//! Generated by `trust-tasks-codegen` — do not edit by hand.
//!
//! Spec slug: `external/accounts/list`. Version: `0.1`.
#[allow(unused_imports)]
use serde::{Deserialize, Serialize};
/// Error types.
pub mod error {
/// Error from a `TryFrom` or `FromStr` implementation.
pub struct ConversionError(::std::borrow::Cow<'static, str>);
impl ::std::error::Error for ConversionError {}
impl ::std::fmt::Display for ConversionError {
fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> Result<(), ::std::fmt::Error> {
::std::fmt::Display::fmt(&self.0, f)
}
}
impl ::std::fmt::Debug for ConversionError {
fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> Result<(), ::std::fmt::Error> {
::std::fmt::Debug::fmt(&self.0, f)
}
}
impl From<&'static str> for ConversionError {
fn from(value: &'static str) -> Self {
Self(value.into())
}
}
impl From<String> for ConversionError {
fn from(value: String) -> Self {
Self(value.into())
}
}
}
///Who may use an account, and how far. One binding per consumer per account. A binding is checked before anything is signed: the caller must be `consumer`, proven by the request's own proof; the request must sit inside `scopeCeiling`; its TTL must not exceed `maxTtlSeconds`; and the binding's rate must not be exhausted.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "AccountBinding",
/// "description": "Who may use an account, and how far. One binding per consumer per account. A binding is checked before anything is signed: the caller must be `consumer`, proven by the request's own proof; the request must sit inside `scopeCeiling`; its TTL must not exceed `maxTtlSeconds`; and the binding's rate must not be exhausted.",
/// "type": "object",
/// "required": [
/// "consumer",
/// "maxTtlSeconds",
/// "ratePerMinute"
/// ],
/// "properties": {
/// "consumer": {
/// "description": "The DID of the integration allowed to use the account.",
/// "type": "string",
/// "maxLength": 2048,
/// "minLength": 7,
/// "pattern": "^did:[a-z0-9]+:\\S+$"
/// },
/// "grantedAt": {
/// "type": "string",
/// "format": "date-time"
/// },
/// "maxTtlSeconds": {
/// "description": "The longest credential lifetime the consumer may request. 900 (15 minutes) is RECOMMENDED; the ceiling is one hour.",
/// "type": "integer",
/// "maximum": 3600.0,
/// "minimum": 60.0
/// },
/// "ratePerMinute": {
/// "description": "Issuances or signatures per minute for this binding.",
/// "type": "integer",
/// "maximum": 600.0,
/// "minimum": 1.0
/// },
/// "scopeCeiling": {
/// "description": "Required for storage and OAuth models; absent for `sui-signer`, whose ceiling is the account's own allow-list and caps.",
/// "$ref": "#/definitions/CredentialScopeCeiling"
/// },
/// "sourceCidrs": {
/// "description": "Where the provider supports it (`aws:SourceIp`), issued credentials are pinned to these networks, so a credential lifted from the consumer is useless elsewhere.",
/// "type": "array",
/// "items": {
/// "type": "string",
/// "maxLength": 49,
/// "pattern": "^[0-9a-fA-F:.]+/[0-9]{1,3}$"
/// },
/// "maxItems": 16
/// }
/// },
/// "additionalProperties": false
///}
/// ```
/// </details>
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct AccountBinding {
///The DID of the integration allowed to use the account.
pub consumer: AccountBindingConsumer,
#[serde(
rename = "grantedAt",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
pub granted_at: ::std::option::Option<::chrono::DateTime<::chrono::offset::Utc>>,
///The longest credential lifetime the consumer may request. 900 (15 minutes) is RECOMMENDED; the ceiling is one hour.
#[serde(rename = "maxTtlSeconds")]
pub max_ttl_seconds: i64,
///Issuances or signatures per minute for this binding.
#[serde(rename = "ratePerMinute")]
pub rate_per_minute: ::std::num::NonZeroU64,
///Required for storage and OAuth models; absent for `sui-signer`, whose ceiling is the account's own allow-list and caps.
#[serde(
rename = "scopeCeiling",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
pub scope_ceiling: ::std::option::Option<CredentialScopeCeiling>,
///Where the provider supports it (`aws:SourceIp`), issued credentials are pinned to these networks, so a credential lifted from the consumer is useless elsewhere.
#[serde(
rename = "sourceCidrs",
default,
skip_serializing_if = "::std::vec::Vec::is_empty"
)]
pub source_cidrs: ::std::vec::Vec<AccountBindingSourceCidrsItem>,
}
impl AccountBinding {
pub fn builder() -> builder::AccountBinding {
Default::default()
}
}
///The DID of the integration allowed to use the account.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "description": "The DID of the integration allowed to use the account.",
/// "type": "string",
/// "maxLength": 2048,
/// "minLength": 7,
/// "pattern": "^did:[a-z0-9]+:\\S+$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountBindingConsumer(::std::string::String);
impl ::std::ops::Deref for AccountBindingConsumer {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountBindingConsumer> for ::std::string::String {
fn from(value: AccountBindingConsumer) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountBindingConsumer {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 2048usize {
return Err("longer than 2048 characters".into());
}
if value.chars().count() < 7usize {
return Err("shorter than 7 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^did:[a-z0-9]+:\\S+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^did:[a-z0-9]+:\\S+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountBindingConsumer {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountBindingConsumer {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountBindingConsumer {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountBindingConsumer {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AccountBindingSourceCidrsItem`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "maxLength": 49,
/// "pattern": "^[0-9a-fA-F:.]+/[0-9]{1,3}$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountBindingSourceCidrsItem(::std::string::String);
impl ::std::ops::Deref for AccountBindingSourceCidrsItem {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountBindingSourceCidrsItem> for ::std::string::String {
fn from(value: AccountBindingSourceCidrsItem) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountBindingSourceCidrsItem {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 49usize {
return Err("longer than 49 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| {
::regress::Regex::new("^[0-9a-fA-F:.]+/[0-9]{1,3}$").unwrap()
});
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[0-9a-fA-F:.]+/[0-9]{1,3}$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountBindingSourceCidrsItem {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountBindingSourceCidrsItem {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountBindingSourceCidrsItem {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountBindingSourceCidrsItem {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///The custodian context that owns the account. Act scope in this context decides who may manage the account and who may consume it; the account's keys are derived in this context's key space.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "AccountContextId",
/// "description": "The custodian context that owns the account. Act scope in this context decides who may manage the account and who may consume it; the account's keys are derived in this context's key space.",
/// "type": "string",
/// "maxLength": 256,
/// "minLength": 1
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountContextId(::std::string::String);
impl ::std::ops::Deref for AccountContextId {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountContextId> for ::std::string::String {
fn from(value: AccountContextId) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountContextId {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 256usize {
return Err("longer than 256 characters".into());
}
if value.chars().count() < 1usize {
return Err("shorter than 1 characters".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountContextId {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountContextId {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountContextId {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountContextId {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///The account's identifier within its context, chosen by whoever creates it. Lowercase letters, digits and hyphens, so that it can be embedded in a certificate subject, a token subject or a provider-side condition without escaping. Unique per context; never reused after deletion while anything that names it (a provider-side trust policy, an audit row) may still exist.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "AccountId",
/// "description": "The account's identifier within its context, chosen by whoever creates it. Lowercase letters, digits and hyphens, so that it can be embedded in a certificate subject, a token subject or a provider-side condition without escaping. Unique per context; never reused after deletion while anything that names it (a provider-side trust policy, an audit row) may still exist.",
/// "type": "string",
/// "maxLength": 64,
/// "minLength": 1,
/// "pattern": "^[a-z0-9][a-z0-9-]*$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountId(::std::string::String);
impl ::std::ops::Deref for AccountId {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountId> for ::std::string::String {
fn from(value: AccountId) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountId {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 64usize {
return Err("longer than 64 characters".into());
}
if value.chars().count() < 1usize {
return Err("shorter than 1 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[a-z0-9][a-z0-9-]*$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[a-z0-9][a-z0-9-]*$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountId {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountId {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountId {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountId {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AccountProbeReport`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "AccountProbeReport",
/// "type": "object",
/// "required": [
/// "at",
/// "complete",
/// "ok",
/// "steps"
/// ],
/// "properties": {
/// "at": {
/// "type": "string",
/// "format": "date-time"
/// },
/// "complete": {
/// "description": "True only when the canary steps (`put`, `get`, `delete`, or the model's equivalent) ran, so the account was exercised end to end. A probe that stopped after `exchange` because nothing named a canary prefix is `complete: false` even when `ok` is true, and does not clear `providerSetupRequired`.",
/// "type": "boolean"
/// },
/// "ok": {
/// "description": "True when every step that ran succeeded.",
/// "type": "boolean"
/// },
/// "steps": {
/// "description": "In order; the first failing step ends the probe.",
/// "type": "array",
/// "items": {
/// "type": "object",
/// "required": [
/// "ok",
/// "step"
/// ],
/// "properties": {
/// "durationMs": {
/// "type": "integer",
/// "minimum": 0.0
/// },
/// "ok": {
/// "type": "boolean"
/// },
/// "providerError": {
/// "description": "The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.",
/// "type": "string",
/// "maxLength": 2048
/// },
/// "providerRequestId": {
/// "type": "string",
/// "maxLength": 256,
/// "pattern": "^[!-~]+$"
/// },
/// "step": {
/// "$ref": "#/definitions/AccountProbeStep"
/// }
/// },
/// "additionalProperties": false
/// },
/// "maxItems": 8
/// }
/// },
/// "additionalProperties": false
///}
/// ```
/// </details>
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct AccountProbeReport {
pub at: ::chrono::DateTime<::chrono::offset::Utc>,
///True only when the canary steps (`put`, `get`, `delete`, or the model's equivalent) ran, so the account was exercised end to end. A probe that stopped after `exchange` because nothing named a canary prefix is `complete: false` even when `ok` is true, and does not clear `providerSetupRequired`.
pub complete: bool,
///True when every step that ran succeeded.
pub ok: bool,
///In order; the first failing step ends the probe.
pub steps: ::std::vec::Vec<AccountProbeReportStepsItem>,
}
impl AccountProbeReport {
pub fn builder() -> builder::AccountProbeReport {
Default::default()
}
}
///`AccountProbeReportStepsItem`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "object",
/// "required": [
/// "ok",
/// "step"
/// ],
/// "properties": {
/// "durationMs": {
/// "type": "integer",
/// "minimum": 0.0
/// },
/// "ok": {
/// "type": "boolean"
/// },
/// "providerError": {
/// "description": "The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.",
/// "type": "string",
/// "maxLength": 2048
/// },
/// "providerRequestId": {
/// "type": "string",
/// "maxLength": 256,
/// "pattern": "^[!-~]+$"
/// },
/// "step": {
/// "$ref": "#/definitions/AccountProbeStep"
/// }
/// },
/// "additionalProperties": false
///}
/// ```
/// </details>
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct AccountProbeReportStepsItem {
#[serde(
rename = "durationMs",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
pub duration_ms: ::std::option::Option<u64>,
pub ok: bool,
///The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.
