: every issuance and signature is refused at once; management reads continue; resumable. `archived`: hidden from default listings, refused for use, restorable. Deletion removes the record.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "AccountState",
/// "description": "`active`: usable by its bindings. `suspended`: every issuance and signature is refused at once; management reads continue; resumable. `archived`: hidden from default listings, refused for use, restorable. Deletion removes the record.",
/// "type": "string",
/// "enum": [
/// "active",
/// "suspended",
/// "archived"
/// ]
///}
/// ```
/// </details>
#[derive(
::serde::Deserialize,
::serde::Serialize,
Clone,
Copy,
Debug,
Eq,
Hash,
Ord,
PartialEq,
PartialOrd,
)]
#[non_exhaustive]
pub enum AccountState {
#[serde(rename = "active")]
Active,
#[serde(rename = "suspended")]
Suspended,
#[serde(rename = "archived")]
Archived,
}
impl ::std::fmt::Display for AccountState {
fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> ::std::fmt::Result {
match *self {
Self::Active => f.write_str("active"),
Self::Suspended => f.write_str("suspended"),
Self::Archived => f.write_str("archived"),
}
}
}
impl ::std::str::FromStr for AccountState {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
match value {
"active" => Ok(Self::Active),
"suspended" => Ok(Self::Suspended),
"archived" => Ok(Self::Archived),
_ => Err("invalid value".into()),
}
}
}
impl ::std::convert::TryFrom<&str> for AccountState {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountState {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountState {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
///`AwsArn`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "AwsArn",
/// "type": "string",
/// "maxLength": 2048,
/// "pattern": "^arn:aws[a-z-]*:[a-z0-9-]+:[a-z0-9-]*:[0-9]{0,12}:[A-Za-z0-9+=,.@_/:-]+$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AwsArn(::std::string::String);
impl ::std::ops::Deref for AwsArn {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AwsArn> for ::std::string::String {
fn from(value: AwsArn) -> Self {
value.0
}
}
impl ::std::str::FromStr for AwsArn {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 2048usize {
return Err("longer than 2048 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| {
::regress::Regex::new(
"^arn:aws[a-z-]*:[a-z0-9-]+:[a-z0-9-]*:[0-9]{0,12}:[A-Za-z0-9+=,.@_/:-]+$",
)
.unwrap()
});
if PATTERN.find(value).is_none() {
return Err(
"doesn't match pattern \"^arn:aws[a-z-]*:[a-z0-9-]+:[a-z0-9-]*:[0-9]{0,12}:[A-Za-z0-9+=,.@_/:-]+$\""
.into(),
);
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AwsArn {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AwsArn {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AwsArn {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AwsArn {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AwsRegion`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "AwsRegion",
/// "type": "string",
/// "maxLength": 32,
/// "pattern": "^[a-z]{2}(-gov)?-[a-z]+-[0-9]$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AwsRegion(::std::string::String);
impl ::std::ops::Deref for AwsRegion {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AwsRegion> for ::std::string::String {
fn from(value: AwsRegion) -> Self {
value.0
}
}
impl ::std::str::FromStr for AwsRegion {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 32usize {
return Err("longer than 32 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| {
::regress::Regex::new("^[a-z]{2}(-gov)?-[a-z]+-[0-9]$").unwrap()
});
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[a-z]{2}(-gov)?-[a-z]+-[0-9]$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AwsRegion {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AwsRegion {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AwsRegion {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AwsRegion {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///The widest scope a binding's consumer may request. An issuance is inside the ceiling when its `prefix` begins with one of `prefixes`, every one of its `actions` is in `actions`, and every one of its `scopes` is in `scopes`. Absent members confer nothing: a ceiling with no `prefixes` permits no storage issuance.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "CredentialScopeCeiling",
/// "description": "The widest scope a binding's consumer may request. An issuance is inside the ceiling when its `prefix` begins with one of `prefixes`, every one of its `actions` is in `actions`, and every one of its `scopes` is in `scopes`. Absent members confer nothing: a ceiling with no `prefixes` permits no storage issuance.",
/// "type": "object",
/// "properties": {
/// "actions": {
/// "type": "array",
/// "items": {
/// "$ref": "#/definitions/ProviderObjectAction"
/// },
/// "maxItems": 3,
/// "minItems": 1,
/// "uniqueItems": true
/// },
/// "prefixes": {
/// "type": "array",
/// "items": {
/// "$ref": "#/definitions/ProviderObjectPrefix"
/// },
/// "maxItems": 64,
/// "minItems": 1,
/// "uniqueItems": true
/// },
/// "scopes": {
/// "type": "array",
/// "items": {
/// "type": "string",
/// "maxLength": 256,
/// "pattern": "^[!#-\\[\\]-~]+$"
/// },
/// "maxItems": 64,
/// "uniqueItems": true
/// }
/// },
/// "additionalProperties": false
///}
/// ```
/// </details>
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct CredentialScopeCeiling {
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub actions: ::std::option::Option<Vec<ProviderObjectAction>>,
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub prefixes: ::std::option::Option<Vec<ProviderObjectPrefix>>,
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub scopes: ::std::option::Option<Vec<CredentialScopeCeilingScopesItem>>,
}
impl ::std::default::Default for CredentialScopeCeiling {
fn default() -> Self {
Self {
actions: Default::default(),
prefixes: Default::default(),
scopes: Default::default(),
}
}
}
impl CredentialScopeCeiling {
pub fn builder() -> builder::CredentialScopeCeiling {
Default::default()
}
}
///`CredentialScopeCeilingScopesItem`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "maxLength": 256,
/// "pattern": "^[!#-\\[\\]-~]+$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct CredentialScopeCeilingScopesItem(::std::string::String);
impl ::std::ops::Deref for CredentialScopeCeilingScopesItem {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<CredentialScopeCeilingScopesItem> for ::std::string::String {
fn from(value: CredentialScopeCeilingScopesItem) -> Self {
value.0
}
}
impl ::std::str::FromStr for CredentialScopeCeilingScopesItem {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 256usize {
return Err("longer than 256 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[!#-\\[\\]-~]+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[!#-\\[\\]-~]+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for CredentialScopeCeilingScopesItem {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for CredentialScopeCeilingScopesItem {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for CredentialScopeCeilingScopesItem {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for CredentialScopeCeilingScopesItem {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
/**
A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.
Multihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.
This definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.
Restricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that "interoperability is not guaranteed between implementations using such values", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.*/
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "DigestMultibase",
/// "description": "A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.\n\nMultihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.\n\nThis definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.\n\nRestricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that \"interoperability is not guaranteed between implementations using such values\", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.",
/// "examples": [
/// "zQmbWqxBEKC3P8tqsKc98xmWNzrzDtRLMiMPL8wBuTGsMnR"
/// ],
/// "type": "string",
/// "minLength": 16,
/// "pattern": "^(z[1-9A-HJ-NP-Za-km-z]+|u[A-Za-z0-9_-]+)$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct DigestMultibase(::std::string::String);
impl ::std::ops::Deref for DigestMultibase {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<DigestMultibase> for ::std::string::String {
fn from(value: DigestMultibase) -> Self {
value.0
}
}
impl ::std::str::FromStr for DigestMultibase {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() < 16usize {
return Err("shorter than 16 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| {
::regress::Regex::new("^(z[1-9A-HJ-NP-Za-km-z]+|u[A-Za-z0-9_-]+)$").unwrap()
});
if PATTERN.find(value).is_none() {
return Err(
"doesn't match pattern \"^(z[1-9A-HJ-NP-Za-km-z]+|u[A-Za-z0-9_-]+)$\"".into(),
);
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for DigestMultibase {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for DigestMultibase {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for DigestMultibase {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for DigestMultibase {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "Ext",
/// "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
/// "type": "object",
/// "minProperties": 1,
/// "additionalProperties": true,
/// "propertyNames": {
/// "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
/// }
///}
/// ```
/// </details>
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(transparent)]
pub struct Ext(pub ::std::collections::HashMap<ExtKey, ::serde_json::Value>);
impl ::std::ops::Deref for Ext {
type Target = ::std::collections::HashMap<ExtKey, ::serde_json::Value>;
fn deref(&self) -> &::std::collections::HashMap<ExtKey, ::serde_json::Value> {
&self.0
}
}
impl ::std::convert::From<Ext> for ::std::collections::HashMap<ExtKey, ::serde_json::Value> {
fn from(value: Ext) -> Self {
value.0
}
}
impl ::std::convert::From<::std::collections::HashMap<ExtKey, ::serde_json::Value>> for Ext {
fn from(value: ::std::collections::HashMap<ExtKey, ::serde_json::Value>) -> Self {
Self(value)
}
}
///`ExtKey`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct ExtKey(::std::string::String);
impl ::std::ops::Deref for ExtKey {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<ExtKey> for ::std::string::String {
fn from(value: ExtKey) -> Self {
value.0
}
}
impl ::std::str::FromStr for ExtKey {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| {
::regress::Regex::new("^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$").unwrap()
});
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for ExtKey {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for ExtKey {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for ExtKey {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for ExtKey {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///An account as every read returns it. Contains no private key, no secret and no issued credential, to any reader.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "ExternalAccount",
/// "description": "An account as every read returns it. Contains no private key, no secret and no issued credential, to any reader.",
/// "type": "object",
/// "required": [
/// "bindings",
/// "context",
/// "createdAt",
/// "egressHosts",
/// "id",
/// "label",
/// "providerSetupRequired",
/// "settings",
/// "state",
/// "updatedAt"
/// ],
/// "properties": {
/// "bindings": {
/// "type": "array",
/// "items": {
/// "$ref": "#/definitions/AccountBinding"
/// },
/// "maxItems": 256
/// },
/// "context": {
/// "$ref": "#/definitions/AccountContextId"
/// },
/// "createdAt": {
/// "type": "string",
/// "format": "date-time"
/// },
/// "egressHosts": {
/// "description": "The provider hosts the custodian connects to on this account's behalf, derived by the custodian from its settings: the token or session endpoints issuance uses, and the destinations external/accounts/probe dials (the object store's host, for a storage model). The custodian MUST NOT connect anywhere else on the account's behalf, so an egress proxy can allow exactly this set. Empty only for a model that neither exchanges nor probes over the network.",
/// "type": "array",
/// "items": {
/// "type": "string",
/// "maxLength": 253,
/// "pattern": "^[a-z0-9.-]+$"
/// },
/// "maxItems": 8
/// },
/// "id": {
/// "$ref": "#/definitions/AccountId"
/// },
/// "label": {
/// "description": "Display name. Untrusted text: render it, never interpret it.",
/// "type": "string",
/// "maxLength": 128,
/// "minLength": 1
/// },
/// "lastProbe": {
/// "$ref": "#/definitions/AccountProbeReport"
/// },
/// "providerSetupRequired": {
/// "description": "True when the account cannot be used until its provider-side setup is redone: after a restore that could not carry its key or secret (a wrapped RSA key, a static secret), or after a rotation awaiting confirmation.",
/// "type": "boolean"
/// },
/// "publicMaterial": {
/// "description": "Absent for the static models, which hold a secret rather than a key.",
/// "$ref": "#/definitions/AccountPublicMaterial"
/// },
/// "secret": {
/// "description": "Static models only; absent until the secret is set.",
/// "$ref": "#/definitions/AccountSecretInfo"
/// },
/// "settings": {
/// "$ref": "#/definitions/AccountSettings"
/// },
/// "state": {
/// "$ref": "#/definitions/AccountState"
/// },
/// "updatedAt": {
/// "type": "string",
/// "format": "date-time"
/// }
/// },
/// "additionalProperties": false
///}
/// ```
/// </details>
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct ExternalAccount {
pub bindings: ::std::vec::Vec<AccountBinding>,
pub context: AccountContextId,
#[serde(rename = "createdAt")]
pub created_at: ::chrono::DateTime<::chrono::offset::Utc>,
///The provider hosts the custodian connects to on this account's behalf, derived by the custodian from its settings: the token or session endpoints issuance uses, and the destinations external/accounts/probe dials (the object store's host, for a storage model). The custodian MUST NOT connect anywhere else on the account's behalf, so an egress proxy can allow exactly this set. Empty only for a model that neither exchanges nor probes over the network.
#[serde(rename = "egressHosts")]
pub egress_hosts: ::std::vec::Vec<ExternalAccountEgressHostsItem>,
pub id: AccountId,
///Display name. Untrusted text: render it, never interpret it.
pub label: ExternalAccountLabel,
#[serde(
rename = "lastProbe",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
pub last_probe: ::std::option::Option<AccountProbeReport>,
///True when the account cannot be used until its provider-side setup is redone: after a restore that could not carry its key or secret (a wrapped RSA key, a static secret), or after a rotation awaiting confirmation.
#[serde(rename = "providerSetupRequired")]
pub provider_setup_required: bool,
///Absent for the static models, which hold a secret rather than a key.
#[serde(
rename = "publicMaterial",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
pub public_material: ::std::option::Option<AccountPublicMaterial>,
///Static models only; absent until the secret is set.
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub secret: ::std::option::Option<AccountSecretInfo>,
pub settings: AccountSettings,
pub state: AccountState,
#[serde(rename = "updatedAt")]
pub updated_at: ::chrono::DateTime<::chrono::offset::Utc>,
}
impl ExternalAccount {
pub fn builder() -> builder::ExternalAccount {
Default::default()
}
}
///`ExternalAccountEgressHostsItem`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "maxLength": 253,
/// "pattern": "^[a-z0-9.-]+$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct ExternalAccountEgressHostsItem(::std::string::String);
impl ::std::ops::Deref for ExternalAccountEgressHostsItem {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<ExternalAccountEgressHostsItem> for ::std::string::String {
fn from(value: ExternalAccountEgressHostsItem) -> Self {
value.0
}
}
impl ::std::str::FromStr for ExternalAccountEgressHostsItem {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 253usize {
return Err("longer than 253 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[a-z0-9.-]+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[a-z0-9.-]+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for ExternalAccountEgressHostsItem {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for ExternalAccountEgressHostsItem {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for ExternalAccountEgressHostsItem {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for ExternalAccountEgressHostsItem {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///Display name. Untrusted text: render it, never interpret it.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "description": "Display name. Untrusted text: render it, never interpret it.",
/// "type": "string",
/// "maxLength": 128,
/// "minLength": 1
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct ExternalAccountLabel(::std::string::String);
impl ::std::ops::Deref for ExternalAccountLabel {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<ExternalAccountLabel> for ::std::string::String {
fn from(value: ExternalAccountLabel) -> Self {
value.0
}
}
impl ::std::str::FromStr for ExternalAccountLabel {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 128usize {
return Err("longer than 128 characters".into());
}
if value.chars().count() < 1usize {
return Err("shorter than 1 characters".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for ExternalAccountLabel {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for ExternalAccountLabel {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for ExternalAccountLabel {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for ExternalAccountLabel {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///Create an external account; the custodian generates its key. The outer document members are owned by the framework — SPEC §6.3.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "$id": "https://trusttasks.org/spec/external/accounts/create/0.1",
/// "title": "Payload",
/// "description": "Create an external account; the custodian generates its key. The outer document members are owned by the framework — SPEC §6.3.",
/// "type": "object",
/// "required": [
/// "context",
/// "id",
/// "label",
/// "settings"
/// ],
/// "properties": {
/// "context": {
/// "$ref": "#/definitions/AccountContextId"
/// },
/// "ext": {
/// "$ref": "#/definitions/Ext"
/// },
/// "id": {
/// "$ref": "#/definitions/AccountId"
/// },
/// "label": {
/// "description": "Display name.",
/// "type": "string",
/// "maxLength": 128,
/// "minLength": 1
/// },
/// "settings": {
/// "$ref": "#/definitions/AccountSettings"
/// }
/// },
/// "additionalProperties": false
///}
/// ```
/// </details>
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct Payload {
pub context: AccountContextId,
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub ext: ::std::option::Option<Ext>,
pub id: AccountId,
///Display name.