#[serde(
rename = "providerError",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
pub provider_error: ::std::option::Option<AccountProbeReportStepsItemProviderError>,
#[serde(
rename = "providerRequestId",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
pub provider_request_id: ::std::option::Option<AccountProbeReportStepsItemProviderRequestId>,
pub step: AccountProbeStep,
}
impl AccountProbeReportStepsItem {
pub fn builder() -> builder::AccountProbeReportStepsItem {
Default::default()
}
}
///The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "description": "The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.",
/// "type": "string",
/// "maxLength": 2048
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountProbeReportStepsItemProviderError(::std::string::String);
impl ::std::ops::Deref for AccountProbeReportStepsItemProviderError {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountProbeReportStepsItemProviderError> for ::std::string::String {
fn from(value: AccountProbeReportStepsItemProviderError) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountProbeReportStepsItemProviderError {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 2048usize {
return Err("longer than 2048 characters".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountProbeReportStepsItemProviderError {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountProbeReportStepsItemProviderError {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountProbeReportStepsItemProviderError {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountProbeReportStepsItemProviderError {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AccountProbeReportStepsItemProviderRequestId`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "maxLength": 256,
/// "pattern": "^[!-~]+$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountProbeReportStepsItemProviderRequestId(::std::string::String);
impl ::std::ops::Deref for AccountProbeReportStepsItemProviderRequestId {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountProbeReportStepsItemProviderRequestId> for ::std::string::String {
fn from(value: AccountProbeReportStepsItemProviderRequestId) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountProbeReportStepsItemProviderRequestId {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 256usize {
return Err("longer than 256 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[!-~]+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[!-~]+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountProbeReportStepsItemProviderRequestId {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String>
for AccountProbeReportStepsItemProviderRequestId
{
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String>
for AccountProbeReportStepsItemProviderRequestId
{
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountProbeReportStepsItemProviderRequestId {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`sign`: the custodian signed its assertion, session request or test transaction. `exchange`: the provider issued a credential for it. `put`, `get`, `delete`: one canary object at the narrowest scope of the account's bindings. `decode`: for `sui-signer`, a built test transaction passed the allow-list (it is never submitted).
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "AccountProbeStep",
/// "description": "`sign`: the custodian signed its assertion, session request or test transaction. `exchange`: the provider issued a credential for it. `put`, `get`, `delete`: one canary object at the narrowest scope of the account's bindings. `decode`: for `sui-signer`, a built test transaction passed the allow-list (it is never submitted).",
/// "type": "string",
/// "enum": [
/// "sign",
/// "exchange",
/// "put",
/// "get",
/// "delete",
/// "decode"
/// ]
///}
/// ```
/// </details>
#[derive(
::serde::Deserialize,
::serde::Serialize,
Clone,
Copy,
Debug,
Eq,
Hash,
Ord,
PartialEq,
PartialOrd,
)]
#[non_exhaustive]
pub enum AccountProbeStep {
#[serde(rename = "sign")]
Sign,
#[serde(rename = "exchange")]
Exchange,
#[serde(rename = "put")]
Put,
#[serde(rename = "get")]
Get,
#[serde(rename = "delete")]
Delete,
#[serde(rename = "decode")]
Decode,
}
impl ::std::fmt::Display for AccountProbeStep {
fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> ::std::fmt::Result {
match *self {
Self::Sign => f.write_str("sign"),
Self::Exchange => f.write_str("exchange"),
Self::Put => f.write_str("put"),
Self::Get => f.write_str("get"),
Self::Delete => f.write_str("delete"),
Self::Decode => f.write_str("decode"),
}
}
}
impl ::std::str::FromStr for AccountProbeStep {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
match value {
"sign" => Ok(Self::Sign),
"exchange" => Ok(Self::Exchange),
"put" => Ok(Self::Put),
"get" => Ok(Self::Get),
"delete" => Ok(Self::Delete),
"decode" => Ok(Self::Decode),
_ => Err("invalid value".into()),
}
}
}
impl ::std::convert::TryFrom<&str> for AccountProbeStep {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountProbeStep {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountProbeStep {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
///The public half of the account's key, as the provider needs it. Never a private key.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "AccountPublicMaterial",
/// "description": "The public half of the account's key, as the provider needs it. Never a private key.",
/// "type": "object",
/// "required": [
/// "algorithm",
/// "keyFingerprint"
/// ],
/// "properties": {
/// "address": {
/// "description": "`sui-signer`: the Sui address the key controls.",
/// "type": "string",
/// "pattern": "^0x[0-9a-f]{64}$"
/// },
/// "algorithm": {
/// "type": "string",
/// "enum": [
/// "ES256",
/// "RS256",
/// "Secp256r1"
/// ]
/// },
/// "certificatePem": {
/// "description": "`aws-roles-anywhere`: the trust anchor's CA certificate. `azure-cert`: the certificate uploaded to the app registration.",
/// "type": "string",
/// "maxLength": 16384,
/// "pattern": "^-----BEGIN CERTIFICATE-----[A-Za-z0-9+/=\\r\\n]+-----END CERTIFICATE-----\\s*$"
/// },
/// "keyFingerprint": {
/// "description": "Digest of the public key's SubjectPublicKeyInfo DER.",
/// "$ref": "#/definitions/DigestMultibase"
/// },
/// "pendingKeyFingerprint": {
/// "description": "During a rotation (external/accounts/keys/rotate), the staged successor key, until it is confirmed and the current key retires.",
/// "$ref": "#/definitions/DigestMultibase"
/// },
/// "publicKeyJwk": {
/// "description": "The public key as a JWK, with `kid`. Public members only: the schema admits no private member (`d`, `p`, `q`, `dp`, `dq`, `qi`), so a document carrying one fails validation.",
/// "type": "object",
/// "required": [
/// "kid",
/// "kty"
/// ],
/// "properties": {
/// "alg": {
/// "type": "string",
/// "enum": [
/// "ES256",
/// "RS256"
/// ]
/// },
/// "crv": {
/// "type": "string",
/// "enum": [
/// "P-256"
/// ]
/// },
/// "e": {
/// "type": "string",
/// "maxLength": 16,
/// "pattern": "^[A-Za-z0-9_-]+$"
/// },
/// "kid": {
/// "type": "string",
/// "maxLength": 128,
/// "pattern": "^[!-~]+$"
/// },
/// "kty": {
/// "type": "string",
/// "enum": [
/// "EC",
/// "RSA"
/// ]
/// },
/// "n": {
/// "type": "string",
/// "maxLength": 1024,
/// "pattern": "^[A-Za-z0-9_-]+$"
/// },
/// "use": {
/// "type": "string",
/// "const": "sig"
/// },
/// "x": {
/// "type": "string",
/// "maxLength": 1024,
/// "pattern": "^[A-Za-z0-9_-]+$"
/// },
/// "y": {
/// "type": "string",
/// "maxLength": 1024,
/// "pattern": "^[A-Za-z0-9_-]+$"
/// }
/// },
/// "additionalProperties": false
/// }
/// },
/// "additionalProperties": false
///}
/// ```
/// </details>
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct AccountPublicMaterial {
///`sui-signer`: the Sui address the key controls.
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub address: ::std::option::Option<AccountPublicMaterialAddress>,
pub algorithm: AccountPublicMaterialAlgorithm,
///`aws-roles-anywhere`: the trust anchor's CA certificate. `azure-cert`: the certificate uploaded to the app registration.
#[serde(
rename = "certificatePem",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
pub certificate_pem: ::std::option::Option<AccountPublicMaterialCertificatePem>,
///Digest of the public key's SubjectPublicKeyInfo DER.
#[serde(rename = "keyFingerprint")]
pub key_fingerprint: DigestMultibase,
///During a rotation (external/accounts/keys/rotate), the staged successor key, until it is confirmed and the current key retires.
#[serde(
rename = "pendingKeyFingerprint",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
pub pending_key_fingerprint: ::std::option::Option<DigestMultibase>,
#[serde(
rename = "publicKeyJwk",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
pub public_key_jwk: ::std::option::Option<AccountPublicMaterialPublicKeyJwk>,
}
impl AccountPublicMaterial {
pub fn builder() -> builder::AccountPublicMaterial {
Default::default()
}
}
///`sui-signer`: the Sui address the key controls.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "description": "`sui-signer`: the Sui address the key controls.",
/// "type": "string",
/// "pattern": "^0x[0-9a-f]{64}$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountPublicMaterialAddress(::std::string::String);
impl ::std::ops::Deref for AccountPublicMaterialAddress {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountPublicMaterialAddress> for ::std::string::String {
fn from(value: AccountPublicMaterialAddress) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountPublicMaterialAddress {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^0x[0-9a-f]{64}$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^0x[0-9a-f]{64}$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountPublicMaterialAddress {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountPublicMaterialAddress {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountPublicMaterialAddress {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountPublicMaterialAddress {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AccountPublicMaterialAlgorithm`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "enum": [
/// "ES256",
/// "RS256",
/// "Secp256r1"
/// ]
///}
/// ```
/// </details>
#[derive(
::serde::Deserialize,
::serde::Serialize,
Clone,
Copy,
Debug,
Eq,
Hash,
Ord,
PartialEq,
PartialOrd,
)]
#[non_exhaustive]
pub enum AccountPublicMaterialAlgorithm {
#[serde(rename = "ES256")]
Es256,
#[serde(rename = "RS256")]
Rs256,
Secp256r1,
}
impl ::std::fmt::Display for AccountPublicMaterialAlgorithm {
fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> ::std::fmt::Result {
match *self {
Self::Es256 => f.write_str("ES256"),
Self::Rs256 => f.write_str("RS256"),
Self::Secp256r1 => f.write_str("Secp256r1"),
}
}
}
impl ::std::str::FromStr for AccountPublicMaterialAlgorithm {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
match value {
"ES256" => Ok(Self::Es256),
"RS256" => Ok(Self::Rs256),
"Secp256r1" => Ok(Self::Secp256r1),
_ => Err("invalid value".into()),
}
}
}
impl ::std::convert::TryFrom<&str> for AccountPublicMaterialAlgorithm {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountPublicMaterialAlgorithm {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountPublicMaterialAlgorithm {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
///`aws-roles-anywhere`: the trust anchor's CA certificate. `azure-cert`: the certificate uploaded to the app registration.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "description": "`aws-roles-anywhere`: the trust anchor's CA certificate. `azure-cert`: the certificate uploaded to the app registration.",
/// "type": "string",
/// "maxLength": 16384,
/// "pattern": "^-----BEGIN CERTIFICATE-----[A-Za-z0-9+/=\\r\\n]+-----END CERTIFICATE-----\\s*$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountPublicMaterialCertificatePem(::std::string::String);
impl ::std::ops::Deref for AccountPublicMaterialCertificatePem {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountPublicMaterialCertificatePem> for ::std::string::String {
fn from(value: AccountPublicMaterialCertificatePem) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountPublicMaterialCertificatePem {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 16384usize {
return Err("longer than 16384 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> = ::std::sync::LazyLock::new(
|| {
::regress::Regex::new(
"^-----BEGIN CERTIFICATE-----[A-Za-z0-9+/=\\r\\n]+-----END CERTIFICATE-----\\s*$",
)
.unwrap()
},
);
if PATTERN.find(value).is_none() {
return Err(
"doesn't match pattern \"^-----BEGIN CERTIFICATE-----[A-Za-z0-9+/=\\r\\n]+-----END CERTIFICATE-----\\s*$\""
.into(),
);
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountPublicMaterialCertificatePem {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountPublicMaterialCertificatePem {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountPublicMaterialCertificatePem {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountPublicMaterialCertificatePem {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///The public key as a JWK, with `kid`. Public members only: the schema admits no private member (`d`, `p`, `q`, `dp`, `dq`, `qi`), so a document carrying one fails validation.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "description": "The public key as a JWK, with `kid`. Public members only: the schema admits no private member (`d`, `p`, `q`, `dp`, `dq`, `qi`), so a document carrying one fails validation.",
/// "type": "object",
/// "required": [
/// "kid",
/// "kty"
/// ],
/// "properties": {
/// "alg": {
/// "type": "string",
/// "enum": [
/// "ES256",
/// "RS256"
/// ]
/// },
/// "crv": {
/// "type": "string",
/// "enum": [
/// "P-256"
/// ]
/// },
/// "e": {
/// "type": "string",
/// "maxLength": 16,
/// "pattern": "^[A-Za-z0-9_-]+$"
/// },
/// "kid": {
/// "type": "string",
/// "maxLength": 128,
/// "pattern": "^[!-~]+$"
/// },
/// "kty": {
/// "type": "string",
/// "enum": [
/// "EC",
/// "RSA"
/// ]
/// },
/// "n": {
/// "type": "string",
/// "maxLength": 1024,
/// "pattern": "^[A-Za-z0-9_-]+$"
/// },
/// "use": {
/// "type": "string",
/// "const": "sig"
/// },
/// "x": {
/// "type": "string",
/// "maxLength": 1024,
/// "pattern": "^[A-Za-z0-9_-]+$"
/// },
/// "y": {
/// "type": "string",
/// "maxLength": 1024,
/// "pattern": "^[A-Za-z0-9_-]+$"
/// }
/// },
/// "additionalProperties": false
///}
/// ```
/// </details>
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct AccountPublicMaterialPublicKeyJwk {
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub alg: ::std::option::Option<AccountPublicMaterialPublicKeyJwkAlg>,
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub crv: ::std::option::Option<AccountPublicMaterialPublicKeyJwkCrv>,
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub e: ::std::option::Option<AccountPublicMaterialPublicKeyJwkE>,
pub kid: AccountPublicMaterialPublicKeyJwkKid,
pub kty: AccountPublicMaterialPublicKeyJwkKty,
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub n: ::std::option::Option<AccountPublicMaterialPublicKeyJwkN>,
#[serde(
rename = "use",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
pub use_: ::std::option::Option<::std::string::String>,
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub x: ::std::option::Option<AccountPublicMaterialPublicKeyJwkX>,
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub y: ::std::option::Option<AccountPublicMaterialPublicKeyJwkY>,
}
impl AccountPublicMaterialPublicKeyJwk {
pub fn builder() -> builder::AccountPublicMaterialPublicKeyJwk {
Default::default()
}
}
///`AccountPublicMaterialPublicKeyJwkAlg`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "enum": [
/// "ES256",
/// "RS256"
/// ]
///}
/// ```
/// </details>
#[derive(
::serde::Deserialize,
::serde::Serialize,
Clone,
Copy,
Debug,
Eq,
Hash,
Ord,
PartialEq,
PartialOrd,
)]
#[non_exhaustive]
pub enum AccountPublicMaterialPublicKeyJwkAlg {
#[serde(rename = "ES256")]
Es256,
#[serde(rename = "RS256")]
Rs256,
}
impl ::std::fmt::Display for AccountPublicMaterialPublicKeyJwkAlg {
fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> ::std::fmt::Result {
match *self {
Self::Es256 => f.write_str("ES256"),
Self::Rs256 => f.write_str("RS256"),
}
}
}
impl ::std::str::FromStr for AccountPublicMaterialPublicKeyJwkAlg {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
match value {
"ES256" => Ok(Self::Es256),
"RS256" => Ok(Self::Rs256),
_ => Err("invalid value".into()),
}
}
}
impl ::std::convert::TryFrom<&str> for AccountPublicMaterialPublicKeyJwkAlg {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountPublicMaterialPublicKeyJwkAlg {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountPublicMaterialPublicKeyJwkAlg {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
///`AccountPublicMaterialPublicKeyJwkCrv`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "enum": [
/// "P-256"
/// ]
///}
/// ```
/// </details>
#[derive(
::serde::Deserialize,
::serde::Serialize,
Clone,
Copy,
Debug,
Eq,
Hash,
Ord,
PartialEq,
PartialOrd,
)]
#[non_exhaustive]
pub enum AccountPublicMaterialPublicKeyJwkCrv {
#[serde(rename = "P-256")]
P256,
}
impl ::std::fmt::Display for AccountPublicMaterialPublicKeyJwkCrv {
fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> ::std::fmt::Result {
match *self {
Self::P256 => f.write_str("P-256"),
}
}
}
impl ::std::str::FromStr for AccountPublicMaterialPublicKeyJwkCrv {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
match value {
"P-256" => Ok(Self::P256),
_ => Err("invalid value".into()),
}
}
}
impl ::std::convert::TryFrom<&str> for AccountPublicMaterialPublicKeyJwkCrv {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountPublicMaterialPublicKeyJwkCrv {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountPublicMaterialPublicKeyJwkCrv {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
///`AccountPublicMaterialPublicKeyJwkE`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "maxLength": 16,
/// "pattern": "^[A-Za-z0-9_-]+$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountPublicMaterialPublicKeyJwkE(::std::string::String);
impl ::std::ops::Deref for AccountPublicMaterialPublicKeyJwkE {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountPublicMaterialPublicKeyJwkE> for ::std::string::String {
fn from(value: AccountPublicMaterialPublicKeyJwkE) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountPublicMaterialPublicKeyJwkE {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 16usize {
return Err("longer than 16 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[A-Za-z0-9_-]+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[A-Za-z0-9_-]+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountPublicMaterialPublicKeyJwkE {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountPublicMaterialPublicKeyJwkE {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountPublicMaterialPublicKeyJwkE {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountPublicMaterialPublicKeyJwkE {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AccountPublicMaterialPublicKeyJwkKid`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "maxLength": 128,
/// "pattern": "^[!-~]+$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountPublicMaterialPublicKeyJwkKid(::std::string::String);
impl ::std::ops::Deref for AccountPublicMaterialPublicKeyJwkKid {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountPublicMaterialPublicKeyJwkKid> for ::std::string::String {
fn from(value: AccountPublicMaterialPublicKeyJwkKid) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountPublicMaterialPublicKeyJwkKid {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 128usize {
return Err("longer than 128 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[!-~]+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[!-~]+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountPublicMaterialPublicKeyJwkKid {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountPublicMaterialPublicKeyJwkKid {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountPublicMaterialPublicKeyJwkKid {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountPublicMaterialPublicKeyJwkKid {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AccountPublicMaterialPublicKeyJwkKty`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "enum": [
/// "EC",
/// "RSA"
/// ]
///}
/// ```
/// </details>
#[derive(
::serde::Deserialize,
::serde::Serialize,
Clone,
Copy,
Debug,
Eq,
Hash,
Ord,
PartialEq,
PartialOrd,
)]
#[non_exhaustive]
pub enum AccountPublicMaterialPublicKeyJwkKty {
#[serde(rename = "EC")]
Ec,
#[serde(rename = "RSA")]
Rsa,
}
impl ::std::fmt::Display for AccountPublicMaterialPublicKeyJwkKty {
fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> ::std::fmt::Result {
match *self {
Self::Ec => f.write_str("EC"),
Self::Rsa => f.write_str("RSA"),
}
}
}
impl ::std::str::FromStr for AccountPublicMaterialPublicKeyJwkKty {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
match value {
"EC" => Ok(Self::Ec),
"RSA" => Ok(Self::Rsa),
_ => Err("invalid value".into()),
}
}
}
impl ::std::convert::TryFrom<&str> for AccountPublicMaterialPublicKeyJwkKty {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountPublicMaterialPublicKeyJwkKty {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountPublicMaterialPublicKeyJwkKty {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
///`AccountPublicMaterialPublicKeyJwkN`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "maxLength": 1024,
/// "pattern": "^[A-Za-z0-9_-]+$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountPublicMaterialPublicKeyJwkN(::std::string::String);
impl ::std::ops::Deref for AccountPublicMaterialPublicKeyJwkN {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountPublicMaterialPublicKeyJwkN> for ::std::string::String {
fn from(value: AccountPublicMaterialPublicKeyJwkN) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountPublicMaterialPublicKeyJwkN {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 1024usize {
return Err("longer than 1024 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[A-Za-z0-9_-]+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[A-Za-z0-9_-]+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountPublicMaterialPublicKeyJwkN {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountPublicMaterialPublicKeyJwkN {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountPublicMaterialPublicKeyJwkN {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountPublicMaterialPublicKeyJwkN {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AccountPublicMaterialPublicKeyJwkX`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "maxLength": 1024,
/// "pattern": "^[A-Za-z0-9_-]+$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountPublicMaterialPublicKeyJwkX(::std::string::String);
impl ::std::ops::Deref for AccountPublicMaterialPublicKeyJwkX {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountPublicMaterialPublicKeyJwkX> for ::std::string::String {
fn from(value: AccountPublicMaterialPublicKeyJwkX) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountPublicMaterialPublicKeyJwkX {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 1024usize {
return Err("longer than 1024 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[A-Za-z0-9_-]+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[A-Za-z0-9_-]+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountPublicMaterialPublicKeyJwkX {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountPublicMaterialPublicKeyJwkX {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountPublicMaterialPublicKeyJwkX {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountPublicMaterialPublicKeyJwkX {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AccountPublicMaterialPublicKeyJwkY`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "maxLength": 1024,
/// "pattern": "^[A-Za-z0-9_-]+$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountPublicMaterialPublicKeyJwkY(::std::string::String);
impl ::std::ops::Deref for AccountPublicMaterialPublicKeyJwkY {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountPublicMaterialPublicKeyJwkY> for ::std::string::String {
fn from(value: AccountPublicMaterialPublicKeyJwkY) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountPublicMaterialPublicKeyJwkY {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 1024usize {
return Err("longer than 1024 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[A-Za-z0-9_-]+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[A-Za-z0-9_-]+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountPublicMaterialPublicKeyJwkY {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountPublicMaterialPublicKeyJwkY {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountPublicMaterialPublicKeyJwkY {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountPublicMaterialPublicKeyJwkY {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///That a static model's secret is set, and which one. Never its value.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "AccountSecretInfo",