pub label: PayloadLabel,
pub settings: AccountSettings,
}
impl Payload {
pub fn builder() -> builder::Payload {
Default::default()
}
}
///Display name.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "description": "Display name.",
/// "type": "string",
/// "maxLength": 128,
/// "minLength": 1
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct PayloadLabel(::std::string::String);
impl ::std::ops::Deref for PayloadLabel {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<PayloadLabel> for ::std::string::String {
fn from(value: PayloadLabel) -> Self {
value.0
}
}
impl ::std::str::FromStr for PayloadLabel {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 128usize {
return Err("longer than 128 characters".into());
}
if value.chars().count() < 1usize {
return Err("shorter than 1 characters".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for PayloadLabel {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for PayloadLabel {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for PayloadLabel {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for PayloadLabel {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///A bucket name as S3 and GCS accept it. Validated rather than free so that it can be placed in a provider policy without escaping.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "ProviderBucketName",
/// "description": "A bucket name as S3 and GCS accept it. Validated rather than free so that it can be placed in a provider policy without escaping.",
/// "type": "string",
/// "maxLength": 63,
/// "minLength": 3,
/// "pattern": "^[a-z0-9][a-z0-9.-]*[a-z0-9]$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct ProviderBucketName(::std::string::String);
impl ::std::ops::Deref for ProviderBucketName {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<ProviderBucketName> for ::std::string::String {
fn from(value: ProviderBucketName) -> Self {
value.0
}
}
impl ::std::str::FromStr for ProviderBucketName {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 63usize {
return Err("longer than 63 characters".into());
}
if value.chars().count() < 3usize {
return Err("shorter than 3 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| {
::regress::Regex::new("^[a-z0-9][a-z0-9.-]*[a-z0-9]$").unwrap()
});
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[a-z0-9][a-z0-9.-]*[a-z0-9]$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for ProviderBucketName {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for ProviderBucketName {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for ProviderBucketName {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for ProviderBucketName {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`ProviderHttpsUrl`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "ProviderHttpsUrl",
/// "type": "string",
/// "format": "uri",
/// "maxLength": 2048,
/// "pattern": "^https://[^\\s\"'\\\\]+$"
///}
/// ```
/// </details>
#[derive(
::serde::Deserialize, ::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd,
)]
#[serde(transparent)]
pub struct ProviderHttpsUrl(pub ::std::string::String);
impl ::std::ops::Deref for ProviderHttpsUrl {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<ProviderHttpsUrl> for ::std::string::String {
fn from(value: ProviderHttpsUrl) -> Self {
value.0
}
}
impl ::std::convert::From<::std::string::String> for ProviderHttpsUrl {
fn from(value: ::std::string::String) -> Self {
Self(value)
}
}
impl ::std::str::FromStr for ProviderHttpsUrl {
type Err = ::std::convert::Infallible;
fn from_str(value: &str) -> ::std::result::Result<Self, Self::Err> {
Ok(Self(value.to_string()))
}
}
impl ::std::fmt::Display for ProviderHttpsUrl {
fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> ::std::fmt::Result {
self.0.fmt(f)
}
}
///`put`: write an object. `get`: read one. `delete`: remove one. No list, ACL, policy or bucket-level action exists here, so none can be granted.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "ProviderObjectAction",
/// "description": "`put`: write an object. `get`: read one. `delete`: remove one. No list, ACL, policy or bucket-level action exists here, so none can be granted.",
/// "type": "string",
/// "enum": [
/// "put",
/// "get",
/// "delete"
/// ]
///}
/// ```
/// </details>
#[derive(
::serde::Deserialize,
::serde::Serialize,
Clone,
Copy,
Debug,
Eq,
Hash,
Ord,
PartialEq,
PartialOrd,
)]
#[non_exhaustive]
pub enum ProviderObjectAction {
#[serde(rename = "put")]
Put,
#[serde(rename = "get")]
Get,
#[serde(rename = "delete")]
Delete,
}
impl ::std::fmt::Display for ProviderObjectAction {
fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> ::std::fmt::Result {
match *self {
Self::Put => f.write_str("put"),
Self::Get => f.write_str("get"),
Self::Delete => f.write_str("delete"),
}
}
}
impl ::std::str::FromStr for ProviderObjectAction {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
match value {
"put" => Ok(Self::Put),
"get" => Ok(Self::Get),
"delete" => Ok(Self::Delete),
_ => Err("invalid value".into()),
}
}
}
impl ::std::convert::TryFrom<&str> for ProviderObjectAction {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for ProviderObjectAction {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for ProviderObjectAction {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
///An object-key prefix within the account's bucket: one or more segments of lowercase letters, digits, `.`, `_` and `-`, each beginning with a letter or digit and ending with `/`. No quote, backslash, wildcard, whitespace, `..` segment or empty segment can appear. That is deliberate: the custodian places this value inside a provider policy — an IAM session policy (JSON), a GCS Credential Access Boundary condition (CEL) — and a value able to carry a metacharacter can break out of the string it is placed in and widen the policy. That is a known class of defect (CVE-2026-42811, a CEL injection in downscoped GCS credentials). Even with this pattern, a custodian MUST build provider policies with the provider language's own encoder, never by string interpolation.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "ProviderObjectPrefix",
/// "description": "An object-key prefix within the account's bucket: one or more segments of lowercase letters, digits, `.`, `_` and `-`, each beginning with a letter or digit and ending with `/`. No quote, backslash, wildcard, whitespace, `..` segment or empty segment can appear. That is deliberate: the custodian places this value inside a provider policy — an IAM session policy (JSON), a GCS Credential Access Boundary condition (CEL) — and a value able to carry a metacharacter can break out of the string it is placed in and widen the policy. That is a known class of defect (CVE-2026-42811, a CEL injection in downscoped GCS credentials). Even with this pattern, a custodian MUST build provider policies with the provider language's own encoder, never by string interpolation.",
/// "type": "string",
/// "maxLength": 512,
/// "minLength": 2,
/// "pattern": "^([a-z0-9][a-z0-9._-]{0,127}/){1,16}$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct ProviderObjectPrefix(::std::string::String);
impl ::std::ops::Deref for ProviderObjectPrefix {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<ProviderObjectPrefix> for ::std::string::String {
fn from(value: ProviderObjectPrefix) -> Self {
value.0
}
}
impl ::std::str::FromStr for ProviderObjectPrefix {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 512usize {
return Err("longer than 512 characters".into());
}
if value.chars().count() < 2usize {
return Err("shorter than 2 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| {
::regress::Regex::new("^([a-z0-9][a-z0-9._-]{0,127}/){1,16}$").unwrap()
});
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^([a-z0-9][a-z0-9._-]{0,127}/){1,16}$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for ProviderObjectPrefix {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for ProviderObjectPrefix {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for ProviderObjectPrefix {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for ProviderObjectPrefix {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`Response`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "Response",
/// "type": "object",
/// "required": [
/// "account"
/// ],
/// "properties": {
/// "account": {
/// "$ref": "#/definitions/ExternalAccount"
/// },
/// "ext": {
/// "$ref": "#/definitions/Ext"
/// }
/// },
/// "additionalProperties": false,
/// "$anchor": "response"
///}
/// ```
/// </details>
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct Response {
pub account: ExternalAccount,
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub ext: ::std::option::Option<Ext>,
}
impl Response {
pub fn builder() -> builder::Response {
Default::default()
}
}
///Which secret is set, without being a way to test guesses at it. `hmacsha256:` followed by the base64url encoding, without padding, of the first 16 bytes of HMAC-SHA256 over the secret's bytes under a fingerprint key the custodian holds and never discloses. Comparable only between fingerprints made by the same custodian: a re-entered value can be confirmed, while the same secret at two custodians gives unrelated fingerprints. Never a bare hash of the secret, which would let anyone who reads it run a dictionary against it offline; and deliberately not a DigestMultibase, since multihash has no code for a keyed digest.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "SecretFingerprint",
/// "description": "Which secret is set, without being a way to test guesses at it. `hmacsha256:` followed by the base64url encoding, without padding, of the first 16 bytes of HMAC-SHA256 over the secret's bytes under a fingerprint key the custodian holds and never discloses. Comparable only between fingerprints made by the same custodian: a re-entered value can be confirmed, while the same secret at two custodians gives unrelated fingerprints. Never a bare hash of the secret, which would let anyone who reads it run a dictionary against it offline; and deliberately not a DigestMultibase, since multihash has no code for a keyed digest.",
/// "type": "string",
/// "maxLength": 33,
/// "pattern": "^hmacsha256:[A-Za-z0-9_-]{22}$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct SecretFingerprint(::std::string::String);
impl ::std::ops::Deref for SecretFingerprint {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<SecretFingerprint> for ::std::string::String {
fn from(value: SecretFingerprint) -> Self {
value.0
}
}
impl ::std::str::FromStr for SecretFingerprint {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 33usize {
return Err("longer than 33 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| {
::regress::Regex::new("^hmacsha256:[A-Za-z0-9_-]{22}$").unwrap()
});
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^hmacsha256:[A-Za-z0-9_-]{22}$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for SecretFingerprint {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for SecretFingerprint {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for SecretFingerprint {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for SecretFingerprint {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///One Move function an account's transactions may call.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "SuiMoveCall",
/// "description": "One Move function an account's transactions may call.",
/// "type": "object",
/// "required": [
/// "function",
/// "module",
/// "package"
/// ],
/// "properties": {
/// "function": {
/// "type": "string",
/// "pattern": "^[A-Za-z][A-Za-z0-9_]{0,127}$"
/// },
/// "module": {
/// "type": "string",
/// "pattern": "^[A-Za-z][A-Za-z0-9_]{0,127}$"
/// },
/// "package": {
/// "type": "string",
/// "pattern": "^0x[0-9a-f]{64}$"
/// }
/// },
/// "additionalProperties": false
///}
/// ```
/// </details>
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct SuiMoveCall {
pub function: SuiMoveCallFunction,
pub module: SuiMoveCallModule,
pub package: SuiMoveCallPackage,
}
impl SuiMoveCall {
pub fn builder() -> builder::SuiMoveCall {
Default::default()
}
}
///`SuiMoveCallFunction`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "pattern": "^[A-Za-z][A-Za-z0-9_]{0,127}$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct SuiMoveCallFunction(::std::string::String);
impl ::std::ops::Deref for SuiMoveCallFunction {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<SuiMoveCallFunction> for ::std::string::String {
fn from(value: SuiMoveCallFunction) -> Self {
value.0
}
}
impl ::std::str::FromStr for SuiMoveCallFunction {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| {
::regress::Regex::new("^[A-Za-z][A-Za-z0-9_]{0,127}$").unwrap()
});
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[A-Za-z][A-Za-z0-9_]{0,127}$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for SuiMoveCallFunction {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for SuiMoveCallFunction {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for SuiMoveCallFunction {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for SuiMoveCallFunction {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`SuiMoveCallModule`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "pattern": "^[A-Za-z][A-Za-z0-9_]{0,127}$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct SuiMoveCallModule(::std::string::String);
impl ::std::ops::Deref for SuiMoveCallModule {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<SuiMoveCallModule> for ::std::string::String {
fn from(value: SuiMoveCallModule) -> Self {
value.0
}
}
impl ::std::str::FromStr for SuiMoveCallModule {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| {
::regress::Regex::new("^[A-Za-z][A-Za-z0-9_]{0,127}$").unwrap()
});
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[A-Za-z][A-Za-z0-9_]{0,127}$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for SuiMoveCallModule {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for SuiMoveCallModule {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for SuiMoveCallModule {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for SuiMoveCallModule {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`SuiMoveCallPackage`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "pattern": "^0x[0-9a-f]{64}$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct SuiMoveCallPackage(::std::string::String);
impl ::std::ops::Deref for SuiMoveCallPackage {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<SuiMoveCallPackage> for ::std::string::String {
fn from(value: SuiMoveCallPackage) -> Self {
value.0
}
}
impl ::std::str::FromStr for SuiMoveCallPackage {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^0x[0-9a-f]{64}$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^0x[0-9a-f]{64}$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for SuiMoveCallPackage {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for SuiMoveCallPackage {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for SuiMoveCallPackage {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for SuiMoveCallPackage {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
/// Types for composing complex structures.