/// "description": "That a static model's secret is set, and which one. Never its value.",
/// "type": "object",
/// "required": [
/// "fingerprint",
/// "setAt"
/// ],
/// "properties": {
/// "fingerprint": {
/// "$ref": "#/definitions/SecretFingerprint"
/// },
/// "setAt": {
/// "type": "string",
/// "format": "date-time"
/// }
/// },
/// "additionalProperties": false
///}
/// ```
/// </details>
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct AccountSecretInfo {
pub fingerprint: SecretFingerprint,
#[serde(rename = "setAt")]
pub set_at: ::chrono::DateTime<::chrono::offset::Utc>,
}
impl AccountSecretInfo {
pub fn builder() -> builder::AccountSecretInfo {
Default::default()
}
}
///Per-model account settings, discriminated by `model`: every branch is an object whose `model` member is a `const`, which is what lets each generated binding emit a tagged union, so an unusable setting is answered as `external:invalidSettings` naming the member rather than as an unparseable payload. Never a secret: every value here is returned to anyone who may read the account. Branches are referred to by their `model` ("the `sui-signer` settings"). They carry no `title`, so that every binding renders each as a plain variant of this union.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "AccountSettings",
/// "description": "Per-model account settings, discriminated by `model`: every branch is an object whose `model` member is a `const`, which is what lets each generated binding emit a tagged union, so an unusable setting is answered as `external:invalidSettings` naming the member rather than as an unparseable payload. Never a secret: every value here is returned to anyone who may read the account. Branches are referred to by their `model` (\"the `sui-signer` settings\"). They carry no `title`, so that every binding renders each as a plain variant of this union.",
/// "oneOf": [
/// {
/// "description": "Egress: `rolesanywhere.<region>.amazonaws.com`, plus `sts.<region>.amazonaws.com` when `chainedRoleArn` is set.",
/// "type": "object",
/// "required": [
/// "model",
/// "profileArn",
/// "region",
/// "roleArn",
/// "trustAnchorArn"
/// ],
/// "properties": {
/// "bucket": {
/// "description": "The S3 bucket issuances are scoped within. Required for an account whose bindings issue storage scopes.",
/// "$ref": "#/definitions/ProviderBucketName"
/// },
/// "chainedRoleArn": {
/// "description": "When set, every issuance chains an AssumeRole into this role carrying the downscoping session policy, for deployments whose Roles Anywhere profile cannot carry one per request. Caps a credential at one hour.",
/// "$ref": "#/definitions/AwsArn"
/// },
/// "model": {
/// "type": "string",
/// "const": "aws-roles-anywhere"
/// },
/// "probePrefix": {
/// "description": "Where external/accounts/probe writes its canary when no binding names a narrower prefix. Lets a new account be probed before anything is bound to it. Absent, a probe of an account with no bindings stops after `exchange` and reports `complete: false`.",
/// "$ref": "#/definitions/ProviderObjectPrefix"
/// },
/// "profileArn": {
/// "$ref": "#/definitions/AwsArn"
/// },
/// "region": {
/// "$ref": "#/definitions/AwsRegion"
/// },
/// "roleArn": {
/// "$ref": "#/definitions/AwsArn"
/// },
/// "trustAnchorArn": {
/// "description": "The trust anchor holding the custodian's CA certificate. Recorded after the administrator creates it from external/accounts/setup.",
/// "$ref": "#/definitions/AwsArn"
/// }
/// },
/// "additionalProperties": false
/// },
/// {
/// "description": "Egress: `sts.googleapis.com`, plus `iamcredentials.googleapis.com` when `serviceAccount` is set.",
/// "type": "object",
/// "required": [
/// "model",
/// "poolId",
/// "projectNumber",
/// "providerId"
/// ],
/// "properties": {
/// "bucket": {
/// "description": "The GCS bucket issuances are scoped within, by a Credential Access Boundary.",
/// "$ref": "#/definitions/ProviderBucketName"
/// },
/// "model": {
/// "type": "string",
/// "const": "gcp-wif-pinned"
/// },
/// "poolId": {
/// "type": "string",
/// "pattern": "^[a-z0-9-]{4,32}$"
/// },
/// "probePrefix": {
/// "description": "Where external/accounts/probe writes its canary when no binding names a narrower prefix. Lets a new account be probed before anything is bound to it. Absent, a probe of an account with no bindings stops after `exchange` and reports `complete: false`.",
/// "$ref": "#/definitions/ProviderObjectPrefix"
/// },
/// "projectNumber": {
/// "type": "string",
/// "pattern": "^[0-9]{1,20}$"
/// },
/// "providerId": {
/// "type": "string",
/// "pattern": "^[a-z0-9-]{4,32}$"
/// },
/// "serviceAccount": {
/// "description": "When set, the federated token is exchanged for this service account's access token.",
/// "type": "string",
/// "maxLength": 254,
/// "pattern": "^[a-z0-9-]+@[a-z0-9-]+\\.iam\\.gserviceaccount\\.com$"
/// },
/// "signingAlgorithm": {
/// "description": "The ID-token algorithm. ES256 unless the provider refuses it. Absent means ES256.",
/// "type": "string",
/// "enum": [
/// "ES256",
/// "RS256"
/// ]
/// }
/// },
/// "additionalProperties": false
/// },
/// {
/// "description": "Egress: `login.microsoftonline.com`, or the sovereign-cloud authority named in `authorityHost`.",
/// "type": "object",
/// "required": [
/// "clientId",
/// "model",
/// "tenantId",
/// "tokenScope"
/// ],
/// "properties": {
/// "authorityHost": {
/// "description": "Absent means `login.microsoftonline.com`.",
/// "type": "string",
/// "maxLength": 253,
/// "pattern": "^[a-z0-9.-]+$"
/// },
/// "clientId": {
/// "type": "string",
/// "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
/// },
/// "model": {
/// "type": "string",
/// "const": "azure-cert"
/// },
/// "tenantId": {
/// "type": "string",
/// "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
/// },
/// "tokenScope": {
/// "description": "The `scope` requested at the token endpoint, such as `https://storage.azure.com/.default`.",
/// "type": "string",
/// "maxLength": 512,
/// "pattern": "^[A-Za-z0-9:/._-]+$"
/// }
/// },
/// "additionalProperties": false
/// },
/// {
/// "description": "Egress: the host of `tokenEndpoint`, and nothing else.",
/// "type": "object",
/// "required": [
/// "clientId",
/// "model",
/// "tokenEndpoint"
/// ],
/// "properties": {
/// "audience": {
/// "description": "The assertion's `aud`. Absent means `tokenEndpoint`.",
/// "type": "string",
/// "maxLength": 2048,
/// "pattern": "^[!-~]+$"
/// },
/// "clientId": {
/// "type": "string",
/// "maxLength": 512,
/// "minLength": 1,
/// "pattern": "^[!-~]+$"
/// },
/// "model": {
/// "type": "string",
/// "const": "oauth2-private-key-jwt"
/// },
/// "scopes": {
/// "description": "The scopes a binding may request, the ceiling for every issuance.",
/// "type": "array",
/// "items": {
/// "type": "string",
/// "maxLength": 256,
/// "pattern": "^[!#-\\[\\]-~]+$"
/// },
/// "maxItems": 64,
/// "uniqueItems": true
/// },
/// "signingAlgorithm": {
/// "type": "string",
/// "enum": [
/// "ES256",
/// "RS256"
/// ]
/// },
/// "tokenEndpoint": {
/// "$ref": "#/definitions/ProviderHttpsUrl"
/// }
/// },
/// "additionalProperties": false
/// },
/// {
/// "description": "Issuance needs no egress: presigning is a computation inside the custodian, and the consumer uses the URL itself. The probe connects to the host of `endpoint`, which `egressHosts` therefore lists.",
/// "type": "object",
/// "required": [
/// "accessKeyId",
/// "bucket",
/// "endpoint",
/// "model",
/// "region"
/// ],
/// "properties": {
/// "accessKeyId": {
/// "description": "The access key's identifier. Not a secret: it appears in every presigned URL. The secret half is set with external/accounts/secret/set and never returned.",
/// "type": "string",
/// "maxLength": 128,
/// "pattern": "^[A-Za-z0-9]+$"
/// },
/// "bucket": {
/// "$ref": "#/definitions/ProviderBucketName"
/// },
/// "endpoint": {
/// "$ref": "#/definitions/ProviderHttpsUrl"
/// },
/// "model": {
/// "type": "string",
/// "const": "s3-static-presign"
/// },
/// "pathStyle": {
/// "description": "Address the bucket in the path rather than the host name, as MinIO usually needs.",
/// "type": "boolean"
/// },
/// "probePrefix": {
/// "description": "Where external/accounts/probe writes its canary when no binding names a narrower prefix. Lets a new account be probed before anything is bound to it. Absent, a probe of an account with no bindings stops after `exchange` and reports `complete: false`.",
/// "$ref": "#/definitions/ProviderObjectPrefix"
/// },
/// "region": {
/// "description": "The SigV4 signing region; `auto` for Cloudflare R2.",
/// "type": "string",
/// "maxLength": 64,
/// "pattern": "^[a-z0-9-]+$"
/// }
/// },
/// "additionalProperties": false
/// },
/// {
/// "description": "No egress: the custodian signs and the consumer submits the transaction. The allow-list, the gas caps and the coin caps are the account's whole authority; a transaction outside them is refused before anything is signed.",
/// "type": "object",
/// "required": [
/// "allowedCalls",
/// "maxGasBudgetMist",
/// "maxGasPerDayMist",
/// "model",
/// "network"
/// ],
/// "properties": {
/// "allowedCalls": {
/// "description": "Every MoveCall command in a signed transaction must name one of these. For Walrus storage: the system package's `register_blob`, `certify_blob`, `extend_blob` and `delete_blob`, and the coin calls needed to pay for them.",
/// "type": "array",
/// "items": {
/// "$ref": "#/definitions/SuiMoveCall"
/// },
/// "maxItems": 32,
/// "minItems": 1
/// },
/// "allowedObjects": {
/// "description": "Shared objects a transaction may take as input, such as the Walrus system and staking objects. Absent means any object the allowed calls accept.",
/// "type": "array",
/// "items": {
/// "type": "string",
/// "pattern": "^0x[0-9a-f]{64}$"
/// },
/// "maxItems": 32
/// },
/// "maxCoinOutPerTx": {
/// "description": "Per coin type, the most a single transaction may spend or transfer out of the account's address, in the coin's smallest unit. A coin type not listed may not leave the address at all.",
/// "type": "array",
/// "items": {
/// "type": "object",
/// "required": [
/// "amount",
/// "coinType"
/// ],
/// "properties": {
/// "amount": {
/// "type": "integer",
/// "minimum": 0.0
/// },
/// "coinType": {
/// "type": "string",
/// "maxLength": 512,
/// "pattern": "^0x[0-9a-f]{1,64}::[A-Za-z0-9_]+::[A-Za-z0-9_]+$"
/// }
/// },
/// "additionalProperties": false
/// },
/// "maxItems": 8
/// },
/// "maxGasBudgetMist": {
/// "description": "The largest gas budget one transaction may declare.",
/// "type": "integer",
/// "minimum": 1.0
/// },
/// "maxGasPerDayMist": {
/// "description": "The total gas budget signed per rolling 24 hours.",
/// "type": "integer",
/// "minimum": 1.0
/// },
/// "model": {
/// "type": "string",
/// "const": "sui-signer"
/// },
/// "network": {
/// "type": "string",
/// "enum": [
/// "mainnet",
/// "testnet",
/// "devnet"
/// ]
/// }
/// },
/// "additionalProperties": false
/// },
/// {
/// "description": "Egress: the host of `baseUrl`. The secret is set with external/accounts/secret/set and used only inside the custodian by `driver`; a provider reachable only by handing the consumer the raw key is not supported.",
/// "type": "object",
/// "required": [
/// "baseUrl",
/// "driver",
/// "model"
/// ],
/// "properties": {
/// "baseUrl": {
/// "$ref": "#/definitions/ProviderHttpsUrl"
/// },
/// "driver": {
/// "description": "The custodian's driver that uses the secret: performs a login or token exchange and returns a short-lived result. A custodian refuses a driver it does not implement.",
/// "type": "string",
/// "maxLength": 64,
/// "pattern": "^[a-z0-9][a-z0-9-]*$"
/// },
/// "model": {
/// "type": "string",
/// "const": "static-secret"
/// }
/// },
/// "additionalProperties": false
/// }
/// ]
///}
/// ```
/// </details>
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(tag = "model", deny_unknown_fields)]
#[non_exhaustive]
pub enum AccountSettings {
///Egress: `rolesanywhere.<region>.amazonaws.com`, plus `sts.<region>.amazonaws.com` when `chainedRoleArn` is set.