pub mod builder {
#[derive(Clone, Debug)]
pub struct AccountBinding {
consumer: ::std::result::Result<super::AccountBindingConsumer, ::std::string::String>,
granted_at: ::std::result::Result<
::std::option::Option<::chrono::DateTime<::chrono::offset::Utc>>,
::std::string::String,
>,
max_ttl_seconds: ::std::result::Result<i64, ::std::string::String>,
rate_per_minute: ::std::result::Result<::std::num::NonZeroU64, ::std::string::String>,
scope_ceiling: ::std::result::Result<
::std::option::Option<super::CredentialScopeCeiling>,
::std::string::String,
>,
source_cidrs: ::std::result::Result<
::std::vec::Vec<super::AccountBindingSourceCidrsItem>,
::std::string::String,
>,
}
impl ::std::default::Default for AccountBinding {
fn default() -> Self {
Self {
consumer: Err("no value supplied for consumer".to_string()),
granted_at: Ok(Default::default()),
max_ttl_seconds: Err("no value supplied for max_ttl_seconds".to_string()),
rate_per_minute: Err("no value supplied for rate_per_minute".to_string()),
scope_ceiling: Ok(Default::default()),
source_cidrs: Ok(Default::default()),
}
}
}
impl AccountBinding {
pub fn consumer<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::AccountBindingConsumer>,
T::Error: ::std::fmt::Display,
{
self.consumer = value
.try_into()
.map_err(|e| format!("error converting supplied value for consumer: {e}"));
self
}
pub fn granted_at<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<
::std::option::Option<::chrono::DateTime<::chrono::offset::Utc>>,
>,
T::Error: ::std::fmt::Display,
{
self.granted_at = value
.try_into()
.map_err(|e| format!("error converting supplied value for granted_at: {e}"));
self
}
pub fn max_ttl_seconds<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<i64>,
T::Error: ::std::fmt::Display,
{
self.max_ttl_seconds = value
.try_into()
.map_err(|e| format!("error converting supplied value for max_ttl_seconds: {e}"));
self
}
pub fn rate_per_minute<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::num::NonZeroU64>,
T::Error: ::std::fmt::Display,
{
self.rate_per_minute = value
.try_into()
.map_err(|e| format!("error converting supplied value for rate_per_minute: {e}"));
self
}
pub fn scope_ceiling<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<super::CredentialScopeCeiling>>,
T::Error: ::std::fmt::Display,
{
self.scope_ceiling = value
.try_into()
.map_err(|e| format!("error converting supplied value for scope_ceiling: {e}"));
self
}
pub fn source_cidrs<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::vec::Vec<super::AccountBindingSourceCidrsItem>>,
T::Error: ::std::fmt::Display,
{
self.source_cidrs = value
.try_into()
.map_err(|e| format!("error converting supplied value for source_cidrs: {e}"));
self
}
}
impl ::std::convert::TryFrom<AccountBinding> for super::AccountBinding {
type Error = super::error::ConversionError;
fn try_from(
value: AccountBinding,
) -> ::std::result::Result<Self, super::error::ConversionError> {
Ok(Self {
consumer: value.consumer?,
granted_at: value.granted_at?,
max_ttl_seconds: value.max_ttl_seconds?,
rate_per_minute: value.rate_per_minute?,
scope_ceiling: value.scope_ceiling?,
source_cidrs: value.source_cidrs?,
})
}
}
impl ::std::convert::From<super::AccountBinding> for AccountBinding {
fn from(value: super::AccountBinding) -> Self {
Self {
consumer: Ok(value.consumer),
granted_at: Ok(value.granted_at),
max_ttl_seconds: Ok(value.max_ttl_seconds),
rate_per_minute: Ok(value.rate_per_minute),
scope_ceiling: Ok(value.scope_ceiling),
source_cidrs: Ok(value.source_cidrs),
}
}
}
#[derive(Clone, Debug)]
pub struct AccountProbeReport {
at: ::std::result::Result<::chrono::DateTime<::chrono::offset::Utc>, ::std::string::String>,
complete: ::std::result::Result<bool, ::std::string::String>,
ok: ::std::result::Result<bool, ::std::string::String>,
steps: ::std::result::Result<
::std::vec::Vec<super::AccountProbeReportStepsItem>,
::std::string::String,
>,
}
impl ::std::default::Default for AccountProbeReport {
fn default() -> Self {
Self {
at: Err("no value supplied for at".to_string()),
complete: Err("no value supplied for complete".to_string()),
ok: Err("no value supplied for ok".to_string()),
steps: Err("no value supplied for steps".to_string()),
}
}
}
impl AccountProbeReport {
pub fn at<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::chrono::DateTime<::chrono::offset::Utc>>,
T::Error: ::std::fmt::Display,
{
self.at = value
.try_into()
.map_err(|e| format!("error converting supplied value for at: {e}"));
self
}
pub fn complete<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<bool>,
T::Error: ::std::fmt::Display,
{
self.complete = value
.try_into()
.map_err(|e| format!("error converting supplied value for complete: {e}"));
self
}
pub fn ok<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<bool>,
T::Error: ::std::fmt::Display,
{
self.ok = value
.try_into()
.map_err(|e| format!("error converting supplied value for ok: {e}"));
self
}
pub fn steps<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::vec::Vec<super::AccountProbeReportStepsItem>>,
T::Error: ::std::fmt::Display,
{
self.steps = value
.try_into()
.map_err(|e| format!("error converting supplied value for steps: {e}"));
self
}
}
impl ::std::convert::TryFrom<AccountProbeReport> for super::AccountProbeReport {
type Error = super::error::ConversionError;
fn try_from(
value: AccountProbeReport,
) -> ::std::result::Result<Self, super::error::ConversionError> {
Ok(Self {
at: value.at?,
complete: value.complete?,
ok: value.ok?,
steps: value.steps?,
})
}
}
impl ::std::convert::From<super::AccountProbeReport> for AccountProbeReport {
fn from(value: super::AccountProbeReport) -> Self {
Self {
at: Ok(value.at),
complete: Ok(value.complete),
ok: Ok(value.ok),
steps: Ok(value.steps),
}
}
}
#[derive(Clone, Debug)]
pub struct AccountProbeReportStepsItem {
duration_ms: ::std::result::Result<::std::option::Option<u64>, ::std::string::String>,
ok: ::std::result::Result<bool, ::std::string::String>,
provider_error: ::std::result::Result<
::std::option::Option<super::AccountProbeReportStepsItemProviderError>,
::std::string::String,
>,
provider_request_id: ::std::result::Result<
::std::option::Option<super::AccountProbeReportStepsItemProviderRequestId>,
::std::string::String,
>,
step: ::std::result::Result<super::AccountProbeStep, ::std::string::String>,
}
impl ::std::default::Default for AccountProbeReportStepsItem {
fn default() -> Self {
Self {
duration_ms: Ok(Default::default()),
ok: Err("no value supplied for ok".to_string()),
provider_error: Ok(Default::default()),
provider_request_id: Ok(Default::default()),
step: Err("no value supplied for step".to_string()),
}
}
}
impl AccountProbeReportStepsItem {
pub fn duration_ms<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<u64>>,
T::Error: ::std::fmt::Display,
{
self.duration_ms = value
.try_into()
.map_err(|e| format!("error converting supplied value for duration_ms: {e}"));
self
}
pub fn ok<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<bool>,
T::Error: ::std::fmt::Display,
{
self.ok = value
.try_into()
.map_err(|e| format!("error converting supplied value for ok: {e}"));
self
}
pub fn provider_error<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<
::std::option::Option<super::AccountProbeReportStepsItemProviderError>,
>,
T::Error: ::std::fmt::Display,
{
self.provider_error = value
.try_into()
.map_err(|e| format!("error converting supplied value for provider_error: {e}"));
self
}
pub fn provider_request_id<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<
::std::option::Option<super::AccountProbeReportStepsItemProviderRequestId>,
>,
T::Error: ::std::fmt::Display,
{
self.provider_request_id = value.try_into().map_err(|e| {
format!("error converting supplied value for provider_request_id: {e}")
});
self
}
pub fn step<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::AccountProbeStep>,
T::Error: ::std::fmt::Display,
{
self.step = value
.try_into()
.map_err(|e| format!("error converting supplied value for step: {e}"));
self
}
}
impl ::std::convert::TryFrom<AccountProbeReportStepsItem> for super::AccountProbeReportStepsItem {
type Error = super::error::ConversionError;
fn try_from(
value: AccountProbeReportStepsItem,
) -> ::std::result::Result<Self, super::error::ConversionError> {
Ok(Self {
duration_ms: value.duration_ms?,
ok: value.ok?,
provider_error: value.provider_error?,
provider_request_id: value.provider_request_id?,
step: value.step?,
})
}
}
impl ::std::convert::From<super::AccountProbeReportStepsItem> for AccountProbeReportStepsItem {
fn from(value: super::AccountProbeReportStepsItem) -> Self {
Self {
duration_ms: Ok(value.duration_ms),
ok: Ok(value.ok),
provider_error: Ok(value.provider_error),
provider_request_id: Ok(value.provider_request_id),
step: Ok(value.step),
}
}
}
#[derive(Clone, Debug)]
pub struct AccountPublicMaterial {
address: ::std::result::Result<
::std::option::Option<super::AccountPublicMaterialAddress>,
::std::string::String,
>,
algorithm:
::std::result::Result<super::AccountPublicMaterialAlgorithm, ::std::string::String>,
certificate_pem: ::std::result::Result<
::std::option::Option<super::AccountPublicMaterialCertificatePem>,
::std::string::String,
>,
key_fingerprint: ::std::result::Result<super::DigestMultibase, ::std::string::String>,
pending_key_fingerprint: ::std::result::Result<
::std::option::Option<super::DigestMultibase>,
::std::string::String,
>,
public_key_jwk: ::std::result::Result<
::std::option::Option<super::AccountPublicMaterialPublicKeyJwk>,
::std::string::String,
>,
}
impl ::std::default::Default for AccountPublicMaterial {
fn default() -> Self {
Self {
address: Ok(Default::default()),
algorithm: Err("no value supplied for algorithm".to_string()),
certificate_pem: Ok(Default::default()),
key_fingerprint: Err("no value supplied for key_fingerprint".to_string()),
pending_key_fingerprint: Ok(Default::default()),
public_key_jwk: Ok(Default::default()),
}
}
}
impl AccountPublicMaterial {
pub fn address<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<super::AccountPublicMaterialAddress>>,
T::Error: ::std::fmt::Display,
{
self.address = value
.try_into()
.map_err(|e| format!("error converting supplied value for address: {e}"));
self
}
pub fn algorithm<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::AccountPublicMaterialAlgorithm>,
T::Error: ::std::fmt::Display,
{
self.algorithm = value
.try_into()
.map_err(|e| format!("error converting supplied value for algorithm: {e}"));
self
}
pub fn certificate_pem<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<
::std::option::Option<super::AccountPublicMaterialCertificatePem>,
>,
T::Error: ::std::fmt::Display,
{
self.certificate_pem = value
.try_into()
.map_err(|e| format!("error converting supplied value for certificate_pem: {e}"));
self
}
pub fn key_fingerprint<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::DigestMultibase>,
T::Error: ::std::fmt::Display,
{
self.key_fingerprint = value
.try_into()
.map_err(|e| format!("error converting supplied value for key_fingerprint: {e}"));
self
}
pub fn pending_key_fingerprint<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<super::DigestMultibase>>,
T::Error: ::std::fmt::Display,
{
self.pending_key_fingerprint = value.try_into().map_err(|e| {
format!("error converting supplied value for pending_key_fingerprint: {e}")
});
self
}
pub fn public_key_jwk<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<
::std::option::Option<super::AccountPublicMaterialPublicKeyJwk>,
>,
T::Error: ::std::fmt::Display,
{
self.public_key_jwk = value
.try_into()
.map_err(|e| format!("error converting supplied value for public_key_jwk: {e}"));
self
}
}
impl ::std::convert::TryFrom<AccountPublicMaterial> for super::AccountPublicMaterial {
type Error = super::error::ConversionError;
fn try_from(
value: AccountPublicMaterial,
) -> ::std::result::Result<Self, super::error::ConversionError> {
Ok(Self {
address: value.address?,
algorithm: value.algorithm?,
certificate_pem: value.certificate_pem?,
key_fingerprint: value.key_fingerprint?,
pending_key_fingerprint: value.pending_key_fingerprint?,
public_key_jwk: value.public_key_jwk?,
})
}
}
impl ::std::convert::From<super::AccountPublicMaterial> for AccountPublicMaterial {
fn from(value: super::AccountPublicMaterial) -> Self {
Self {
address: Ok(value.address),
algorithm: Ok(value.algorithm),
certificate_pem: Ok(value.certificate_pem),
key_fingerprint: Ok(value.key_fingerprint),
pending_key_fingerprint: Ok(value.pending_key_fingerprint),
public_key_jwk: Ok(value.public_key_jwk),
}
}
}
#[derive(Clone, Debug)]
pub struct AccountPublicMaterialPublicKeyJwk {
alg: ::std::result::Result<
::std::option::Option<super::AccountPublicMaterialPublicKeyJwkAlg>,
::std::string::String,
>,
crv: ::std::result::Result<
::std::option::Option<super::AccountPublicMaterialPublicKeyJwkCrv>,
::std::string::String,
>,
e: ::std::result::Result<
::std::option::Option<super::AccountPublicMaterialPublicKeyJwkE>,
::std::string::String,
>,
kid: ::std::result::Result<
super::AccountPublicMaterialPublicKeyJwkKid,
::std::string::String,
>,
kty: ::std::result::Result<
super::AccountPublicMaterialPublicKeyJwkKty,
::std::string::String,
>,
n: ::std::result::Result<
::std::option::Option<super::AccountPublicMaterialPublicKeyJwkN>,
::std::string::String,
>,
use_: ::std::result::Result<
::std::option::Option<::std::string::String>,
::std::string::String,
>,
x: ::std::result::Result<
::std::option::Option<super::AccountPublicMaterialPublicKeyJwkX>,
::std::string::String,
>,
y: ::std::result::Result<
::std::option::Option<super::AccountPublicMaterialPublicKeyJwkY>,
::std::string::String,
>,
}
impl ::std::default::Default for AccountPublicMaterialPublicKeyJwk {
fn default() -> Self {
Self {
alg: Ok(Default::default()),
crv: Ok(Default::default()),
e: Ok(Default::default()),
kid: Err("no value supplied for kid".to_string()),
kty: Err("no value supplied for kty".to_string()),
n: Ok(Default::default()),
use_: Ok(Default::default()),
x: Ok(Default::default()),
y: Ok(Default::default()),
}
}
}
impl AccountPublicMaterialPublicKeyJwk {
pub fn alg<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<
::std::option::Option<super::AccountPublicMaterialPublicKeyJwkAlg>,
>,
T::Error: ::std::fmt::Display,
{
self.alg = value
.try_into()
.map_err(|e| format!("error converting supplied value for alg: {e}"));
self
}
pub fn crv<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<
::std::option::Option<super::AccountPublicMaterialPublicKeyJwkCrv>,
>,
T::Error: ::std::fmt::Display,
{
self.crv = value
.try_into()
.map_err(|e| format!("error converting supplied value for crv: {e}"));
self
}
pub fn e<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<
::std::option::Option<super::AccountPublicMaterialPublicKeyJwkE>,
>,
T::Error: ::std::fmt::Display,
{
self.e = value
.try_into()
.map_err(|e| format!("error converting supplied value for e: {e}"));
self
}
pub fn kid<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::AccountPublicMaterialPublicKeyJwkKid>,
T::Error: ::std::fmt::Display,
{
self.kid = value
.try_into()
.map_err(|e| format!("error converting supplied value for kid: {e}"));
self
}
pub fn kty<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::AccountPublicMaterialPublicKeyJwkKty>,
T::Error: ::std::fmt::Display,
{
self.kty = value
.try_into()
.map_err(|e| format!("error converting supplied value for kty: {e}"));
self
}
pub fn n<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<
::std::option::Option<super::AccountPublicMaterialPublicKeyJwkN>,
>,
T::Error: ::std::fmt::Display,
{
self.n = value
.try_into()
.map_err(|e| format!("error converting supplied value for n: {e}"));
self
}
pub fn use_<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<::std::string::String>>,
T::Error: ::std::fmt::Display,
{
self.use_ = value
.try_into()
.map_err(|e| format!("error converting supplied value for use_: {e}"));
self
}
pub fn x<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<
::std::option::Option<super::AccountPublicMaterialPublicKeyJwkX>,
>,
T::Error: ::std::fmt::Display,
{
self.x = value
.try_into()
.map_err(|e| format!("error converting supplied value for x: {e}"));
self
}
pub fn y<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<
::std::option::Option<super::AccountPublicMaterialPublicKeyJwkY>,
>,
T::Error: ::std::fmt::Display,
{
self.y = value
.try_into()
.map_err(|e| format!("error converting supplied value for y: {e}"));
self
}
}
impl ::std::convert::TryFrom<AccountPublicMaterialPublicKeyJwk>
for super::AccountPublicMaterialPublicKeyJwk
{
type Error = super::error::ConversionError;
fn try_from(
value: AccountPublicMaterialPublicKeyJwk,
) -> ::std::result::Result<Self, super::error::ConversionError> {
Ok(Self {
alg: value.alg?,
crv: value.crv?,
e: value.e?,
kid: value.kid?,
kty: value.kty?,
n: value.n?,
use_: value.use_?,
x: value.x?,
y: value.y?,
})
}
}
impl ::std::convert::From<super::AccountPublicMaterialPublicKeyJwk>
for AccountPublicMaterialPublicKeyJwk
{
fn from(value: super::AccountPublicMaterialPublicKeyJwk) -> Self {
Self {
alg: Ok(value.alg),
crv: Ok(value.crv),
e: Ok(value.e),
kid: Ok(value.kid),
kty: Ok(value.kty),
n: Ok(value.n),
use_: Ok(value.use_),
x: Ok(value.x),
y: Ok(value.y),
}
}
}
#[derive(Clone, Debug)]
pub struct AccountSecretInfo {
fingerprint: ::std::result::Result<super::SecretFingerprint, ::std::string::String>,
set_at:
::std::result::Result<::chrono::DateTime<::chrono::offset::Utc>, ::std::string::String>,
}
impl ::std::default::Default for AccountSecretInfo {
fn default() -> Self {
Self {
fingerprint: Err("no value supplied for fingerprint".to_string()),
set_at: Err("no value supplied for set_at".to_string()),
}
}
}
impl AccountSecretInfo {
pub fn fingerprint<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::SecretFingerprint>,
T::Error: ::std::fmt::Display,
{
self.fingerprint = value
.try_into()
.map_err(|e| format!("error converting supplied value for fingerprint: {e}"));
self
}
pub fn set_at<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::chrono::DateTime<::chrono::offset::Utc>>,
T::Error: ::std::fmt::Display,
{
self.set_at = value
.try_into()
.map_err(|e| format!("error converting supplied value for set_at: {e}"));
self
}
}
impl ::std::convert::TryFrom<AccountSecretInfo> for super::AccountSecretInfo {
type Error = super::error::ConversionError;
fn try_from(
value: AccountSecretInfo,
) -> ::std::result::Result<Self, super::error::ConversionError> {
Ok(Self {
fingerprint: value.fingerprint?,
set_at: value.set_at?,
})
}
}
impl ::std::convert::From<super::AccountSecretInfo> for AccountSecretInfo {
fn from(value: super::AccountSecretInfo) -> Self {
Self {
fingerprint: Ok(value.fingerprint),
set_at: Ok(value.set_at),
}
}
}
#[derive(Clone, Debug)]
pub struct AccountSettingsMaxCoinOutPerTxItem {
amount: ::std::result::Result<u64, ::std::string::String>,
coin_type: ::std::result::Result<
super::AccountSettingsMaxCoinOutPerTxItemCoinType,
::std::string::String,
>,
}
impl ::std::default::Default for AccountSettingsMaxCoinOutPerTxItem {
fn default() -> Self {
Self {
amount: Err("no value supplied for amount".to_string()),
coin_type: Err("no value supplied for coin_type".to_string()),
}
}
}
impl AccountSettingsMaxCoinOutPerTxItem {
pub fn amount<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<u64>,
T::Error: ::std::fmt::Display,
{
self.amount = value
.try_into()
.map_err(|e| format!("error converting supplied value for amount: {e}"));
self
}
pub fn coin_type<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::AccountSettingsMaxCoinOutPerTxItemCoinType>,
T::Error: ::std::fmt::Display,
{
self.coin_type = value
.try_into()
.map_err(|e| format!("error converting supplied value for coin_type: {e}"));
self
}
}
impl ::std::convert::TryFrom<AccountSettingsMaxCoinOutPerTxItem>
for super::AccountSettingsMaxCoinOutPerTxItem
{
type Error = super::error::ConversionError;
fn try_from(
value: AccountSettingsMaxCoinOutPerTxItem,
) -> ::std::result::Result<Self, super::error::ConversionError> {
Ok(Self {
amount: value.amount?,
coin_type: value.coin_type?,
})
}
}
impl ::std::convert::From<super::AccountSettingsMaxCoinOutPerTxItem>
for AccountSettingsMaxCoinOutPerTxItem
{
fn from(value: super::AccountSettingsMaxCoinOutPerTxItem) -> Self {
Self {
amount: Ok(value.amount),
coin_type: Ok(value.coin_type),
}
}
}
#[derive(Clone, Debug)]
pub struct CredentialScopeCeiling {
actions: ::std::result::Result<
::std::option::Option<Vec<super::ProviderObjectAction>>,
::std::string::String,
>,
prefixes: ::std::result::Result<
::std::option::Option<Vec<super::ProviderObjectPrefix>>,
::std::string::String,
>,
scopes: ::std::result::Result<
::std::option::Option<Vec<super::CredentialScopeCeilingScopesItem>>,
::std::string::String,
>,
}
impl ::std::default::Default for CredentialScopeCeiling {
fn default() -> Self {
Self {
actions: Ok(Default::default()),
prefixes: Ok(Default::default()),
scopes: Ok(Default::default()),
}
}
}
impl CredentialScopeCeiling {
pub fn actions<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<Vec<super::ProviderObjectAction>>>,
T::Error: ::std::fmt::Display,
{
self.actions = value
.try_into()
.map_err(|e| format!("error converting supplied value for actions: {e}"));
self
}
pub fn prefixes<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<Vec<super::ProviderObjectPrefix>>>,
T::Error: ::std::fmt::Display,
{
self.prefixes = value
.try_into()
.map_err(|e| format!("error converting supplied value for prefixes: {e}"));
self
}
pub fn scopes<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<
::std::option::Option<Vec<super::CredentialScopeCeilingScopesItem>>,
>,
T::Error: ::std::fmt::Display,
{
self.scopes = value
.try_into()
.map_err(|e| format!("error converting supplied value for scopes: {e}"));
self
}
}
impl ::std::convert::TryFrom<CredentialScopeCeiling> for super::CredentialScopeCeiling {
type Error = super::error::ConversionError;
fn try_from(
value: CredentialScopeCeiling,
) -> ::std::result::Result<Self, super::error::ConversionError> {
Ok(Self {
actions: value.actions?,
prefixes: value.prefixes?,
scopes: value.scopes?,
})
}
}
impl ::std::convert::From<super::CredentialScopeCeiling> for CredentialScopeCeiling {
fn from(value: super::CredentialScopeCeiling) -> Self {
Self {
actions: Ok(value.actions),
prefixes: Ok(value.prefixes),
scopes: Ok(value.scopes),
}
}
}
#[derive(Clone, Debug)]
pub struct ExternalAccount {
bindings:
::std::result::Result<::std::vec::Vec<super::AccountBinding>, ::std::string::String>,
context: ::std::result::Result<super::AccountContextId, ::std::string::String>,
created_at:
::std::result::Result<::chrono::DateTime<::chrono::offset::Utc>, ::std::string::String>,
egress_hosts: ::std::result::Result<
::std::vec::Vec<super::ExternalAccountEgressHostsItem>,
::std::string::String,
>,
id: ::std::result::Result<super::AccountId, ::std::string::String>,
label: ::std::result::Result<super::ExternalAccountLabel, ::std::string::String>,
last_probe: ::std::result::Result<
::std::option::Option<super::AccountProbeReport>,
::std::string::String,
>,
provider_setup_required: ::std::result::Result<bool, ::std::string::String>,
public_material: ::std::result::Result<
::std::option::Option<super::AccountPublicMaterial>,
::std::string::String,
>,
secret: ::std::result::Result<
::std::option::Option<super::AccountSecretInfo>,
::std::string::String,
>,
settings: ::std::result::Result<super::AccountSettings, ::std::string::String>,
state: ::std::result::Result<super::AccountState, ::std::string::String>,
updated_at:
::std::result::Result<::chrono::DateTime<::chrono::offset::Utc>, ::std::string::String>,
}
impl ::std::default::Default for ExternalAccount {
fn default() -> Self {
Self {
bindings: Err("no value supplied for bindings".to_string()),
context: Err("no value supplied for context".to_string()),
created_at: Err("no value supplied for created_at".to_string()),
egress_hosts: Err("no value supplied for egress_hosts".to_string()),
id: Err("no value supplied for id".to_string()),
label: Err("no value supplied for label".to_string()),
last_probe: Ok(Default::default()),
provider_setup_required: Err(
"no value supplied for provider_setup_required".to_string()
),
public_material: Ok(Default::default()),
secret: Ok(Default::default()),
settings: Err("no value supplied for settings".to_string()),
state: Err("no value supplied for state".to_string()),
updated_at: Err("no value supplied for updated_at".to_string()),
}
}
}
impl ExternalAccount {
pub fn bindings<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::vec::Vec<super::AccountBinding>>,
T::Error: ::std::fmt::Display,
{
self.bindings = value
.try_into()
.map_err(|e| format!("error converting supplied value for bindings: {e}"));
self
}
pub fn context<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::AccountContextId>,
T::Error: ::std::fmt::Display,
{
self.context = value
.try_into()
.map_err(|e| format!("error converting supplied value for context: {e}"));
self
}
pub fn created_at<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::chrono::DateTime<::chrono::offset::Utc>>,
T::Error: ::std::fmt::Display,
{
self.created_at = value
.try_into()
.map_err(|e| format!("error converting supplied value for created_at: {e}"));
self
}
pub fn egress_hosts<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::vec::Vec<super::ExternalAccountEgressHostsItem>>,
T::Error: ::std::fmt::Display,
{
self.egress_hosts = value
.try_into()
.map_err(|e| format!("error converting supplied value for egress_hosts: {e}"));
self
}
pub fn id<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::AccountId>,
T::Error: ::std::fmt::Display,
{
self.id = value
.try_into()
.map_err(|e| format!("error converting supplied value for id: {e}"));
self
}
pub fn label<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::ExternalAccountLabel>,
T::Error: ::std::fmt::Display,
{
self.label = value
.try_into()
.map_err(|e| format!("error converting supplied value for label: {e}"));
self
}
pub fn last_probe<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<super::AccountProbeReport>>,
T::Error: ::std::fmt::Display,
{
self.last_probe = value
.try_into()
.map_err(|e| format!("error converting supplied value for last_probe: {e}"));
self
}
pub fn provider_setup_required<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<bool>,
T::Error: ::std::fmt::Display,
{
self.provider_setup_required = value.try_into().map_err(|e| {
format!("error converting supplied value for provider_setup_required: {e}")
});
self
}
pub fn public_material<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<super::AccountPublicMaterial>>,
T::Error: ::std::fmt::Display,
{
self.public_material = value
.try_into()
.map_err(|e| format!("error converting supplied value for public_material: {e}"));
self
}
pub fn secret<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<super::AccountSecretInfo>>,
T::Error: ::std::fmt::Display,
{
self.secret = value
.try_into()
.map_err(|e| format!("error converting supplied value for secret: {e}"));
self
}
pub fn settings<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::AccountSettings>,
T::Error: ::std::fmt::Display,
{
self.settings = value
.try_into()
.map_err(|e| format!("error converting supplied value for settings: {e}"));
self
}
pub fn state<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::AccountState>,
T::Error: ::std::fmt::Display,
{
self.state = value
.try_into()
.map_err(|e| format!("error converting supplied value for state: {e}"));
self
}
pub fn updated_at<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::chrono::DateTime<::chrono::offset::Utc>>,
T::Error: ::std::fmt::Display,
{
self.updated_at = value
.try_into()
.map_err(|e| format!("error converting supplied value for updated_at: {e}"));
self
}
}
impl ::std::convert::TryFrom<ExternalAccount> for super::ExternalAccount {
type Error = super::error::ConversionError;
fn try_from(
value: ExternalAccount,
) -> ::std::result::Result<Self, super::error::ConversionError> {
Ok(Self {
bindings: value.bindings?,
context: value.context?,
created_at: value.created_at?,
egress_hosts: value.egress_hosts?,
id: value.id?,
label: value.label?,
last_probe: value.last_probe?,
provider_setup_required: value.provider_setup_required?,
public_material: value.public_material?,
secret: value.secret?,
settings: value.settings?,
state: value.state?,
updated_at: value.updated_at?,
})
}
}
impl ::std::convert::From<super::ExternalAccount> for ExternalAccount {
fn from(value: super::ExternalAccount) -> Self {
Self {
bindings: Ok(value.bindings),
context: Ok(value.context),
created_at: Ok(value.created_at),
egress_hosts: Ok(value.egress_hosts),
id: Ok(value.id),
label: Ok(value.label),
last_probe: Ok(value.last_probe),
provider_setup_required: Ok(value.provider_setup_required),
public_material: Ok(value.public_material),
secret: Ok(value.secret),
settings: Ok(value.settings),
state: Ok(value.state),
updated_at: Ok(value.updated_at),
}
}
}
#[derive(Clone, Debug)]
pub struct Payload {
context: ::std::result::Result<super::AccountContextId, ::std::string::String>,
ext: ::std::result::Result<::std::option::Option<super::Ext>, ::std::string::String>,
id: ::std::result::Result<super::AccountId, ::std::string::String>,
label: ::std::result::Result<super::PayloadLabel, ::std::string::String>,
settings: ::std::result::Result<super::AccountSettings, ::std::string::String>,
}
impl ::std::default::Default for Payload {
fn default() -> Self {
Self {
context: Err("no value supplied for context".to_string()),
ext: Ok(Default::default()),
id: Err("no value supplied for id".to_string()),
label: Err("no value supplied for label".to_string()),
settings: Err("no value supplied for settings".to_string()),
}
}
}
impl Payload {
pub fn context<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::AccountContextId>,
T::Error: ::std::fmt::Display,
{
self.context = value
.try_into()
.map_err(|e| format!("error converting supplied value for context: {e}"));
self
}
pub fn ext<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<super::Ext>>,
T::Error: ::std::fmt::Display,
{
self.ext = value
.try_into()
.map_err(|e| format!("error converting supplied value for ext: {e}"));
self
}
pub fn id<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::AccountId>,
T::Error: ::std::fmt::Display,
{
self.id = value
.try_into()
.map_err(|e| format!("error converting supplied value for id: {e}"));
self
}
pub fn label<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::PayloadLabel>,
T::Error: ::std::fmt::Display,
{
self.label = value
.try_into()
.map_err(|e| format!("error converting supplied value for label: {e}"));
self
}
pub fn settings<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::AccountSettings>,
T::Error: ::std::fmt::Display,
{
self.settings = value
.try_into()
.map_err(|e| format!("error converting supplied value for settings: {e}"));
self
}
}
impl ::std::convert::TryFrom<Payload> for super::Payload {