#[serde(rename = "aws-roles-anywhere")]
AwsRolesAnywhere {
///The S3 bucket issuances are scoped within. Required for an account whose bindings issue storage scopes.
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
bucket: ::std::option::Option<ProviderBucketName>,
///When set, every issuance chains an AssumeRole into this role carrying the downscoping session policy, for deployments whose Roles Anywhere profile cannot carry one per request. Caps a credential at one hour.
#[serde(
rename = "chainedRoleArn",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
chained_role_arn: ::std::option::Option<AwsArn>,
///Where external/accounts/probe writes its canary when no binding names a narrower prefix. Lets a new account be probed before anything is bound to it. Absent, a probe of an account with no bindings stops after `exchange` and reports `complete: false`.
#[serde(
rename = "probePrefix",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
probe_prefix: ::std::option::Option<ProviderObjectPrefix>,
#[serde(rename = "profileArn")]
profile_arn: AwsArn,
region: AwsRegion,
#[serde(rename = "roleArn")]
role_arn: AwsArn,
///The trust anchor holding the custodian's CA certificate. Recorded after the administrator creates it from external/accounts/setup.
#[serde(rename = "trustAnchorArn")]
trust_anchor_arn: AwsArn,
},
///Egress: `sts.googleapis.com`, plus `iamcredentials.googleapis.com` when `serviceAccount` is set.
#[serde(rename = "gcp-wif-pinned")]
GcpWifPinned {
///The GCS bucket issuances are scoped within, by a Credential Access Boundary.
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
bucket: ::std::option::Option<ProviderBucketName>,
#[serde(rename = "poolId")]
pool_id: AccountSettingsPoolId,
///Where external/accounts/probe writes its canary when no binding names a narrower prefix. Lets a new account be probed before anything is bound to it. Absent, a probe of an account with no bindings stops after `exchange` and reports `complete: false`.
#[serde(
rename = "probePrefix",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
probe_prefix: ::std::option::Option<ProviderObjectPrefix>,
#[serde(rename = "projectNumber")]
project_number: AccountSettingsProjectNumber,
#[serde(rename = "providerId")]
provider_id: AccountSettingsProviderId,
///When set, the federated token is exchanged for this service account's access token.
#[serde(
rename = "serviceAccount",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
service_account: ::std::option::Option<AccountSettingsServiceAccount>,
///The ID-token algorithm. ES256 unless the provider refuses it. Absent means ES256.
#[serde(
rename = "signingAlgorithm",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
signing_algorithm: ::std::option::Option<AccountSettingsSigningAlgorithm>,
},
///Egress: `login.microsoftonline.com`, or the sovereign-cloud authority named in `authorityHost`.
#[serde(rename = "azure-cert")]
AzureCert {
///Absent means `login.microsoftonline.com`.
#[serde(
rename = "authorityHost",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
authority_host: ::std::option::Option<AccountSettingsAuthorityHost>,
#[serde(rename = "clientId")]
client_id: AccountSettingsClientId,
#[serde(rename = "tenantId")]
tenant_id: AccountSettingsTenantId,
///The `scope` requested at the token endpoint, such as `https://storage.azure.com/.default`.
#[serde(rename = "tokenScope")]
token_scope: AccountSettingsTokenScope,
},
///Egress: the host of `tokenEndpoint`, and nothing else.
#[serde(rename = "oauth2-private-key-jwt")]
Oauth2PrivateKeyJwt {
///The assertion's `aud`. Absent means `tokenEndpoint`.
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
audience: ::std::option::Option<AccountSettingsAudience>,
#[serde(rename = "clientId")]
client_id: AccountSettingsClientId,
///The scopes a binding may request, the ceiling for every issuance.
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
scopes: ::std::option::Option<Vec<AccountSettingsScopesItem>>,
#[serde(
rename = "signingAlgorithm",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
signing_algorithm: ::std::option::Option<AccountSettingsSigningAlgorithm>,
#[serde(rename = "tokenEndpoint")]
token_endpoint: ProviderHttpsUrl,
},
///Issuance needs no egress: presigning is a computation inside the custodian, and the consumer uses the URL itself. The probe connects to the host of `endpoint`, which `egressHosts` therefore lists.
#[serde(rename = "s3-static-presign")]
S3StaticPresign {
///The access key's identifier. Not a secret: it appears in every presigned URL. The secret half is set with external/accounts/secret/set and never returned.
#[serde(rename = "accessKeyId")]
access_key_id: AccountSettingsAccessKeyId,
bucket: ProviderBucketName,
endpoint: ProviderHttpsUrl,
///Address the bucket in the path rather than the host name, as MinIO usually needs.
#[serde(
rename = "pathStyle",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
path_style: ::std::option::Option<bool>,
///Where external/accounts/probe writes its canary when no binding names a narrower prefix. Lets a new account be probed before anything is bound to it. Absent, a probe of an account with no bindings stops after `exchange` and reports `complete: false`.
#[serde(
rename = "probePrefix",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
probe_prefix: ::std::option::Option<ProviderObjectPrefix>,
///The SigV4 signing region; `auto` for Cloudflare R2.
region: AccountSettingsRegion,
},
///No egress: the custodian signs and the consumer submits the transaction. The allow-list, the gas caps and the coin caps are the account's whole authority; a transaction outside them is refused before anything is signed.
#[serde(rename = "sui-signer")]
SuiSigner {
///Every MoveCall command in a signed transaction must name one of these. For Walrus storage: the system package's `register_blob`, `certify_blob`, `extend_blob` and `delete_blob`, and the coin calls needed to pay for them.
#[serde(rename = "allowedCalls")]
allowed_calls: ::std::vec::Vec<SuiMoveCall>,
///Shared objects a transaction may take as input, such as the Walrus system and staking objects. Absent means any object the allowed calls accept.
#[serde(
rename = "allowedObjects",
default,
skip_serializing_if = "::std::vec::Vec::is_empty"
)]
allowed_objects: ::std::vec::Vec<AccountSettingsAllowedObjectsItem>,
///Per coin type, the most a single transaction may spend or transfer out of the account's address, in the coin's smallest unit. A coin type not listed may not leave the address at all.
#[serde(
rename = "maxCoinOutPerTx",
default,
skip_serializing_if = "::std::vec::Vec::is_empty"
)]
max_coin_out_per_tx: ::std::vec::Vec<AccountSettingsMaxCoinOutPerTxItem>,
///The largest gas budget one transaction may declare.
#[serde(rename = "maxGasBudgetMist")]
max_gas_budget_mist: ::std::num::NonZeroU64,
///The total gas budget signed per rolling 24 hours.
#[serde(rename = "maxGasPerDayMist")]
max_gas_per_day_mist: ::std::num::NonZeroU64,
network: AccountSettingsNetwork,
},
///Egress: the host of `baseUrl`. The secret is set with external/accounts/secret/set and used only inside the custodian by `driver`; a provider reachable only by handing the consumer the raw key is not supported.
#[serde(rename = "static-secret")]
StaticSecret {
#[serde(rename = "baseUrl")]
base_url: ProviderHttpsUrl,
///The custodian's driver that uses the secret: performs a login or token exchange and returns a short-lived result. A custodian refuses a driver it does not implement.