type Error = super::error::ConversionError;
fn try_from(value: Payload) -> ::std::result::Result<Self, super::error::ConversionError> {
Ok(Self {
context: value.context?,
ext: value.ext?,
id: value.id?,
label: value.label?,
settings: value.settings?,
})
}
}
impl ::std::convert::From<super::Payload> for Payload {
fn from(value: super::Payload) -> Self {
Self {
context: Ok(value.context),
ext: Ok(value.ext),
id: Ok(value.id),
label: Ok(value.label),
settings: Ok(value.settings),
}
}
}
#[derive(Clone, Debug)]
pub struct Response {
account: ::std::result::Result<super::ExternalAccount, ::std::string::String>,
ext: ::std::result::Result<::std::option::Option<super::Ext>, ::std::string::String>,
}
impl ::std::default::Default for Response {
fn default() -> Self {
Self {
account: Err("no value supplied for account".to_string()),
ext: Ok(Default::default()),
}
}
}
impl Response {
pub fn account<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::ExternalAccount>,
T::Error: ::std::fmt::Display,
{
self.account = value
.try_into()
.map_err(|e| format!("error converting supplied value for account: {e}"));
self
}
pub fn ext<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<super::Ext>>,
T::Error: ::std::fmt::Display,
{
self.ext = value
.try_into()
.map_err(|e| format!("error converting supplied value for ext: {e}"));
self
}
}
impl ::std::convert::TryFrom<Response> for super::Response {
type Error = super::error::ConversionError;
fn try_from(value: Response) -> ::std::result::Result<Self, super::error::ConversionError> {
Ok(Self {
account: value.account?,
ext: value.ext?,
})
}
}
impl ::std::convert::From<super::Response> for Response {
fn from(value: super::Response) -> Self {
Self {
account: Ok(value.account),
ext: Ok(value.ext),
}
}
}
#[derive(Clone, Debug)]
pub struct SuiMoveCall {
function: ::std::result::Result<super::SuiMoveCallFunction, ::std::string::String>,
module: ::std::result::Result<super::SuiMoveCallModule, ::std::string::String>,
package: ::std::result::Result<super::SuiMoveCallPackage, ::std::string::String>,
}
impl ::std::default::Default for SuiMoveCall {
fn default() -> Self {
Self {
function: Err("no value supplied for function".to_string()),
module: Err("no value supplied for module".to_string()),
package: Err("no value supplied for package".to_string()),
}
}
}
impl SuiMoveCall {
pub fn function<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::SuiMoveCallFunction>,
T::Error: ::std::fmt::Display,
{
self.function = value
.try_into()
.map_err(|e| format!("error converting supplied value for function: {e}"));
self
}
pub fn module<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::SuiMoveCallModule>,
T::Error: ::std::fmt::Display,
{
self.module = value
.try_into()
.map_err(|e| format!("error converting supplied value for module: {e}"));
self
}
pub fn package<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::SuiMoveCallPackage>,
T::Error: ::std::fmt::Display,
{
self.package = value
.try_into()
.map_err(|e| format!("error converting supplied value for package: {e}"));
self
}
}
impl ::std::convert::TryFrom<SuiMoveCall> for super::SuiMoveCall {
type Error = super::error::ConversionError;
fn try_from(
value: SuiMoveCall,
) -> ::std::result::Result<Self, super::error::ConversionError> {
Ok(Self {
function: value.function?,
module: value.module?,
package: value.package?,
})
}
}
impl ::std::convert::From<super::SuiMoveCall> for SuiMoveCall {
fn from(value: super::SuiMoveCall) -> Self {
Self {
function: Ok(value.function),
module: Ok(value.module),
package: Ok(value.package),
}
}
}
}
impl crate::Payload for Payload {
const TYPE_URI: &'static str = "https://trusttasks.org/spec/external/accounts/create/0.1";
const IS_PROOF_REQUIRED: bool = true;
const IS_ISSUED_AT_REQUIRED: bool = true;
const IS_RECIPIENT_REQUIRED: bool = true;
const PAYLOAD_SCHEMA: Option<&'static str> = Some(
"{\n \"$defs\": {\n \"AccountBinding\": {\n \"additionalProperties\": false,\n \"description\": \"Who may use an account, and how far. One binding per consumer per account. A binding is checked before anything is signed: the caller must be `consumer`, proven by the request's own proof; the request must sit inside `scopeCeiling`; its TTL must not exceed `maxTtlSeconds`; and the binding's rate must not be exhausted.\",\n \"properties\": {\n \"consumer\": {\n \"description\": \"The DID of the integration allowed to use the account.\",\n \"maxLength\": 2048,\n \"minLength\": 7,\n \"pattern\": \"^did:[a-z0-9]+:\\\\S+$\",\n \"type\": \"string\"\n },\n \"grantedAt\": {\n \"format\": \"date-time\",\n \"type\": \"string\"\n },\n \"maxTtlSeconds\": {\n \"description\": \"The longest credential lifetime the consumer may request. 900 (15 minutes) is RECOMMENDED; the ceiling is one hour.\",\n \"maximum\": 3600,\n \"minimum\": 60,\n \"type\": \"integer\"\n },\n \"ratePerMinute\": {\n \"description\": \"Issuances or signatures per minute for this binding.\",\n \"maximum\": 600,\n \"minimum\": 1,\n \"type\": \"integer\"\n },\n \"scopeCeiling\": {\n \"$ref\": \"#/$defs/CredentialScopeCeiling\",\n \"description\": \"Required for storage and OAuth models; absent for `sui-signer`, whose ceiling is the account's own allow-list and caps.\"\n },\n \"sourceCidrs\": {\n \"description\": \"Where the provider supports it (`aws:SourceIp`), issued credentials are pinned to these networks, so a credential lifted from the consumer is useless elsewhere.\",\n \"items\": {\n \"maxLength\": 49,\n \"pattern\": \"^[0-9a-fA-F:.]+/[0-9]{1,3}$\",\n \"type\": \"string\"\n },\n \"maxItems\": 16,\n \"type\": \"array\"\n }\n },\n \"required\": [\n \"consumer\",\n \"maxTtlSeconds\",\n \"ratePerMinute\"\n ],\n \"title\": \"AccountBinding\",\n \"type\": \"object\"\n },\n \"AccountContextId\": {\n \"description\": \"The custodian context that owns the account. Act scope in this context decides who may manage the account and who may consume it; the account's keys are derived in this context's key space.\",\n \"maxLength\": 256,\n \"minLength\": 1,\n \"title\": \"AccountContextId\",\n \"type\": \"string\"\n },\n \"AccountId\": {\n \"description\": \"The account's identifier within its context, chosen by whoever creates it. Lowercase letters, digits and hyphens, so that it can be embedded in a certificate subject, a token subject or a provider-side condition without escaping. Unique per context; never reused after deletion while anything that names it (a provider-side trust policy, an audit row) may still exist.\",\n \"maxLength\": 64,\n \"minLength\": 1,\n \"pattern\": \"^[a-z0-9][a-z0-9-]*$\",\n \"title\": \"AccountId\",\n \"type\": \"string\"\n },\n \"AccountProbeReport\": {\n \"additionalProperties\": false,\n \"properties\": {\n \"at\": {\n \"format\": \"date-time\",\n \"type\": \"string\"\n },\n \"complete\": {\n \"description\": \"True only when the canary steps (`put`, `get`, `delete`, or the model's equivalent) ran, so the account was exercised end to end. A probe that stopped after `exchange` because nothing named a canary prefix is `complete: false` even when `ok` is true, and does not clear `providerSetupRequired`.\",\n \"type\": \"boolean\"\n },\n \"ok\": {\n \"description\": \"True when every step that ran succeeded.\",\n \"type\": \"boolean\"\n },\n \"steps\": {\n \"description\": \"In order; the first failing step ends the probe.\",\n \"items\": {\n \"additionalProperties\": false,\n \"properties\": {\n \"durationMs\": {\n \"minimum\": 0,\n \"type\": \"integer\"\n },\n \"ok\": {\n \"type\": \"boolean\"\n },\n \"providerError\": {\n \"description\": \"The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.\",\n \"maxLength\": 2048,\n \"type\": \"string\"\n },\n \"providerRequestId\": {\n \"maxLength\": 256,\n \"pattern\": \"^[!-~]+$\",\n \"type\": \"string\"\n },\n \"step\": {\n \"$ref\": \"#/$defs/AccountProbeStep\"\n }\n },\n \"required\": [\n \"step\",\n \"ok\"\n ],\n \"type\": \"object\"\n },\n \"maxItems\": 8,\n \"type\": \"array\"\n }\n },\n \"required\": [\n \"at\",\n \"ok\",\n \"complete\",\n \"steps\"\n ],\n \"title\": \"AccountProbeReport\",\n \"type\": \"object\"\n },\n \"AccountProbeStep\": {\n \"description\": \"`sign`: the custodian signed its assertion, session request or test transaction. `exchange`: the provider issued a credential for it. `put`, `get`, `delete`: one canary object at the narrowest scope of the account's bindings. `decode`: for `sui-signer`, a built test transaction passed the allow-list (it is never submitted).\",\n \"enum\": [\n \"sign\",\n \"exchange\",\n \"put\",\n \"get\",\n \"delete\",\n \"decode\"\n ],\n \"title\": \"AccountProbeStep\",\n \"type\": \"string\"\n },\n \"AccountPublicMaterial\": {\n \"additionalProperties\": false,\n \"description\": \"The public half of the account's key, as the provider needs it. Never a private key.\",\n \"properties\": {\n \"address\": {\n \"description\": \"`sui-signer`: the Sui address the key controls.\",\n \"pattern\": \"^0x[0-9a-f]{64}$\",\n \"type\": \"string\"\n },\n \"algorithm\": {\n \"enum\": [\n \"ES256\",\n \"RS256\",\n \"Secp256r1\"\n ],\n \"type\": \"string\"\n },\n \"certificatePem\": {\n \"description\": \"`aws-roles-anywhere`: the trust anchor's CA certificate. `azure-cert`: the certificate uploaded to the app registration.\",\n \"maxLength\": 16384,\n \"pattern\": \"^-----BEGIN CERTIFICATE-----[A-Za-z0-9+/=\\\\r\\\\n]+-----END CERTIFICATE-----\\\\s*$\",\n \"type\": \"string\"\n },\n \"keyFingerprint\": {\n \"$ref\": \"#/$defs/DigestMultibase\",\n \"description\": \"Digest of the public key's SubjectPublicKeyInfo DER.\"\n },\n \"pendingKeyFingerprint\": {\n \"$ref\": \"#/$defs/DigestMultibase\",\n \"description\": \"During a rotation (external/accounts/keys/rotate), the staged successor key, until it is confirmed and the current key retires.\"\n },\n \"publicKeyJwk\": {\n \"additionalProperties\": false,\n \"description\": \"The public key as a JWK, with `kid`. Public members only: the schema admits no private member (`d`, `p`, `q`, `dp`, `dq`, `qi`), so a document carrying one fails validation.\",\n \"properties\": {\n \"alg\": {\n \"enum\": [\n \"ES256\",\n \"RS256\"\n ],\n \"type\": \"string\"\n },\n \"crv\": {\n \"enum\": [\n \"P-256\"\n ],\n \"type\": \"string\"\n },\n \"e\": {\n \"maxLength\": 16,\n \"pattern\": \"^[A-Za-z0-9_-]+$\",\n \"type\": \"string\"\n },\n \"kid\": {\n \"maxLength\": 128,\n \"pattern\": \"^[!-~]+$\",\n \"type\": \"string\"\n },\n \"kty\": {\n \"enum\": [\n \"EC\",\n \"RSA\"\n ],\n \"type\": \"string\"\n },\n \"n\": {\n \"maxLength\": 1024,\n \"pattern\": \"^[A-Za-z0-9_-]+$\",\n \"type\": \"string\"\n },\n \"use\": {\n \"const\": \"sig\",\n \"type\": \"string\"\n },\n \"x\": {\n \"maxLength\": 1024,\n \"pattern\": \"^[A-Za-z0-9_-]+$\",\n \"type\": \"string\"\n },\n \"y\": {\n \"maxLength\": 1024,\n \"pattern\": \"^[A-Za-z0-9_-]+$\",\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"kty\",\n \"kid\"\n ],\n \"type\": \"object\"\n }\n },\n \"required\": [\n \"algorithm\",\n \"keyFingerprint\"\n ],\n \"title\": \"AccountPublicMaterial\",\n \"type\": \"object\"\n },\n \"AccountSecretInfo\": {\n \"additionalProperties\": false,\n \"description\": \"That a static model's secret is set, and which one. Never its value.\",\n \"properties\": {\n \"fingerprint\": {\n \"$ref\": \"#/$defs/SecretFingerprint\"\n },\n \"setAt\": {\n \"format\": \"date-time\",\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"fingerprint\",\n \"setAt\"\n ],\n \"title\": \"AccountSecretInfo\",\n \"type\": \"object\"\n },\n \"AccountSettings\": {\n \"description\": \"Per-model account settings, discriminated by `model`: every branch is an object whose `model` member is a `const`, which is what lets each generated binding emit a tagged union, so an unusable setting is answered as `external:invalidSettings` naming the member rather than as an unparseable payload. Never a secret: every value here is returned to anyone who may read the account. Branches are referred to by their `model` (\\\"the `sui-signer` settings\\\"). They carry no `title`, so that every binding renders each as a plain variant of this union.\",\n \"oneOf\": [\n {\n \"additionalProperties\": false,\n \"description\": \"Egress: `rolesanywhere.<region>.amazonaws.com`, plus `sts.<region>.amazonaws.com` when `chainedRoleArn` is set.\",\n \"properties\": {\n \"bucket\": {\n \"$ref\": \"#/$defs/ProviderBucketName\",\n \"description\": \"The S3 bucket issuances are scoped within. Required for an account whose bindings issue storage scopes.\"\n },\n \"chainedRoleArn\": {\n \"$ref\": \"#/$defs/AwsArn\",\n \"description\": \"When set, every issuance chains an AssumeRole into this role carrying the downscoping session policy, for deployments whose Roles Anywhere profile cannot carry one per request. Caps a credential at one hour.\"\n },\n \"model\": {\n \"const\": \"aws-roles-anywhere\",\n \"type\": \"string\"\n },\n \"probePrefix\": {\n \"$ref\": \"#/$defs/ProviderObjectPrefix\",\n \"description\": \"Where external/accounts/probe writes its canary when no binding names a narrower prefix. Lets a new account be probed before anything is bound to it. Absent, a probe of an account with no bindings stops after `exchange` and reports `complete: false`.\"\n },\n \"profileArn\": {\n \"$ref\": \"#/$defs/AwsArn\"\n },\n \"region\": {\n \"$ref\": \"#/$defs/AwsRegion\"\n },\n \"roleArn\": {\n \"$ref\": \"#/$defs/AwsArn\"\n },\n \"trustAnchorArn\": {\n \"$ref\": \"#/$defs/AwsArn\",\n \"description\": \"The trust anchor holding the custodian's CA certificate. Recorded after the administrator creates it from external/accounts/setup.\"\n }\n },\n \"required\": [\n \"model\",\n \"region\",\n \"profileArn\",\n \"roleArn\",\n \"trustAnchorArn\"\n ],\n \"type\": \"object\"\n },\n {\n \"additionalProperties\": false,\n \"description\": \"Egress: `sts.googleapis.com`, plus `iamcredentials.googleapis.com` when `serviceAccount` is set.\",\n \"properties\": {\n \"bucket\": {\n \"$ref\": \"#/$defs/ProviderBucketName\",\n \"description\": \"The GCS bucket issuances are scoped within, by a Credential Access Boundary.\"\n },\n \"model\": {\n \"const\": \"gcp-wif-pinned\",\n \"type\": \"string\"\n },\n \"poolId\": {\n \"pattern\": \"^[a-z0-9-]{4,32}$\",\n \"type\": \"string\"\n },\n \"probePrefix\": {\n \"$ref\": \"#/$defs/ProviderObjectPrefix\",\n \"description\": \"Where external/accounts/probe writes its canary when no binding names a narrower prefix. Lets a new account be probed before anything is bound to it. Absent, a probe of an account with no bindings stops after `exchange` and reports `complete: false`.\"\n },\n \"projectNumber\": {\n \"pattern\": \"^[0-9]{1,20}$\",\n \"type\": \"string\"\n },\n \"providerId\": {\n \"pattern\": \"^[a-z0-9-]{4,32}$\",\n \"type\": \"string\"\n },\n \"serviceAccount\": {\n \"description\": \"When set, the federated token is exchanged for this service account's access token.\",\n \"maxLength\": 254,\n \"pattern\": \"^[a-z0-9-]+@[a-z0-9-]+\\\\.iam\\\\.gserviceaccount\\\\.com$\",\n \"type\": \"string\"\n },\n \"signingAlgorithm\": {\n \"description\": \"The ID-token algorithm. ES256 unless the provider refuses it. Absent means ES256.\",\n \"enum\": [\n \"ES256\",\n \"RS256\"\n ],\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"model\",\n \"projectNumber\",\n \"poolId\",\n \"providerId\"\n ],\n \"type\": \"object\"\n },\n {\n \"additionalProperties\": false,\n \"description\": \"Egress: `login.microsoftonline.com`, or the sovereign-cloud authority named in `authorityHost`.\",\n \"properties\": {\n \"authorityHost\": {\n \"description\": \"Absent means `login.microsoftonline.com`.\",\n \"maxLength\": 253,\n \"pattern\": \"^[a-z0-9.-]+$\",\n \"type\": \"string\"\n },\n \"clientId\": {\n \"pattern\": \"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$\",\n \"type\": \"string\"\n },\n \"model\": {\n \"const\": \"azure-cert\",\n \"type\": \"string\"\n },\n \"tenantId\": {\n \"pattern\": \"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$\",\n \"type\": \"string\"\n },\n \"tokenScope\": {\n \"description\": \"The `scope` requested at the token endpoint, such as `https://storage.azure.com/.default`.\",\n \"maxLength\": 512,\n \"pattern\": \"^[A-Za-z0-9:/._-]+$\",\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"model\",\n \"tenantId\",\n \"clientId\",\n \"tokenScope\"\n ],\n \"type\": \"object\"\n },\n {\n \"additionalProperties\": false,\n \"description\": \"Egress: the host of `tokenEndpoint`, and nothing else.\",\n \"properties\": {\n \"audience\": {\n \"description\": \"The assertion's `aud`. Absent means `tokenEndpoint`.\",\n \"maxLength\": 2048,\n \"pattern\": \"^[!-~]+$\",\n \"type\": \"string\"\n },\n \"clientId\": {\n \"maxLength\": 512,\n \"minLength\": 1,\n \"pattern\": \"^[!-~]+$\",\n \"type\": \"string\"\n },\n \"model\": {\n \"const\": \"oauth2-private-key-jwt\",\n \"type\": \"string\"\n },\n \"scopes\": {\n \"description\": \"The scopes a binding may request, the ceiling for every issuance.\",\n \"items\": {\n \"maxLength\": 256,\n \"pattern\": \"^[!#-\\\\[\\\\]-~]+$\",\n \"type\": \"string\"\n },\n \"maxItems\": 64,\n \"type\": \"array\",\n \"uniqueItems\": true\n },\n \"signingAlgorithm\": {\n \"enum\": [\n \"ES256\",\n \"RS256\"\n ],\n \"type\": \"string\"\n },\n \"tokenEndpoint\": {\n \"$ref\": \"#/$defs/ProviderHttpsUrl\"\n }\n },\n \"required\": [\n \"model\",\n \"tokenEndpoint\",\n \"clientId\"\n ],\n \"type\": \"object\"\n },\n {\n \"additionalProperties\": false,\n \"description\": \"Issuance needs no egress: presigning is a computation inside the custodian, and the consumer uses the URL itself. The probe connects to the host of `endpoint`, which `egressHosts` therefore lists.\",\n \"properties\": {\n \"accessKeyId\": {\n \"description\": \"The access key's identifier. Not a secret: it appears in every presigned URL. The secret half is set with external/accounts/secret/set and never returned.\",\n \"maxLength\": 128,\n \"pattern\": \"^[A-Za-z0-9]+$\",\n \"type\": \"string\"\n },\n \"bucket\": {\n \"$ref\": \"#/$defs/ProviderBucketName\"\n },\n \"endpoint\": {\n \"$ref\": \"#/$defs/ProviderHttpsUrl\"\n },\n \"model\": {\n \"const\": \"s3-static-presign\",\n \"type\": \"string\"\n },\n \"pathStyle\": {\n \"description\": \"Address the bucket in the path rather than the host name, as MinIO usually needs.\",\n \"type\": \"boolean\"\n },\n \"probePrefix\": {\n \"$ref\": \"#/$defs/ProviderObjectPrefix\",\n \"description\": \"Where external/accounts/probe writes its canary when no binding names a narrower prefix. Lets a new account be probed before anything is bound to it. Absent, a probe of an account with no bindings stops after `exchange` and reports `complete: false`.\"\n },\n \"region\": {\n \"description\": \"The SigV4 signing region; `auto` for Cloudflare R2.\",\n \"maxLength\": 64,\n \"pattern\": \"^[a-z0-9-]+$\",\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"model\",\n \"endpoint\",\n \"region\",\n \"bucket\",\n \"accessKeyId\"\n ],\n \"type\": \"object\"\n },\n {\n \"additionalProperties\": false,\n \"description\": \"No egress: the custodian signs and the consumer submits the transaction. The allow-list, the gas caps and the coin caps are the account's whole authority; a transaction outside them is refused before anything is signed.\",\n \"properties\": {\n \"allowedCalls\": {\n \"description\": \"Every MoveCall command in a signed transaction must name one of these. For Walrus storage: the system package's `register_blob`, `certify_blob`, `extend_blob` and `delete_blob`, and the coin calls needed to pay for them.\",\n \"items\": {\n \"$ref\": \"#/$defs/SuiMoveCall\"\n },\n \"maxItems\": 32,\n \"minItems\": 1,\n \"type\": \"array\"\n },\n \"allowedObjects\": {\n \"description\": \"Shared objects a transaction may take as input, such as the Walrus system and staking objects. Absent means any object the allowed calls accept.\",\n \"items\": {\n \"pattern\": \"^0x[0-9a-f]{64}$\",\n \"type\": \"string\"\n },\n \"maxItems\": 32,\n \"type\": \"array\"\n },\n \"maxCoinOutPerTx\": {\n \"description\": \"Per coin type, the most a single transaction may spend or transfer out of the account's address, in the coin's smallest unit. A coin type not listed may not leave the address at all.\",\n \"items\": {\n \"additionalProperties\": false,\n \"properties\": {\n \"amount\": {\n \"minimum\": 0,\n \"type\": \"integer\"\n },\n \"coinType\": {\n \"maxLength\": 512,\n \"pattern\": \"^0x[0-9a-f]{1,64}::[A-Za-z0-9_]+::[A-Za-z0-9_]+$\",\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"coinType\",\n \"amount\"\n ],\n \"type\": \"object\"\n },\n \"maxItems\": 8,\n \"type\": \"array\"\n },\n \"maxGasBudgetMist\": {\n \"description\": \"The largest gas budget one transaction may declare.\",\n \"minimum\": 1,\n \"type\": \"integer\"\n },\n \"maxGasPerDayMist\": {\n \"description\": \"The total gas budget signed per rolling 24 hours.\",\n \"minimum\": 1,\n \"type\": \"integer\"\n },\n \"model\": {\n \"const\": \"sui-signer\",\n \"type\": \"string\"\n },\n \"network\": {\n \"enum\": [\n \"mainnet\",\n \"testnet\",\n \"devnet\"\n ],\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"model\",\n \"network\",\n \"allowedCalls\",\n \"maxGasBudgetMist\",\n \"maxGasPerDayMist\"\n ],\n \"type\": \"object\"\n },\n {\n \"additionalProperties\": false,\n \"description\": \"Egress: the host of `baseUrl`. The secret is set with external/accounts/secret/set and used only inside the custodian by `driver`; a provider reachable only by handing the consumer the raw key is not supported.\",\n \"properties\": {\n \"baseUrl\": {\n \"$ref\": \"#/$defs/ProviderHttpsUrl\"\n },\n \"driver\": {\n \"description\": \"The custodian's driver that uses the secret: performs a login or token exchange and returns a short-lived result. A custodian refuses a driver it does not implement.\",\n \"maxLength\": 64,\n \"pattern\": \"^[a-z0-9][a-z0-9-]*$\",\n \"type\": \"string\"\n },\n \"model\": {\n \"const\": \"static-secret\",\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"model\",\n \"driver\",\n \"baseUrl\"\n ],\n \"type\": \"object\"\n }\n ],\n \"title\": \"AccountSettings\"\n },\n \"AccountState\": {\n \"description\": \"`active`: usable by its bindings. `suspended`: every issuance and signature is refused at once; management reads continue; resumable. `archived`: hidden from default listings, refused for use, restorable. Deletion removes the record.\",\n \"enum\": [\n \"active\",\n \"suspended\",\n \"archived\"\n ],\n \"title\": \"AccountState\",\n \"type\": \"string\"\n },\n \"AwsArn\": {\n \"maxLength\": 2048,\n \"pattern\": \"^arn:aws[a-z-]*:[a-z0-9-]+:[a-z0-9-]*:[0-9]{0,12}:[A-Za-z0-9+=,.@_/:-]+$\",\n \"title\": \"AwsArn\",\n \"type\": \"string\"\n },\n \"AwsRegion\": {\n \"maxLength\": 32,\n \"pattern\": \"^[a-z]{2}(-gov)?-[a-z]+-[0-9]$\",\n \"title\": \"AwsRegion\",\n \"type\": \"string\"\n },\n \"CredentialScopeCeiling\": {\n \"additionalProperties\": false,\n \"description\": \"The widest scope a binding's consumer may request. An issuance is inside the ceiling when its `prefix` begins with one of `prefixes`, every one of its `actions` is in `actions`, and every one of its `scopes` is in `scopes`. Absent members confer nothing: a ceiling with no `prefixes` permits no storage issuance.\",\n \"properties\": {\n \"actions\": {\n \"items\": {\n \"$ref\": \"#/$defs/ProviderObjectAction\"\n },\n \"maxItems\": 3,\n \"minItems\": 1,\n \"type\": \"array\",\n \"uniqueItems\": true\n },\n \"prefixes\": {\n \"items\": {\n \"$ref\": \"#/$defs/ProviderObjectPrefix\"\n },\n \"maxItems\": 64,\n \"minItems\": 1,\n \"type\": \"array\",\n \"uniqueItems\": true\n },\n \"scopes\": {\n \"items\": {\n \"maxLength\": 256,\n \"pattern\": \"^[!#-\\\\[\\\\]-~]+$\",\n \"type\": \"string\"\n },\n \"maxItems\": 64,\n \"type\": \"array\",\n \"uniqueItems\": true\n }\n },\n \"title\": \"CredentialScopeCeiling\",\n \"type\": \"object\"\n },\n \"DigestMultibase\": {\n \"description\": \"A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.\\n\\nMultihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.\\n\\nThis definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.\\n\\nRestricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that \\\"interoperability is not guaranteed between implementations using such values\\\", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.\",\n \"examples\": [\n \"zQmbWqxBEKC3P8tqsKc98xmWNzrzDtRLMiMPL8wBuTGsMnR\"\n ],\n \"minLength\": 16,\n \"pattern\": \"^(z[1-9A-HJ-NP-Za-km-z]+|u[A-Za-z0-9_-]+)$\",\n \"title\": \"DigestMultibase\",\n \"type\": \"string\"\n },\n \"Ext\": {\n \"additionalProperties\": true,\n \"description\": \"Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.\",\n \"minProperties\": 1,\n \"propertyNames\": {\n \"pattern\": \"^[a-z][a-z0-9-]*(\\\\.[a-z0-9-]+)+$\"\n },\n \"title\": \"Ext\",\n \"type\": \"object\"\n },\n \"ExternalAccount\": {\n \"additionalProperties\": false,\n \"description\": \"An account as every read returns it. Contains no private key, no secret and no issued credential, to any reader.\",\n \"properties\": {\n \"bindings\": {\n \"items\": {\n \"$ref\": \"#/$defs/AccountBinding\"\n },\n \"maxItems\": 256,\n \"type\": \"array\"\n },\n \"context\": {\n \"$ref\": \"#/$defs/AccountContextId\"\n },\n \"createdAt\": {\n \"format\": \"date-time\",\n \"type\": \"string\"\n },\n \"egressHosts\": {\n \"description\": \"The provider hosts the custodian connects to on this account's behalf, derived by the custodian from its settings: the token or session endpoints issuance uses, and the destinations external/accounts/probe dials (the object store's host, for a storage model). The custodian MUST NOT connect anywhere else on the account's behalf, so an egress proxy can allow exactly this set. Empty only for a model that neither exchanges nor probes over the network.\",\n \"items\": {\n \"maxLength\": 253,\n \"pattern\": \"^[a-z0-9.-]+$\",\n \"type\": \"string\"\n },\n \"maxItems\": 8,\n \"type\": \"array\"\n },\n \"id\": {\n \"$ref\": \"#/$defs/AccountId\"\n },\n \"label\": {\n \"description\": \"Display name. Untrusted text: render it, never interpret it.\",\n \"maxLength\": 128,\n \"minLength\": 1,\n \"type\": \"string\"\n },\n \"lastProbe\": {\n \"$ref\": \"#/$defs/AccountProbeReport\"\n },\n \"providerSetupRequired\": {\n \"description\": \"True when the account cannot be used until its provider-side setup is redone: after a restore that could not carry its key or secret (a wrapped RSA key, a static secret), or after a rotation awaiting confirmation.\",\n \"type\": \"boolean\"\n },\n \"publicMaterial\": {\n \"$ref\": \"#/$defs/AccountPublicMaterial\",\n \"description\": \"Absent for the static models, which hold a secret rather than a key.\"\n },\n \"secret\": {\n \"$ref\": \"#/$defs/AccountSecretInfo\",\n \"description\": \"Static models only; absent until the secret is set.\"\n },\n \"settings\": {\n \"$ref\": \"#/$defs/AccountSettings\"\n },\n \"state\": {\n \"$ref\": \"#/$defs/AccountState\"\n },\n \"updatedAt\": {\n \"format\": \"date-time\",\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"id\",\n \"label\",\n \"context\",\n \"settings\",\n \"state\",\n \"bindings\",\n \"egressHosts\",\n \"providerSetupRequired\",\n \"createdAt\",\n \"updatedAt\"\n ],\n \"title\": \"ExternalAccount\",\n \"type\": \"object\"\n },\n \"ProviderBucketName\": {\n \"description\": \"A bucket name as S3 and GCS accept it. Validated rather than free so that it can be placed in a provider policy without escaping.\",\n \"maxLength\": 63,\n \"minLength\": 3,\n \"pattern\": \"^[a-z0-9][a-z0-9.-]*[a-z0-9]$\",\n \"title\": \"ProviderBucketName\",\n \"type\": \"string\"\n },\n \"ProviderHttpsUrl\": {\n \"format\": \"uri\",\n \"maxLength\": 2048,\n \"pattern\": \"^https://[^\\\\s\\\"'\\\\\\\\]+$\",\n \"title\": \"ProviderHttpsUrl\",\n \"type\": \"string\"\n },\n \"ProviderObjectAction\": {\n \"description\": \"`put`: write an object. `get`: read one. `delete`: remove one. No list, ACL, policy or bucket-level action exists here, so none can be granted.\",\n \"enum\": [\n \"put\",\n \"get\",\n \"delete\"\n ],\n \"title\": \"ProviderObjectAction\",\n \"type\": \"string\"\n },\n \"ProviderObjectPrefix\": {\n \"description\": \"An object-key prefix within the account's bucket: one or more segments of lowercase letters, digits, `.`, `_` and `-`, each beginning with a letter or digit and ending with `/`. No quote, backslash, wildcard, whitespace, `..` segment or empty segment can appear. That is deliberate: the custodian places this value inside a provider policy — an IAM session policy (JSON), a GCS Credential Access Boundary condition (CEL) — and a value able to carry a metacharacter can break out of the string it is placed in and widen the policy. That is a known class of defect (CVE-2026-42811, a CEL injection in downscoped GCS credentials). Even with this pattern, a custodian MUST build provider policies with the provider language's own encoder, never by string interpolation.\",\n \"maxLength\": 512,\n \"minLength\": 2,\n \"pattern\": \"^([a-z0-9][a-z0-9._-]{0,127}/){1,16}$\",\n \"title\": \"ProviderObjectPrefix\",\n \"type\": \"string\"\n },\n \"Response\": {\n \"$anchor\": \"response\",\n \"additionalProperties\": false,\n \"properties\": {\n \"account\": {\n \"$ref\": \"#/$defs/ExternalAccount\"\n },\n \"ext\": {\n \"$ref\": \"#/$defs/Ext\"\n }\n },\n \"required\": [\n \"account\"\n ],\n \"title\": \"External Accounts — Create — response payload\",\n \"type\": \"object\"\n },\n \"SecretFingerprint\": {\n \"description\": \"Which secret is set, without being a way to test guesses at it. `hmacsha256:` followed by the base64url encoding, without padding, of the first 16 bytes of HMAC-SHA256 over the secret's bytes under a fingerprint key the custodian holds and never discloses. Comparable only between fingerprints made by the same custodian: a re-entered value can be confirmed, while the same secret at two custodians gives unrelated fingerprints. Never a bare hash of the secret, which would let anyone who reads it run a dictionary against it offline; and deliberately not a DigestMultibase, since multihash has no code for a keyed digest.\",\n \"maxLength\": 33,\n \"pattern\": \"^hmacsha256:[A-Za-z0-9_-]{22}$\",\n \"title\": \"SecretFingerprint\",\n \"type\": \"string\"\n },\n \"SuiMoveCall\": {\n \"additionalProperties\": false,\n \"description\": \"One Move function an account's transactions may call.\",\n \"properties\": {\n \"function\": {\n \"pattern\": \"^[A-Za-z][A-Za-z0-9_]{0,127}$\",\n \"type\": \"string\"\n },\n \"module\": {\n \"pattern\": \"^[A-Za-z][A-Za-z0-9_]{0,127}$\",\n \"type\": \"string\"\n },\n \"package\": {\n \"pattern\": \"^0x[0-9a-f]{64}$\",\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"package\",\n \"module\",\n \"function\"\n ],\n \"title\": \"SuiMoveCall\",\n \"type\": \"object\"\n }\n },\n \"$id\": \"https://trusttasks.org/spec/external/accounts/create/0.1\",\n \"$schema\": \"https://json-schema.org/draft/2020-12/schema\",\n \"additionalProperties\": false,\n \"description\": \"Create an external account; the custodian generates its key. The outer document members are owned by the framework — SPEC §6.3.\",\n \"properties\": {\n \"context\": {\n \"$ref\": \"#/$defs/AccountContextId\"\n },\n \"ext\": {\n \"$ref\": \"#/$defs/Ext\"\n },\n \"id\": {\n \"$ref\": \"#/$defs/AccountId\"\n },\n \"label\": {\n \"description\": \"Display name.\",\n \"maxLength\": 128,\n \"minLength\": 1,\n \"type\": \"string\"\n },\n \"settings\": {\n \"$ref\": \"#/$defs/AccountSettings\"\n }\n },\n \"required\": [\n \"context\",\n \"id\",\n \"label\",\n \"settings\"\n ],\n \"title\": \"External Accounts — Create — payload\",\n \"type\": \"object\"\n}\n",