driver: AccountSettingsDriver,
},
}
///The access key's identifier. Not a secret: it appears in every presigned URL. The secret half is set with external/accounts/secret/set and never returned.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "description": "The access key's identifier. Not a secret: it appears in every presigned URL. The secret half is set with external/accounts/secret/set and never returned.",
/// "type": "string",
/// "maxLength": 128,
/// "pattern": "^[A-Za-z0-9]+$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountSettingsAccessKeyId(::std::string::String);
impl ::std::ops::Deref for AccountSettingsAccessKeyId {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountSettingsAccessKeyId> for ::std::string::String {
fn from(value: AccountSettingsAccessKeyId) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountSettingsAccessKeyId {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 128usize {
return Err("longer than 128 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[A-Za-z0-9]+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[A-Za-z0-9]+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsAccessKeyId {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSettingsAccessKeyId {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsAccessKeyId {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountSettingsAccessKeyId {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AccountSettingsAllowedObjectsItem`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "pattern": "^0x[0-9a-f]{64}$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountSettingsAllowedObjectsItem(::std::string::String);
impl ::std::ops::Deref for AccountSettingsAllowedObjectsItem {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountSettingsAllowedObjectsItem> for ::std::string::String {
fn from(value: AccountSettingsAllowedObjectsItem) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountSettingsAllowedObjectsItem {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^0x[0-9a-f]{64}$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^0x[0-9a-f]{64}$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsAllowedObjectsItem {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSettingsAllowedObjectsItem {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsAllowedObjectsItem {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountSettingsAllowedObjectsItem {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///The assertion's `aud`. Absent means `tokenEndpoint`.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "description": "The assertion's `aud`. Absent means `tokenEndpoint`.",
/// "type": "string",
/// "maxLength": 2048,
/// "pattern": "^[!-~]+$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountSettingsAudience(::std::string::String);
impl ::std::ops::Deref for AccountSettingsAudience {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountSettingsAudience> for ::std::string::String {
fn from(value: AccountSettingsAudience) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountSettingsAudience {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 2048usize {
return Err("longer than 2048 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[!-~]+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[!-~]+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsAudience {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSettingsAudience {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsAudience {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountSettingsAudience {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///Absent means `login.microsoftonline.com`.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "description": "Absent means `login.microsoftonline.com`.",
/// "type": "string",
/// "maxLength": 253,
/// "pattern": "^[a-z0-9.-]+$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountSettingsAuthorityHost(::std::string::String);
impl ::std::ops::Deref for AccountSettingsAuthorityHost {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountSettingsAuthorityHost> for ::std::string::String {
fn from(value: AccountSettingsAuthorityHost) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountSettingsAuthorityHost {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 253usize {
return Err("longer than 253 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[a-z0-9.-]+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[a-z0-9.-]+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsAuthorityHost {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSettingsAuthorityHost {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsAuthorityHost {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountSettingsAuthorityHost {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AccountSettingsClientId`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountSettingsClientId(::std::string::String);
impl ::std::ops::Deref for AccountSettingsClientId {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountSettingsClientId> for ::std::string::String {
fn from(value: AccountSettingsClientId) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountSettingsClientId {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| {
::regress::Regex::new(
"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$",
)
.unwrap()
});
if PATTERN.find(value).is_none() {
return Err(
"doesn't match pattern \"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$\""
.into(),
);
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsClientId {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSettingsClientId {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsClientId {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountSettingsClientId {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///The custodian's driver that uses the secret: performs a login or token exchange and returns a short-lived result. A custodian refuses a driver it does not implement.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "description": "The custodian's driver that uses the secret: performs a login or token exchange and returns a short-lived result. A custodian refuses a driver it does not implement.",
/// "type": "string",
/// "maxLength": 64,
/// "pattern": "^[a-z0-9][a-z0-9-]*$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountSettingsDriver(::std::string::String);
impl ::std::ops::Deref for AccountSettingsDriver {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountSettingsDriver> for ::std::string::String {
fn from(value: AccountSettingsDriver) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountSettingsDriver {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 64usize {
return Err("longer than 64 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[a-z0-9][a-z0-9-]*$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[a-z0-9][a-z0-9-]*$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsDriver {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSettingsDriver {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsDriver {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountSettingsDriver {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AccountSettingsMaxCoinOutPerTxItem`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "object",
/// "required": [
/// "amount",
/// "coinType"
/// ],
/// "properties": {
/// "amount": {
/// "type": "integer",
/// "minimum": 0.0
/// },
/// "coinType": {
/// "type": "string",
/// "maxLength": 512,
/// "pattern": "^0x[0-9a-f]{1,64}::[A-Za-z0-9_]+::[A-Za-z0-9_]+$"
/// }
/// },
/// "additionalProperties": false
///}
/// ```
/// </details>
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct AccountSettingsMaxCoinOutPerTxItem {
pub amount: u64,
#[serde(rename = "coinType")]
pub coin_type: AccountSettingsMaxCoinOutPerTxItemCoinType,
}
impl AccountSettingsMaxCoinOutPerTxItem {
pub fn builder() -> builder::AccountSettingsMaxCoinOutPerTxItem {
Default::default()
}
}
///`AccountSettingsMaxCoinOutPerTxItemCoinType`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "maxLength": 512,
/// "pattern": "^0x[0-9a-f]{1,64}::[A-Za-z0-9_]+::[A-Za-z0-9_]+$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountSettingsMaxCoinOutPerTxItemCoinType(::std::string::String);
impl ::std::ops::Deref for AccountSettingsMaxCoinOutPerTxItemCoinType {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountSettingsMaxCoinOutPerTxItemCoinType> for ::std::string::String {
fn from(value: AccountSettingsMaxCoinOutPerTxItemCoinType) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountSettingsMaxCoinOutPerTxItemCoinType {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 512usize {
return Err("longer than 512 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| {
::regress::Regex::new("^0x[0-9a-f]{1,64}::[A-Za-z0-9_]+::[A-Za-z0-9_]+$").unwrap()
});
if PATTERN.find(value).is_none() {
return Err(
"doesn't match pattern \"^0x[0-9a-f]{1,64}::[A-Za-z0-9_]+::[A-Za-z0-9_]+$\"".into(),
);
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsMaxCoinOutPerTxItemCoinType {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String>
for AccountSettingsMaxCoinOutPerTxItemCoinType
{
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsMaxCoinOutPerTxItemCoinType {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountSettingsMaxCoinOutPerTxItemCoinType {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AccountSettingsNetwork`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "enum": [
/// "mainnet",
/// "testnet",
/// "devnet"
/// ]
///}
/// ```
/// </details>
#[derive(
::serde::Deserialize,
::serde::Serialize,
Clone,
Copy,
Debug,
Eq,
Hash,
Ord,
PartialEq,
PartialOrd,
)]
#[non_exhaustive]
pub enum AccountSettingsNetwork {
#[serde(rename = "mainnet")]
Mainnet,
#[serde(rename = "testnet")]
Testnet,
#[serde(rename = "devnet")]
Devnet,
}
impl ::std::fmt::Display for AccountSettingsNetwork {
fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> ::std::fmt::Result {
match *self {
Self::Mainnet => f.write_str("mainnet"),
Self::Testnet => f.write_str("testnet"),
Self::Devnet => f.write_str("devnet"),
}
}
}
impl ::std::str::FromStr for AccountSettingsNetwork {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
match value {
"mainnet" => Ok(Self::Mainnet),
"testnet" => Ok(Self::Testnet),
"devnet" => Ok(Self::Devnet),
_ => Err("invalid value".into()),
}
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsNetwork {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSettingsNetwork {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsNetwork {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
///`AccountSettingsPoolId`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "pattern": "^[a-z0-9-]{4,32}$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountSettingsPoolId(::std::string::String);
impl ::std::ops::Deref for AccountSettingsPoolId {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountSettingsPoolId> for ::std::string::String {
fn from(value: AccountSettingsPoolId) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountSettingsPoolId {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[a-z0-9-]{4,32}$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[a-z0-9-]{4,32}$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsPoolId {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSettingsPoolId {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsPoolId {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountSettingsPoolId {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AccountSettingsProjectNumber`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "pattern": "^[0-9]{1,20}$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountSettingsProjectNumber(::std::string::String);
impl ::std::ops::Deref for AccountSettingsProjectNumber {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountSettingsProjectNumber> for ::std::string::String {
fn from(value: AccountSettingsProjectNumber) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountSettingsProjectNumber {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[0-9]{1,20}$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[0-9]{1,20}$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsProjectNumber {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSettingsProjectNumber {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsProjectNumber {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountSettingsProjectNumber {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AccountSettingsProviderId`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "pattern": "^[a-z0-9-]{4,32}$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountSettingsProviderId(::std::string::String);
impl ::std::ops::Deref for AccountSettingsProviderId {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountSettingsProviderId> for ::std::string::String {
fn from(value: AccountSettingsProviderId) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountSettingsProviderId {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[a-z0-9-]{4,32}$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[a-z0-9-]{4,32}$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsProviderId {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSettingsProviderId {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsProviderId {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountSettingsProviderId {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///The SigV4 signing region; `auto` for Cloudflare R2.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "description": "The SigV4 signing region; `auto` for Cloudflare R2.",
/// "type": "string",
/// "maxLength": 64,
/// "pattern": "^[a-z0-9-]+$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountSettingsRegion(::std::string::String);
impl ::std::ops::Deref for AccountSettingsRegion {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountSettingsRegion> for ::std::string::String {
fn from(value: AccountSettingsRegion) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountSettingsRegion {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 64usize {
return Err("longer than 64 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[a-z0-9-]+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[a-z0-9-]+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsRegion {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSettingsRegion {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsRegion {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountSettingsRegion {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AccountSettingsScopesItem`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "maxLength": 256,
/// "pattern": "^[!#-\\[\\]-~]+$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountSettingsScopesItem(::std::string::String);
impl ::std::ops::Deref for AccountSettingsScopesItem {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountSettingsScopesItem> for ::std::string::String {
fn from(value: AccountSettingsScopesItem) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountSettingsScopesItem {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 256usize {
return Err("longer than 256 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[!#-\\[\\]-~]+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[!#-\\[\\]-~]+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsScopesItem {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSettingsScopesItem {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsScopesItem {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountSettingsScopesItem {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///When set, the federated token is exchanged for this service account's access token.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "description": "When set, the federated token is exchanged for this service account's access token.",
/// "type": "string",
/// "maxLength": 254,
/// "pattern": "^[a-z0-9-]+@[a-z0-9-]+\\.iam\\.gserviceaccount\\.com$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountSettingsServiceAccount(::std::string::String);
impl ::std::ops::Deref for AccountSettingsServiceAccount {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountSettingsServiceAccount> for ::std::string::String {
fn from(value: AccountSettingsServiceAccount) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountSettingsServiceAccount {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 254usize {
return Err("longer than 254 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| {
::regress::Regex::new("^[a-z0-9-]+@[a-z0-9-]+\\.iam\\.gserviceaccount\\.com$")
.unwrap()
});
if PATTERN.find(value).is_none() {
return Err(
"doesn't match pattern \"^[a-z0-9-]+@[a-z0-9-]+\\.iam\\.gserviceaccount\\.com$\""
.into(),
);
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsServiceAccount {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSettingsServiceAccount {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsServiceAccount {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountSettingsServiceAccount {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///The ID-token algorithm. ES256 unless the provider refuses it. Absent means ES256.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "description": "The ID-token algorithm. ES256 unless the provider refuses it. Absent means ES256.",
/// "type": "string",
/// "enum": [
/// "ES256",
/// "RS256"
/// ]
///}
/// ```
/// </details>
#[derive(
::serde::Deserialize,
::serde::Serialize,
Clone,
Copy,
Debug,
Eq,
Hash,
Ord,
PartialEq,
PartialOrd,
)]
#[non_exhaustive]
pub enum AccountSettingsSigningAlgorithm {
#[serde(rename = "ES256")]
Es256,
#[serde(rename = "RS256")]
Rs256,
}
impl ::std::fmt::Display for AccountSettingsSigningAlgorithm {
fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> ::std::fmt::Result {
match *self {
Self::Es256 => f.write_str("ES256"),
Self::Rs256 => f.write_str("RS256"),
}
}
}
impl ::std::str::FromStr for AccountSettingsSigningAlgorithm {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
match value {
"ES256" => Ok(Self::Es256),
"RS256" => Ok(Self::Rs256),
_ => Err("invalid value".into()),
}
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsSigningAlgorithm {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSettingsSigningAlgorithm {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsSigningAlgorithm {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
///`AccountSettingsTenantId`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountSettingsTenantId(::std::string::String);
impl ::std::ops::Deref for AccountSettingsTenantId {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountSettingsTenantId> for ::std::string::String {
fn from(value: AccountSettingsTenantId) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountSettingsTenantId {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| {
::regress::Regex::new(
"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$",
)
.unwrap()
});
if PATTERN.find(value).is_none() {
return Err(
"doesn't match pattern \"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$\""
.into(),
);
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsTenantId {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSettingsTenantId {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsTenantId {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountSettingsTenantId {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///The `scope` requested at the token endpoint, such as `https://storage.azure.com/.default`.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "description": "The `scope` requested at the token endpoint, such as `https://storage.azure.com/.default`.",
/// "type": "string",
/// "maxLength": 512,
/// "pattern": "^[A-Za-z0-9:/._-]+$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountSettingsTokenScope(::std::string::String);
impl ::std::ops::Deref for AccountSettingsTokenScope {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountSettingsTokenScope> for ::std::string::String {
fn from(value: AccountSettingsTokenScope) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountSettingsTokenScope {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 512usize {
return Err("longer than 512 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[A-Za-z0-9:/._-]+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[A-Za-z0-9:/._-]+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsTokenScope {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSettingsTokenScope {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsTokenScope {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountSettingsTokenScope {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`active`: usable by its bindings. `suspended`: every issuance and signature is refused at once; management reads continue; resumable. `archived`: hidden from default listings, refused for use, restorable. Deletion removes the record.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "AccountState",
/// "description": "`active`: usable by its bindings. `suspended`: every issuance and signature is refused at once; management reads continue; resumable. `archived`: hidden from default listings, refused for use, restorable. Deletion removes the record.",
/// "type": "string",
/// "enum": [
/// "active",
/// "suspended",
/// "archived"
/// ]
///}
/// ```
/// </details>
#[derive(
::serde::Deserialize,
::serde::Serialize,
Clone,
Copy,
Debug,
Eq,
Hash,
Ord,
PartialEq,
PartialOrd,
)]
#[non_exhaustive]
pub enum AccountState {
#[serde(rename = "active")]
Active,
#[serde(rename = "suspended")]
Suspended,
#[serde(rename = "archived")]
Archived,
}
impl ::std::fmt::Display for AccountState {
fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> ::std::fmt::Result {
match *self {
Self::Active => f.write_str("active"),
Self::Suspended => f.write_str("suspended"),
Self::Archived => f.write_str("archived"),
}
}
}
impl ::std::str::FromStr for AccountState {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
match value {
"active" => Ok(Self::Active),
"suspended" => Ok(Self::Suspended),
"archived" => Ok(Self::Archived),
_ => Err("invalid value".into()),
}
}
}
impl ::std::convert::TryFrom<&str> for AccountState {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountState {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountState {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
/**
How the account authenticates to its provider. Every model pins the custodian's verification material in the provider's own account, uploaded once, so no model requires the custodian to be reachable from the internet. `aws-roles-anywhere`: the custodian is the certificate authority of an IAM Roles Anywhere trust anchor, and signs CreateSession with a short-lived end-entity certificate it issued to the account's own key. `gcp-wif-pinned`: a Workload Identity Federation pool provider holds an uploaded JWKS; the custodian signs an ID token and exchanges it at Google's STS. `azure-cert`: a certificate uploaded to an Entra app registration; the custodian signs an RFC 7523 client assertion. `oauth2-private-key-jwt`: the same RFC 7523 client authentication against any token endpoint that registered the custodian's public key. `s3-static-presign`: an access-key pair for an S3-compatible store that cannot federate; the custodian presigns per-object URLs and never releases the key. `sui-signer`: a Sui address derived from the custodian's key; the custodian signs only allow-listed transactions. `static-secret`: an API key or token used inside the custodian by a named driver; last resort, never released.