);
}
impl crate::Payload for Response {
const TYPE_URI: &'static str =
"https://trusttasks.org/spec/external/accounts/create/0.1#response";
const IS_PROOF_REQUIRED: bool = true;
const IS_ISSUED_AT_REQUIRED: bool = true;
const IS_RECIPIENT_REQUIRED: bool = true;
const PAYLOAD_SCHEMA: Option<&'static str> = Some(
"{\n \"$defs\": {\n \"AccountBinding\": {\n \"additionalProperties\": false,\n \"description\": \"Who may use an account, and how far. One binding per consumer per account. A binding is checked before anything is signed: the caller must be `consumer`, proven by the request's own proof; the request must sit inside `scopeCeiling`; its TTL must not exceed `maxTtlSeconds`; and the binding's rate must not be exhausted.\",\n \"properties\": {\n \"consumer\": {\n \"description\": \"The DID of the integration allowed to use the account.\",\n \"maxLength\": 2048,\n \"minLength\": 7,\n \"pattern\": \"^did:[a-z0-9]+:\\\\S+$\",\n \"type\": \"string\"\n },\n \"grantedAt\": {\n \"format\": \"date-time\",\n \"type\": \"string\"\n },\n \"maxTtlSeconds\": {\n \"description\": \"The longest credential lifetime the consumer may request. 900 (15 minutes) is RECOMMENDED; the ceiling is one hour.\",\n \"maximum\": 3600,\n \"minimum\": 60,\n \"type\": \"integer\"\n },\n \"ratePerMinute\": {\n \"description\": \"Issuances or signatures per minute for this binding.\",\n \"maximum\": 600,\n \"minimum\": 1,\n \"type\": \"integer\"\n },\n \"scopeCeiling\": {\n \"$ref\": \"#/$defs/CredentialScopeCeiling\",\n \"description\": \"Required for storage and OAuth models; absent for `sui-signer`, whose ceiling is the account's own allow-list and caps.\"\n },\n \"sourceCidrs\": {\n \"description\": \"Where the provider supports it (`aws:SourceIp`), issued credentials are pinned to these networks, so a credential lifted from the consumer is useless elsewhere.\",\n \"items\": {\n \"maxLength\": 49,\n \"pattern\": \"^[0-9a-fA-F:.]+/[0-9]{1,3}$\",\n \"type\": \"string\"\n },\n \"maxItems\": 16,\n \"type\": \"array\"\n }\n },\n \"required\": [\n \"consumer\",\n \"maxTtlSeconds\",\n \"ratePerMinute\"\n ],\n \"title\": \"AccountBinding\",\n \"type\": \"object\"\n },\n \"AccountContextId\": {\n \"description\": \"The custodian context that owns the account. Act scope in this context decides who may manage the account and who may consume it; the account's keys are derived in this context's key space.\",\n \"maxLength\": 256,\n \"minLength\": 1,\n \"title\": \"AccountContextId\",\n \"type\": \"string\"\n },\n \"AccountId\": {\n \"description\": \"The account's identifier within its context, chosen by whoever creates it. Lowercase letters, digits and hyphens, so that it can be embedded in a certificate subject, a token subject or a provider-side condition without escaping. Unique per context; never reused after deletion while anything that names it (a provider-side trust policy, an audit row) may still exist.\",\n \"maxLength\": 64,\n \"minLength\": 1,\n \"pattern\": \"^[a-z0-9][a-z0-9-]*$\",\n \"title\": \"AccountId\",\n \"type\": \"string\"\n },\n \"AccountProbeReport\": {\n \"additionalProperties\": false,\n \"properties\": {\n \"at\": {\n \"format\": \"date-time\",\n \"type\": \"string\"\n },\n \"complete\": {\n \"description\": \"True only when the canary steps (`put`, `get`, `delete`, or the model's equivalent) ran, so the account was exercised end to end. A probe that stopped after `exchange` because nothing named a canary prefix is `complete: false` even when `ok` is true, and does not clear `providerSetupRequired`.\",\n \"type\": \"boolean\"\n },\n \"ok\": {\n \"description\": \"True when every step that ran succeeded.\",\n \"type\": \"boolean\"\n },\n \"steps\": {\n \"description\": \"In order; the first failing step ends the probe.\",\n \"items\": {\n \"additionalProperties\": false,\n \"properties\": {\n \"durationMs\": {\n \"minimum\": 0,\n \"type\": \"integer\"\n },\n \"ok\": {\n \"type\": \"boolean\"\n },\n \"providerError\": {\n \"description\": \"The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.\",\n \"maxLength\": 2048,\n \"type\": \"string\"\n },\n \"providerRequestId\": {\n \"maxLength\": 256,\n \"pattern\": \"^[!-~]+$\",\n \"type\": \"string\"\n },\n \"step\": {\n \"$ref\": \"#/$defs/AccountProbeStep\"\n }\n },\n \"required\": [\n \"step\",\n \"ok\"\n ],\n \"type\": \"object\"\n },\n \"maxItems\": 8,\n \"type\": \"array\"\n }\n },\n \"required\": [\n \"at\",\n \"ok\",\n \"complete\",\n \"steps\"\n ],\n \"title\": \"AccountProbeReport\",\n \"type\": \"object\"\n },\n \"AccountProbeStep\": {\n \"description\": \"`sign`: the custodian signed its assertion, session request or test transaction. `exchange`: the provider issued a credential for it. `put`, `get`, `delete`: one canary object at the narrowest scope of the account's bindings. `decode`: for `sui-signer`, a built test transaction passed the allow-list (it is never submitted).\",\n \"enum\": [\n \"sign\",\n \"exchange\",\n \"put\",\n \"get\",\n \"delete\",\n \"decode\"\n ],\n \"title\": \"AccountProbeStep\",\n \"type\": \"string\"\n },\n \"AccountPublicMaterial\": {\n \"additionalProperties\": false,\n \"description\": \"The public half of the account's key, as the provider needs it. Never a private key.\",\n \"properties\": {\n \"address\": {\n \"description\": \"`sui-signer`: the Sui address the key controls.\",\n \"pattern\": \"^0x[0-9a-f]{64}$\",\n \"type\": \"string\"\n },\n \"algorithm\": {\n \"enum\": [\n \"ES256\",\n \"RS256\",\n \"Secp256r1\"\n ],\n \"type\": \"string\"\n },\n \"certificatePem\": {\n \"description\": \"`aws-roles-anywhere`: the trust anchor's CA certificate. `azure-cert`: the certificate uploaded to the app registration.\",\n \"maxLength\": 16384,\n \"pattern\": \"^-----BEGIN CERTIFICATE-----[A-Za-z0-9+/=\\\\r\\\\n]+-----END CERTIFICATE-----\\\\s*$\",\n \"type\": \"string\"\n },\n \"keyFingerprint\": {\n \"$ref\": \"#/$defs/DigestMultibase\",\n \"description\": \"Digest of the public key's SubjectPublicKeyInfo DER.\"\n },\n \"pendingKeyFingerprint\": {\n \"$ref\": \"#/$defs/DigestMultibase\",\n \"description\": \"During a rotation (external/accounts/keys/rotate), the staged successor key, until it is confirmed and the current key retires.\"\n },\n \"publicKeyJwk\": {\n \"additionalProperties\": false,\n \"description\": \"The public key as a JWK, with `kid`. Public members only: the schema admits no private member (`d`, `p`, `q`, `dp`, `dq`, `qi`), so a document carrying one fails validation.\",\n \"properties\": {\n \"alg\": {\n \"enum\": [\n \"ES256\",\n \"RS256\"\n ],\n \"type\": \"string\"\n },\n \"crv\": {\n \"enum\": [\n \"P-256\"\n ],\n \"type\": \"string\"\n },\n \"e\": {\n \"maxLength\": 16,\n \"pattern\": \"^[A-Za-z0-9_-]+$\",\n \"type\": \"string\"\n },\n \"kid\": {\n \"maxLength\": 128,\n \"pattern\": \"^[!-~]+$\",\n \"type\": \"string\"\n },\n \"kty\": {\n \"enum\": [\n \"EC\",\n \"RSA\"\n ],\n \"type\": \"string\"\n },\n \"n\": {\n \"maxLength\": 1024,\n \"pattern\": \"^[A-Za-z0-9_-]+$\",\n \"type\": \"string\"\n },\n \"use\": {\n \"const\": \"sig\",\n \"type\": \"string\"\n },\n \"x\": {\n \"maxLength\": 1024,\n \"pattern\": \"^[A-Za-z0-9_-]+$\",\n \"type\": \"string\"\n },\n \"y\": {\n \"maxLength\": 1024,\n \"pattern\": \"^[A-Za-z0-9_-]+$\",\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"kty\",\n \"kid\"\n ],\n \"type\": \"object\"\n }\n },\n \"required\": [\n \"algorithm\",\n \"keyFingerprint\"\n ],\n \"title\": \"AccountPublicMaterial\",\n \"type\": \"object\"\n },\n \"AccountSecretInfo\": {\n \"additionalProperties\": false,\n \"description\": \"That a static model's secret is set, and which one. Never its value.\",\n \"properties\": {\n \"fingerprint\": {\n \"$ref\": \"#/$defs/SecretFingerprint\"\n },\n \"setAt\": {\n \"format\": \"date-time\",\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"fingerprint\",\n \"setAt\"\n ],\n \"title\": \"AccountSecretInfo\",\n \"type\": \"object\"\n },\n \"AccountSettings\": {\n \"description\": \"Per-model account settings, discriminated by `model`: every branch is an object whose `model` member is a `const`, which is what lets each generated binding emit a tagged union, so an unusable setting is answered as `external:invalidSettings` naming the member rather than as an unparseable payload. Never a secret: every value here is returned to anyone who may read the account. Branches are referred to by their `model` (\\\"the `sui-signer` settings\\\"). They carry no `title`, so that every binding renders each as a plain variant of this union.\",\n \"oneOf\": [\n {\n \"additionalProperties\": false,\n \"description\": \"Egress: `rolesanywhere.<region>.amazonaws.com`, plus `sts.<region>.amazonaws.com` when `chainedRoleArn` is set.\",\n \"properties\": {\n \"bucket\": {\n \"$ref\": \"#/$defs/ProviderBucketName\",\n \"description\": \"The S3 bucket issuances are scoped within. Required for an account whose bindings issue storage scopes.\"\n },\n \"chainedRoleArn\": {\n \"$ref\": \"#/$defs/AwsArn\",\n \"description\": \"When set, every issuance chains an AssumeRole into this role carrying the downscoping session policy, for deployments whose Roles Anywhere profile cannot carry one per request. Caps a credential at one hour.\"\n },\n \"model\": {\n \"const\": \"aws-roles-anywhere\",\n \"type\": \"string\"\n },\n \"probePrefix\": {\n \"$ref\": \"#/$defs/ProviderObjectPrefix\",\n \"description\": \"Where external/accounts/probe writes its canary when no binding names a narrower prefix. Lets a new account be probed before anything is bound to it. Absent, a probe of an account with no bindings stops after `exchange` and reports `complete: false`.\"\n },\n \"profileArn\": {\n \"$ref\": \"#/$defs/AwsArn\"\n },\n \"region\": {\n \"$ref\": \"#/$defs/AwsRegion\"\n },\n \"roleArn\": {\n \"$ref\": \"#/$defs/AwsArn\"\n },\n \"trustAnchorArn\": {\n \"$ref\": \"#/$defs/AwsArn\",\n \"description\": \"The trust anchor holding the custodian's CA certificate. Recorded after the administrator creates it from external/accounts/setup.\"\n }\n },\n \"required\": [\n \"model\",\n \"region\",\n \"profileArn\",\n \"roleArn\",\n \"trustAnchorArn\"\n ],\n \"type\": \"object\"\n },\n {\n \"additionalProperties\": false,\n \"description\": \"Egress: `sts.googleapis.com`, plus `iamcredentials.googleapis.com` when `serviceAccount` is set.\",\n \"properties\": {\n \"bucket\": {\n \"$ref\": \"#/$defs/ProviderBucketName\",\n \"description\": \"The GCS bucket issuances are scoped within, by a Credential Access Boundary.\"\n },\n \"model\": {\n \"const\": \"gcp-wif-pinned\",\n \"type\": \"string\"\n },\n \"poolId\": {\n \"pattern\": \"^[a-z0-9-]{4,32}$\",\n \"type\": \"string\"\n },\n \"probePrefix\": {\n \"$ref\": \"#/$defs/ProviderObjectPrefix\",\n \"description\": \"Where external/accounts/probe writes its canary when no binding names a narrower prefix. Lets a new account be probed before anything is bound to it. Absent, a probe of an account with no bindings stops after `exchange` and reports `complete: false`.\"\n },\n \"projectNumber\": {\n \"pattern\": \"^[0-9]{1,20}$\",\n \"type\": \"string\"\n },\n \"providerId\": {\n \"pattern\": \"^[a-z0-9-]{4,32}$\",\n \"type\": \"string\"\n },\n \"serviceAccount\": {\n \"description\": \"When set, the federated token is exchanged for this service account's access token.\",\n \"maxLength\": 254,\n \"pattern\": \"^[a-z0-9-]+@[a-z0-9-]+\\\\.iam\\\\.gserviceaccount\\\\.com$\",\n \"type\": \"string\"\n },\n \"signingAlgorithm\": {\n \"description\": \"The ID-token algorithm. ES256 unless the provider refuses it. Absent means ES256.\",\n \"enum\": [\n \"ES256\",\n \"RS256\"\n ],\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"model\",\n \"projectNumber\",\n \"poolId\",\n \"providerId\"\n ],\n \"type\": \"object\"\n },\n {\n \"additionalProperties\": false,\n \"description\": \"Egress: `login.microsoftonline.com`, or the sovereign-cloud authority named in `authorityHost`.\",\n \"properties\": {\n \"authorityHost\": {\n \"description\": \"Absent means `login.microsoftonline.com`.\",\n \"maxLength\": 253,\n \"pattern\": \"^[a-z0-9.-]+$\",\n \"type\": \"string\"\n },\n \"clientId\": {\n \"pattern\": \"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$\",\n \"type\": \"string\"\n },\n \"model\": {\n \"const\": \"azure-cert\",\n \"type\": \"string\"\n },\n \"tenantId\": {\n \"pattern\": \"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$\",\n \"type\": \"string\"\n },\n \"tokenScope\": {\n \"description\": \"The `scope` requested at the token endpoint, such as `https://storage.azure.com/.default`.\",\n \"maxLength\": 512,\n \"pattern\": \"^[A-Za-z0-9:/._-]+$\",\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"model\",\n \"tenantId\",\n \"clientId\",\n \"tokenScope\"\n ],\n \"type\": \"object\"\n },\n {\n \"additionalProperties\": false,\n \"description\": \"Egress: the host of `tokenEndpoint`, and nothing else.\",\n \"properties\": {\n \"audience\": {\n \"description\": \"The assertion's `aud`. Absent means `tokenEndpoint`.\",\n \"maxLength\": 2048,\n \"pattern\": \"^[!-~]+$\",\n \"type\": \"string\"\n },\n \"clientId\": {\n \"maxLength\": 512,\n \"minLength\": 1,\n \"pattern\": \"^[!-~]+$\",\n \"type\": \"string\"\n },\n \"model\": {\n \"const\": \"oauth2-private-key-jwt\",\n \"type\": \"string\"\n },\n \"scopes\": {\n \"description\": \"The scopes a binding may request, the ceiling for every issuance.\",\n \"items\": {\n \"maxLength\": 256,\n \"pattern\": \"^[!#-\\\\[\\\\]-~]+$\",\n \"type\": \"string\"\n },\n \"maxItems\": 64,\n \"type\": \"array\",\n \"uniqueItems\": true\n },\n \"signingAlgorithm\": {\n \"enum\": [\n \"ES256\",\n \"RS256\"\n ],\n \"type\": \"string\"\n },\n \"tokenEndpoint\": {\n \"$ref\": \"#/$defs/ProviderHttpsUrl\"\n }\n },\n \"required\": [\n \"model\",\n \"tokenEndpoint\",\n \"clientId\"\n ],\n \"type\": \"object\"\n },\n {\n \"additionalProperties\": false,\n \"description\": \"Issuance needs no egress: presigning is a computation inside the custodian, and the consumer uses the URL itself. The probe connects to the host of `endpoint`, which `egressHosts` therefore lists.\",\n \"properties\": {\n \"accessKeyId\": {\n \"description\": \"The access key's identifier. Not a secret: it appears in every presigned URL. The secret half is set with external/accounts/secret/set and never returned.\",\n \"maxLength\": 128,\n \"pattern\": \"^[A-Za-z0-9]+$\",\n \"type\": \"string\"\n },\n \"bucket\": {\n \"$ref\": \"#/$defs/ProviderBucketName\"\n },\n \"endpoint\": {\n \"$ref\": \"#/$defs/ProviderHttpsUrl\"\n },\n \"model\": {\n \"const\": \"s3-static-presign\",\n \"type\": \"string\"\n },\n \"pathStyle\": {\n \"description\": \"Address the bucket in the path rather than the host name, as MinIO usually needs.\",\n \"type\": \"boolean\"\n },\n \"probePrefix\": {\n \"$ref\": \"#/$defs/ProviderObjectPrefix\",\n \"description\": \"Where external/accounts/probe writes its canary when no binding names a narrower prefix. Lets a new account be probed before anything is bound to it. Absent, a probe of an account with no bindings stops after `exchange` and reports `complete: false`.\"\n },\n \"region\": {\n \"description\": \"The SigV4 signing region; `auto` for Cloudflare R2.\",\n \"maxLength\": 64,\n \"pattern\": \"^[a-z0-9-]+$\",\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"model\",\n \"endpoint\",\n \"region\",\n \"bucket\",\n \"accessKeyId\"\n ],\n \"type\": \"object\"\n },\n {\n \"additionalProperties\": false,\n \"description\": \"No egress: the custodian signs and the consumer submits the transaction. The allow-list, the gas caps and the coin caps are the account's whole authority; a transaction outside them is refused before anything is signed.\",\n \"properties\": {\n \"allowedCalls\": {\n \"description\": \"Every MoveCall command in a signed transaction must name one of these. For Walrus storage: the system package's `register_blob`, `certify_blob`, `extend_blob` and `delete_blob`, and the coin calls needed to pay for them.\",\n \"items\": {\n \"$ref\": \"#/$defs/SuiMoveCall\"\n },\n \"maxItems\": 32,\n \"minItems\": 1,\n \"type\": \"array\"\n },\n \"allowedObjects\": {\n \"description\": \"Shared objects a transaction may take as input, such as the Walrus system and staking objects. Absent means any object the allowed calls accept.\",\n \"items\": {\n \"pattern\": \"^0x[0-9a-f]{64}$\",\n \"type\": \"string\"\n },\n \"maxItems\": 32,\n \"type\": \"array\"\n },\n \"maxCoinOutPerTx\": {\n \"description\": \"Per coin type, the most a single transaction may spend or transfer out of the account's address, in the coin's smallest unit. A coin type not listed may not leave the address at all.\",\n \"items\": {\n \"additionalProperties\": false,\n \"properties\": {\n \"amount\": {\n \"minimum\": 0,\n \"type\": \"integer\"\n },\n \"coinType\": {\n \"maxLength\": 512,\n \"pattern\": \"^0x[0-9a-f]{1,64}::[A-Za-z0-9_]+::[A-Za-z0-9_]+$\",\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"coinType\",\n \"amount\"\n ],\n \"type\": \"object\"\n },\n \"maxItems\": 8,\n \"type\": \"array\"\n },\n \"maxGasBudgetMist\": {\n \"description\": \"The largest gas budget one transaction may declare.\",\n \"minimum\": 1,\n \"type\": \"integer\"\n },\n \"maxGasPerDayMist\": {\n \"description\": \"The total gas budget signed per rolling 24 hours.\",\n \"minimum\": 1,\n \"type\": \"integer\"\n },\n \"model\": {\n \"const\": \"sui-signer\",\n \"type\": \"string\"\n },\n \"network\": {\n \"enum\": [\n \"mainnet\",\n \"testnet\",\n \"devnet\"\n ],\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"model\",\n \"network\",\n \"allowedCalls\",\n \"maxGasBudgetMist\",\n \"maxGasPerDayMist\"\n ],\n \"type\": \"object\"\n },\n {\n \"additionalProperties\": false,\n \"description\": \"Egress: the host of `baseUrl`. The secret is set with external/accounts/secret/set and used only inside the custodian by `driver`; a provider reachable only by handing the consumer the raw key is not supported.\",\n \"properties\": {\n \"baseUrl\": {\n \"$ref\": \"#/$defs/ProviderHttpsUrl\"\n },\n \"driver\": {\n \"description\": \"The custodian's driver that uses the secret: performs a login or token exchange and returns a short-lived result. A custodian refuses a driver it does not implement.\",\n \"maxLength\": 64,\n \"pattern\": \"^[a-z0-9][a-z0-9-]*$\",\n \"type\": \"string\"\n },\n \"model\": {\n \"const\": \"static-secret\",\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"model\",\n \"driver\",\n \"baseUrl\"\n ],\n \"type\": \"object\"\n }\n ],\n \"title\": \"AccountSettings\"\n },\n \"AccountState\": {\n \"description\": \"`active`: usable by its bindings. `suspended`: every issuance and signature is refused at once; management reads continue; resumable. `archived`: hidden from default listings, refused for use, restorable. Deletion removes the record.\",\n \"enum\": [\n \"active\",\n \"suspended\",\n \"archived\"\n ],\n \"title\": \"AccountState\",\n \"type\": \"string\"\n },\n \"AwsArn\": {\n \"maxLength\": 2048,\n \"pattern\": \"^arn:aws[a-z-]*:[a-z0-9-]+:[a-z0-9-]*:[0-9]{0,12}:[A-Za-z0-9+=,.@_/:-]+$\",\n \"title\": \"AwsArn\",\n \"type\": \"string\"\n },\n \"AwsRegion\": {\n \"maxLength\": 32,\n \"pattern\": \"^[a-z]{2}(-gov)?-[a-z]+-[0-9]$\",\n \"title\": \"AwsRegion\",\n \"type\": \"string\"\n },\n \"CredentialScopeCeiling\": {\n \"additionalProperties\": false,\n \"description\": \"The widest scope a binding's consumer may request. An issuance is inside the ceiling when its `prefix` begins with one of `prefixes`, every one of its `actions` is in `actions`, and every one of its `scopes` is in `scopes`. Absent members confer nothing: a ceiling with no `prefixes` permits no storage issuance.\",\n \"properties\": {\n \"actions\": {\n \"items\": {\n \"$ref\": \"#/$defs/ProviderObjectAction\"\n },\n \"maxItems\": 3,\n \"minItems\": 1,\n \"type\": \"array\",\n \"uniqueItems\": true\n },\n \"prefixes\": {\n \"items\": {\n \"$ref\": \"#/$defs/ProviderObjectPrefix\"\n },\n \"maxItems\": 64,\n \"minItems\": 1,\n \"type\": \"array\",\n \"uniqueItems\": true\n },\n \"scopes\": {\n \"items\": {\n \"maxLength\": 256,\n \"pattern\": \"^[!#-\\\\[\\\\]-~]+$\",\n \"type\": \"string\"\n },\n \"maxItems\": 64,\n \"type\": \"array\",\n \"uniqueItems\": true\n }\n },\n \"title\": \"CredentialScopeCeiling\",\n \"type\": \"object\"\n },\n \"DigestMultibase\": {\n \"description\": \"A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.\\n\\nMultihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.\\n\\nThis definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.\\n\\nRestricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that \\\"interoperability is not guaranteed between implementations using such values\\\", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.\",\n \"examples\": [\n \"zQmbWqxBEKC3P8tqsKc98xmWNzrzDtRLMiMPL8wBuTGsMnR\"\n ],\n \"minLength\": 16,\n \"pattern\": \"^(z[1-9A-HJ-NP-Za-km-z]+|u[A-Za-z0-9_-]+)$\",\n \"title\": \"DigestMultibase\",\n \"type\": \"string\"\n },\n \"Ext\": {\n \"additionalProperties\": true,\n \"description\": \"Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.\",\n \"minProperties\": 1,\n \"propertyNames\": {\n \"pattern\": \"^[a-z][a-z0-9-]*(\\\\.[a-z0-9-]+)+$\"\n },\n \"title\": \"Ext\",\n \"type\": \"object\"\n },\n \"ExternalAccount\": {\n \"additionalProperties\": false,\n \"description\": \"An account as every read returns it. Contains no private key, no secret and no issued credential, to any reader.\",\n \"properties\": {\n \"bindings\": {\n \"items\": {\n \"$ref\": \"#/$defs/AccountBinding\"\n },\n \"maxItems\": 256,\n \"type\": \"array\"\n },\n \"context\": {\n \"$ref\": \"#/$defs/AccountContextId\"\n },\n \"createdAt\": {\n \"format\": \"date-time\",\n \"type\": \"string\"\n },\n \"egressHosts\": {\n \"description\": \"The provider hosts the custodian connects to on this account's behalf, derived by the custodian from its settings: the token or session endpoints issuance uses, and the destinations external/accounts/probe dials (the object store's host, for a storage model). The custodian MUST NOT connect anywhere else on the account's behalf, so an egress proxy can allow exactly this set. Empty only for a model that neither exchanges nor probes over the network.\",\n \"items\": {\n \"maxLength\": 253,\n \"pattern\": \"^[a-z0-9.-]+$\",\n \"type\": \"string\"\n },\n \"maxItems\": 8,\n \"type\": \"array\"\n },\n \"id\": {\n \"$ref\": \"#/$defs/AccountId\"\n },\n \"label\": {\n \"description\": \"Display name. Untrusted text: render it, never interpret it.\",\n \"maxLength\": 128,\n \"minLength\": 1,\n \"type\": \"string\"\n },\n \"lastProbe\": {\n \"$ref\": \"#/$defs/AccountProbeReport\"\n },\n \"providerSetupRequired\": {\n \"description\": \"True when the account cannot be used until its provider-side setup is redone: after a restore that could not carry its key or secret (a wrapped RSA key, a static secret), or after a rotation awaiting confirmation.\",\n \"type\": \"boolean\"\n },\n \"publicMaterial\": {\n \"$ref\": \"#/$defs/AccountPublicMaterial\",\n \"description\": \"Absent for the static models, which hold a secret rather than a key.\"\n },\n \"secret\": {\n \"$ref\": \"#/$defs/AccountSecretInfo\",\n \"description\": \"Static models only; absent until the secret is set.\"\n },\n \"settings\": {\n \"$ref\": \"#/$defs/AccountSettings\"\n },\n \"state\": {\n \"$ref\": \"#/$defs/AccountState\"\n },\n \"updatedAt\": {\n \"format\": \"date-time\",\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"id\",\n \"label\",\n \"context\",\n \"settings\",\n \"state\",\n \"bindings\",\n \"egressHosts\",\n \"providerSetupRequired\",\n \"createdAt\",\n \"updatedAt\"\n ],\n \"title\": \"ExternalAccount\",\n \"type\": \"object\"\n },\n \"ProviderBucketName\": {\n \"description\": \"A bucket name as S3 and GCS accept it. Validated rather than free so that it can be placed in a provider policy without escaping.\",\n \"maxLength\": 63,\n \"minLength\": 3,\n \"pattern\": \"^[a-z0-9][a-z0-9.-]*[a-z0-9]$\",\n \"title\": \"ProviderBucketName\",\n \"type\": \"string\"\n },\n \"ProviderHttpsUrl\": {\n \"format\": \"uri\",\n \"maxLength\": 2048,\n \"pattern\": \"^https://[^\\\\s\\\"'\\\\\\\\]+$\",\n \"title\": \"ProviderHttpsUrl\",\n \"type\": \"string\"\n },\n \"ProviderObjectAction\": {\n \"description\": \"`put`: write an object. `get`: read one. `delete`: remove one. No list, ACL, policy or bucket-level action exists here, so none can be granted.\",\n \"enum\": [\n \"put\",\n \"get\",\n \"delete\"\n ],\n \"title\": \"ProviderObjectAction\",\n \"type\": \"string\"\n },\n \"ProviderObjectPrefix\": {\n \"description\": \"An object-key prefix within the account's bucket: one or more segments of lowercase letters, digits, `.`, `_` and `-`, each beginning with a letter or digit and ending with `/`. No quote, backslash, wildcard, whitespace, `..` segment or empty segment can appear. That is deliberate: the custodian places this value inside a provider policy — an IAM session policy (JSON), a GCS Credential Access Boundary condition (CEL) — and a value able to carry a metacharacter can break out of the string it is placed in and widen the policy. That is a known class of defect (CVE-2026-42811, a CEL injection in downscoped GCS credentials). Even with this pattern, a custodian MUST build provider policies with the provider language's own encoder, never by string interpolation.\",\n \"maxLength\": 512,\n \"minLength\": 2,\n \"pattern\": \"^([a-z0-9][a-z0-9._-]{0,127}/){1,16}$\",\n \"title\": \"ProviderObjectPrefix\",\n \"type\": \"string\"\n },\n \"Response\": {\n \"$anchor\": \"response\",\n \"additionalProperties\": false,\n \"properties\": {\n \"account\": {\n \"$ref\": \"#/$defs/ExternalAccount\"\n },\n \"ext\": {\n \"$ref\": \"#/$defs/Ext\"\n }\n },\n \"required\": [\n \"account\"\n ],\n \"title\": \"External Accounts — Create — response payload\",\n \"type\": \"object\"\n },\n \"SecretFingerprint\": {\n \"description\": \"Which secret is set, without being a way to test guesses at it. `hmacsha256:` followed by the base64url encoding, without padding, of the first 16 bytes of HMAC-SHA256 over the secret's bytes under a fingerprint key the custodian holds and never discloses. Comparable only between fingerprints made by the same custodian: a re-entered value can be confirmed, while the same secret at two custodians gives unrelated fingerprints. Never a bare hash of the secret, which would let anyone who reads it run a dictionary against it offline; and deliberately not a DigestMultibase, since multihash has no code for a keyed digest.\",\n \"maxLength\": 33,\n \"pattern\": \"^hmacsha256:[A-Za-z0-9_-]{22}$\",\n \"title\": \"SecretFingerprint\",\n \"type\": \"string\"\n },\n \"SuiMoveCall\": {\n \"additionalProperties\": false,\n \"description\": \"One Move function an account's transactions may call.\",\n \"properties\": {\n \"function\": {\n \"pattern\": \"^[A-Za-z][A-Za-z0-9_]{0,127}$\",\n \"type\": \"string\"\n },\n \"module\": {\n \"pattern\": \"^[A-Za-z][A-Za-z0-9_]{0,127}$\",\n \"type\": \"string\"\n },\n \"package\": {\n \"pattern\": \"^0x[0-9a-f]{64}$\",\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"package\",\n \"module\",\n \"function\"\n ],\n \"title\": \"SuiMoveCall\",\n \"type\": \"object\"\n }\n },\n \"$ref\": \"#/$defs/Response\",\n \"$schema\": \"https://json-schema.org/draft/2020-12/schema\"\n}\n",
);
}
impl crate::RequestPayload for Payload {
type Response = Response;
}
/// The extended error codes this specification declares (SPEC §7.3 item 9,
/// §8.5), in declaration order. Empty when it declares none.
pub const ERROR_CODES: &[crate::DeclaredErrorCode] = &[
error_codes::NOT_FOUND,
error_codes::ALREADY_EXISTS,
error_codes::INVALID_SETTINGS,
error_codes::MODEL_UNSUPPORTED,
];
/// One constant per extended error code this specification declares
/// (SPEC §7.3 item 9), named for its local part.
///
/// Emit these rather than a string literal: the code is read from the
/// specification, so it cannot name a code the specification never
/// declared.
pub mod error_codes {
/// `external:notFound`
///
/// The named context does not exist, or the caller has no standing in it. Conflated so that a context's existence is not confirmed to a stranger. See the family conventions §2.
///
/// Declared `retryable: false`.
pub const NOT_FOUND: crate::DeclaredErrorCode = crate::DeclaredErrorCode {
code: "external:notFound",
retryable: false,
details_schema: ::core::option::Option::None,
};
/// `external:alreadyExists`
///
/// An account in the context already carries this id.
///
/// Declared `retryable: false`.
pub const ALREADY_EXISTS: crate::DeclaredErrorCode = crate::DeclaredErrorCode {
code: "external:alreadyExists",
retryable: false,
details_schema: ::core::option::Option::None,
};
/// `external:invalidSettings`
///
/// The settings validate against the schema but are unusable: a model change, an inconsistent value, or a driver or network this custodian does not implement. `details.member` names the offending member.
///
/// Declared `retryable: false`.
/// Declares a `detailsSchema` for the error's `details` member.
pub const INVALID_SETTINGS: crate::DeclaredErrorCode = crate::DeclaredErrorCode {
code: "external:invalidSettings",
retryable: false,
details_schema: ::core::option::Option::Some(
"{\"additionalProperties\":false,\"properties\":{\"member\":{\"maxLength\":128,\"type\":\"string\"}},\"required\":[\"member\"],\"type\":\"object\"}",
),
};
/// `external/accounts/create:modelUnsupported`
///
/// The custodian does not implement `settings.model`. A model it implements but cannot use as configured is `external:invalidSettings` instead.
///
/// Declared `retryable: false`.
pub const MODEL_UNSUPPORTED: crate::DeclaredErrorCode = crate::DeclaredErrorCode {
code: "external/accounts/create:modelUnsupported",
retryable: false,
details_schema: ::core::option::Option::None,
};
}