Plain OpenID Connect discovery federation is deliberately absent. It works by the provider fetching the issuer's JWKS from a public URL, which either makes the custodian reachable from the internet or makes whoever hosts a copy of the JWKS able to mint credentials for every federated role.*/
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "AuthModel",
/// "description": "How the account authenticates to its provider. Every model pins the custodian's verification material in the provider's own account, uploaded once, so no model requires the custodian to be reachable from the internet. `aws-roles-anywhere`: the custodian is the certificate authority of an IAM Roles Anywhere trust anchor, and signs CreateSession with a short-lived end-entity certificate it issued to the account's own key. `gcp-wif-pinned`: a Workload Identity Federation pool provider holds an uploaded JWKS; the custodian signs an ID token and exchanges it at Google's STS. `azure-cert`: a certificate uploaded to an Entra app registration; the custodian signs an RFC 7523 client assertion. `oauth2-private-key-jwt`: the same RFC 7523 client authentication against any token endpoint that registered the custodian's public key. `s3-static-presign`: an access-key pair for an S3-compatible store that cannot federate; the custodian presigns per-object URLs and never releases the key. `sui-signer`: a Sui address derived from the custodian's key; the custodian signs only allow-listed transactions. `static-secret`: an API key or token used inside the custodian by a named driver; last resort, never released.\n\nPlain OpenID Connect discovery federation is deliberately absent. It works by the provider fetching the issuer's JWKS from a public URL, which either makes the custodian reachable from the internet or makes whoever hosts a copy of the JWKS able to mint credentials for every federated role.",
/// "type": "string",
/// "enum": [
/// "aws-roles-anywhere",
/// "gcp-wif-pinned",
/// "azure-cert",
/// "oauth2-private-key-jwt",
/// "s3-static-presign",
/// "sui-signer",
/// "static-secret"
/// ]
///}
/// ```
/// </details>
#[derive(
::serde::Deserialize,
::serde::Serialize,
Clone,
Copy,
Debug,
Eq,
Hash,
Ord,
PartialEq,
PartialOrd,
)]
#[non_exhaustive]
pub enum AuthModel {
#[serde(rename = "aws-roles-anywhere")]
AwsRolesAnywhere,
#[serde(rename = "gcp-wif-pinned")]
GcpWifPinned,
#[serde(rename = "azure-cert")]
AzureCert,
#[serde(rename = "oauth2-private-key-jwt")]
Oauth2PrivateKeyJwt,
#[serde(rename = "s3-static-presign")]
S3StaticPresign,
#[serde(rename = "sui-signer")]
SuiSigner,
#[serde(rename = "static-secret")]
StaticSecret,
}
impl ::std::fmt::Display for AuthModel {
fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> ::std::fmt::Result {
match *self {
Self::AwsRolesAnywhere => f.write_str("aws-roles-anywhere"),
Self::GcpWifPinned => f.write_str("gcp-wif-pinned"),
Self::AzureCert => f.write_str("azure-cert"),
Self::Oauth2PrivateKeyJwt => f.write_str("oauth2-private-key-jwt"),
Self::S3StaticPresign => f.write_str("s3-static-presign"),
Self::SuiSigner => f.write_str("sui-signer"),
Self::StaticSecret => f.write_str("static-secret"),
}
}
}
impl ::std::str::FromStr for AuthModel {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
match value {
"aws-roles-anywhere" => Ok(Self::AwsRolesAnywhere),
"gcp-wif-pinned" => Ok(Self::GcpWifPinned),
"azure-cert" => Ok(Self::AzureCert),
"oauth2-private-key-jwt" => Ok(Self::Oauth2PrivateKeyJwt),
"s3-static-presign" => Ok(Self::S3StaticPresign),
"sui-signer" => Ok(Self::SuiSigner),
"static-secret" => Ok(Self::StaticSecret),
_ => Err("invalid value".into()),
}
}
}
impl ::std::convert::TryFrom<&str> for AuthModel {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AuthModel {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AuthModel {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
///`AwsArn`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "AwsArn",
/// "type": "string",
/// "maxLength": 2048,
/// "pattern": "^arn:aws[a-z-]*:[a-z0-9-]+:[a-z0-9-]*:[0-9]{0,12}:[A-Za-z0-9+=,.@_/:-]+$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AwsArn(::std::string::String);
impl ::std::ops::Deref for AwsArn {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AwsArn> for ::std::string::String {
fn from(value: AwsArn) -> Self {
value.0
}
}
impl ::std::str::FromStr for AwsArn {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 2048usize {
return Err("longer than 2048 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| {
::regress::Regex::new(
"^arn:aws[a-z-]*:[a-z0-9-]+:[a-z0-9-]*:[0-9]{0,12}:[A-Za-z0-9+=,.@_/:-]+$",
)
.unwrap()
});
if PATTERN.find(value).is_none() {
return Err(
"doesn't match pattern \"^arn:aws[a-z-]*:[a-z0-9-]+:[a-z0-9-]*:[0-9]{0,12}:[A-Za-z0-9+=,.@_/:-]+$\""
.into(),
);
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AwsArn {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AwsArn {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AwsArn {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AwsArn {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AwsRegion`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "AwsRegion",
/// "type": "string",
/// "maxLength": 32,
/// "pattern": "^[a-z]{2}(-gov)?-[a-z]+-[0-9]$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AwsRegion(::std::string::String);
impl ::std::ops::Deref for AwsRegion {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AwsRegion> for ::std::string::String {
fn from(value: AwsRegion) -> Self {
value.0
}
}
impl ::std::str::FromStr for AwsRegion {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 32usize {
return Err("longer than 32 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| {
::regress::Regex::new("^[a-z]{2}(-gov)?-[a-z]+-[0-9]$").unwrap()
});
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[a-z]{2}(-gov)?-[a-z]+-[0-9]$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AwsRegion {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AwsRegion {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AwsRegion {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AwsRegion {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///The widest scope a binding's consumer may request. An issuance is inside the ceiling when its `prefix` begins with one of `prefixes`, every one of its `actions` is in `actions`, and every one of its `scopes` is in `scopes`. Absent members confer nothing: a ceiling with no `prefixes` permits no storage issuance.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "CredentialScopeCeiling",
/// "description": "The widest scope a binding's consumer may request. An issuance is inside the ceiling when its `prefix` begins with one of `prefixes`, every one of its `actions` is in `actions`, and every one of its `scopes` is in `scopes`. Absent members confer nothing: a ceiling with no `prefixes` permits no storage issuance.",
/// "type": "object",
/// "properties": {
/// "actions": {
/// "type": "array",
/// "items": {
/// "$ref": "#/definitions/ProviderObjectAction"
/// },
/// "maxItems": 3,
/// "minItems": 1,
/// "uniqueItems": true
/// },
/// "prefixes": {
/// "type": "array",
/// "items": {
/// "$ref": "#/definitions/ProviderObjectPrefix"
/// },
/// "maxItems": 64,
/// "minItems": 1,
/// "uniqueItems": true
/// },
/// "scopes": {
/// "type": "array",
/// "items": {
/// "type": "string",
/// "maxLength": 256,
/// "pattern": "^[!#-\\[\\]-~]+$"
/// },
/// "maxItems": 64,
/// "uniqueItems": true
/// }
/// },
/// "additionalProperties": false
///}
/// ```
/// </details>
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct CredentialScopeCeiling {
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub actions: ::std::option::Option<Vec<ProviderObjectAction>>,
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub prefixes: ::std::option::Option<Vec<ProviderObjectPrefix>>,
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub scopes: ::std::option::Option<Vec<CredentialScopeCeilingScopesItem>>,
}
impl ::std::default::Default for CredentialScopeCeiling {
fn default() -> Self {
Self {
actions: Default::default(),
prefixes: Default::default(),
scopes: Default::default(),
}
}
}
impl CredentialScopeCeiling {
pub fn builder() -> builder::CredentialScopeCeiling {
Default::default()
}
}
///`CredentialScopeCeilingScopesItem`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "maxLength": 256,
/// "pattern": "^[!#-\\[\\]-~]+$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct CredentialScopeCeilingScopesItem(::std::string::String);
impl ::std::ops::Deref for CredentialScopeCeilingScopesItem {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<CredentialScopeCeilingScopesItem> for ::std::string::String {
fn from(value: CredentialScopeCeilingScopesItem) -> Self {
value.0
}
}
impl ::std::str::FromStr for CredentialScopeCeilingScopesItem {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 256usize {
return Err("longer than 256 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[!#-\\[\\]-~]+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[!#-\\[\\]-~]+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for CredentialScopeCeilingScopesItem {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for CredentialScopeCeilingScopesItem {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for CredentialScopeCeilingScopesItem {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for CredentialScopeCeilingScopesItem {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
/**
A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.
Multihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.
This definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.
Restricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that "interoperability is not guaranteed between implementations using such values", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.*/
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "DigestMultibase",
/// "description": "A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.\n\nMultihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.\n\nThis definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.\n\nRestricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that \"interoperability is not guaranteed between implementations using such values\", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.",
/// "examples": [
/// "zQmbWqxBEKC3P8tqsKc98xmWNzrzDtRLMiMPL8wBuTGsMnR"
/// ],
/// "type": "string",
/// "minLength": 16,
/// "pattern": "^(z[1-9A-HJ-NP-Za-km-z]+|u[A-Za-z0-9_-]+)$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct DigestMultibase(::std::string::String);
impl ::std::ops::Deref for DigestMultibase {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<DigestMultibase> for ::std::string::String {
fn from(value: DigestMultibase) -> Self {
value.0
}
}
impl ::std::str::FromStr for DigestMultibase {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() < 16usize {
return Err("shorter than 16 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| {
::regress::Regex::new("^(z[1-9A-HJ-NP-Za-km-z]+|u[A-Za-z0-9_-]+)$").unwrap()
});
if PATTERN.find(value).is_none() {
return Err(
"doesn't match pattern \"^(z[1-9A-HJ-NP-Za-km-z]+|u[A-Za-z0-9_-]+)$\"".into(),
);
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for DigestMultibase {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for DigestMultibase {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for DigestMultibase {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for DigestMultibase {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "Ext",
/// "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
/// "type": "object",
/// "minProperties": 1,
/// "additionalProperties": true,
/// "propertyNames": {
/// "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
/// }
///}
/// ```
/// </details>
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(transparent)]
pub struct Ext(pub ::std::collections::HashMap<ExtKey, ::serde_json::Value>);
impl ::std::ops::Deref for Ext {
type Target = ::std::collections::HashMap<ExtKey, ::serde_json::Value>;
fn deref(&self) -> &::std::collections::HashMap<ExtKey, ::serde_json::Value> {
&self.0
}
}
impl ::std::convert::From<Ext> for ::std::collections::HashMap<ExtKey, ::serde_json::Value> {
fn from(value: Ext) -> Self {
value.0
}
}
impl ::std::convert::From<::std::collections::HashMap<ExtKey, ::serde_json::Value>> for Ext {
fn from(value: ::std::collections::HashMap<ExtKey, ::serde_json::Value>) -> Self {
Self(value)
}
}
///`ExtKey`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct ExtKey(::std::string::String);
impl ::std::ops::Deref for ExtKey {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<ExtKey> for ::std::string::String {
fn from(value: ExtKey) -> Self {
value.0
}
}
impl ::std::str::FromStr for ExtKey {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| {
::regress::Regex::new("^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$").unwrap()
});
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for ExtKey {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for ExtKey {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for ExtKey {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for ExtKey {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///An account as every read returns it. Contains no private key, no secret and no issued credential, to any reader.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "ExternalAccount",
/// "description": "An account as every read returns it. Contains no private key, no secret and no issued credential, to any reader.",
/// "type": "object",
/// "required": [
/// "bindings",
/// "context",
/// "createdAt",
/// "egressHosts",
/// "id",
/// "label",
/// "providerSetupRequired",
/// "settings",
/// "state",
/// "updatedAt"
/// ],
/// "properties": {
/// "bindings": {
/// "type": "array",
/// "items": {
/// "$ref": "#/definitions/AccountBinding"
/// },
/// "maxItems": 256
/// },
/// "context": {
/// "$ref": "#/definitions/AccountContextId"
/// },
/// "createdAt": {
/// "type": "string",
/// "format": "date-time"
/// },
/// "egressHosts": {
/// "description": "The provider hosts the custodian connects to on this account's behalf, derived by the custodian from its settings: the token or session endpoints issuance uses, and the destinations external/accounts/probe dials (the object store's host, for a storage model). The custodian MUST NOT connect anywhere else on the account's behalf, so an egress proxy can allow exactly this set. Empty only for a model that neither exchanges nor probes over the network.",
/// "type": "array",
/// "items": {
/// "type": "string",
/// "maxLength": 253,
/// "pattern": "^[a-z0-9.-]+$"
/// },
/// "maxItems": 8
/// },
/// "id": {
/// "$ref": "#/definitions/AccountId"
/// },
/// "label": {
/// "description": "Display name. Untrusted text: render it, never interpret it.",
/// "type": "string",
/// "maxLength": 128,
/// "minLength": 1
/// },
/// "lastProbe": {
/// "$ref": "#/definitions/AccountProbeReport"
/// },
/// "providerSetupRequired": {
/// "description": "True when the account cannot be used until its provider-side setup is redone: after a restore that could not carry its key or secret (a wrapped RSA key, a static secret), or after a rotation awaiting confirmation.",
/// "type": "boolean"
/// },
/// "publicMaterial": {
/// "description": "Absent for the static models, which hold a secret rather than a key.",
/// "$ref": "#/definitions/AccountPublicMaterial"
/// },
/// "secret": {
/// "description": "Static models only; absent until the secret is set.",
/// "$ref": "#/definitions/AccountSecretInfo"
/// },
/// "settings": {
/// "$ref": "#/definitions/AccountSettings"
/// },
/// "state": {
/// "$ref": "#/definitions/AccountState"
/// },
/// "updatedAt": {
/// "type": "string",
/// "format": "date-time"
/// }
/// },
/// "additionalProperties": false
///}
/// ```
/// </details>
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct ExternalAccount {
pub bindings: ::std::vec::Vec<AccountBinding>,
pub context: AccountContextId,
#[serde(rename = "createdAt")]
pub created_at: ::chrono::DateTime<::chrono::offset::Utc>,
///The provider hosts the custodian connects to on this account's behalf, derived by the custodian from its settings: the token or session endpoints issuance uses, and the destinations external/accounts/probe dials (the object store's host, for a storage model). The custodian MUST NOT connect anywhere else on the account's behalf, so an egress proxy can allow exactly this set. Empty only for a model that neither exchanges nor probes over the network.
#[serde(rename = "egressHosts")]
pub egress_hosts: ::std::vec::Vec<ExternalAccountEgressHostsItem>,
pub id: AccountId,
///Display name. Untrusted text: render it, never interpret it.
pub label: ExternalAccountLabel,
#[serde(
rename = "lastProbe",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
pub last_probe: ::std::option::Option<AccountProbeReport>,
///True when the account cannot be used until its provider-side setup is redone: after a restore that could not carry its key or secret (a wrapped RSA key, a static secret), or after a rotation awaiting confirmation.
#[serde(rename = "providerSetupRequired")]
pub provider_setup_required: bool,
///Absent for the static models, which hold a secret rather than a key.
#[serde(
rename = "publicMaterial",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
pub public_material: ::std::option::Option<AccountPublicMaterial>,
///Static models only; absent until the secret is set.
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub secret: ::std::option::Option<AccountSecretInfo>,
pub settings: AccountSettings,
pub state: AccountState,
#[serde(rename = "updatedAt")]
pub updated_at: ::chrono::DateTime<::chrono::offset::Utc>,
}
impl ExternalAccount {
pub fn builder() -> builder::ExternalAccount {
Default::default()
}
}
///`ExternalAccountEgressHostsItem`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "maxLength": 253,
/// "pattern": "^[a-z0-9.-]+$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct ExternalAccountEgressHostsItem(::std::string::String);
impl ::std::ops::Deref for ExternalAccountEgressHostsItem {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<ExternalAccountEgressHostsItem> for ::std::string::String {
fn from(value: ExternalAccountEgressHostsItem) -> Self {
value.0
}
}
impl ::std::str::FromStr for ExternalAccountEgressHostsItem {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 253usize {
return Err("longer than 253 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[a-z0-9.-]+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[a-z0-9.-]+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for ExternalAccountEgressHostsItem {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for ExternalAccountEgressHostsItem {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for ExternalAccountEgressHostsItem {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for ExternalAccountEgressHostsItem {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///Display name. Untrusted text: render it, never interpret it.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "description": "Display name. Untrusted text: render it, never interpret it.",
/// "type": "string",
/// "maxLength": 128,
/// "minLength": 1
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct ExternalAccountLabel(::std::string::String);
impl ::std::ops::Deref for ExternalAccountLabel {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<ExternalAccountLabel> for ::std::string::String {
fn from(value: ExternalAccountLabel) -> Self {
value.0
}
}
impl ::std::str::FromStr for ExternalAccountLabel {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 128usize {
return Err("longer than 128 characters".into());
}
if value.chars().count() < 1usize {
return Err("shorter than 1 characters".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for ExternalAccountLabel {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for ExternalAccountLabel {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for ExternalAccountLabel {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for ExternalAccountLabel {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///List the external accounts in a context. The outer document members are owned by the framework — SPEC §6.3.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "$id": "https://trusttasks.org/spec/external/accounts/list/0.1",
/// "title": "Payload",
/// "description": "List the external accounts in a context. The outer document members are owned by the framework — SPEC §6.3.",
/// "type": "object",
/// "required": [
/// "context"
/// ],
/// "properties": {
/// "context": {
/// "$ref": "#/definitions/AccountContextId"
/// },
/// "cursor": {
/// "description": "Opaque; quote the previous page's `nextCursor`.",
/// "type": "string",
/// "maxLength": 512,
/// "pattern": "^[A-Za-z0-9_-]+$"
/// },
/// "ext": {
/// "$ref": "#/definitions/Ext"
/// },
/// "limit": {
/// "type": "integer",
/// "maximum": 200.0,
/// "minimum": 1.0
/// },
/// "model": {
/// "$ref": "#/definitions/AuthModel"
/// },
/// "state": {
/// "description": "Only accounts in this state. Absent means `active` and `suspended`.",
/// "$ref": "#/definitions/AccountState"
/// }
/// },
/// "additionalProperties": false
///}
/// ```
/// </details>
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct Payload {
pub context: AccountContextId,
///Opaque; quote the previous page's `nextCursor`.
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub cursor: ::std::option::Option<PayloadCursor>,
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub ext: ::std::option::Option<Ext>,
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub limit: ::std::option::Option<::std::num::NonZeroU64>,
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub model: ::std::option::Option<AuthModel>,
///Only accounts in this state. Absent means `active` and `suspended`.
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub state: ::std::option::Option<AccountState>,
}
impl Payload {
pub fn builder() -> builder::Payload {
Default::default()
}
}
///Opaque; quote the previous page's `nextCursor`.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "description": "Opaque; quote the previous page's `nextCursor`.",
/// "type": "string",
/// "maxLength": 512,
/// "pattern": "^[A-Za-z0-9_-]+$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct PayloadCursor(::std::string::String);
impl ::std::ops::Deref for PayloadCursor {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<PayloadCursor> for ::std::string::String {
fn from(value: PayloadCursor) -> Self {
value.0
}
}
impl ::std::str::FromStr for PayloadCursor {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 512usize {
return Err("longer than 512 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[A-Za-z0-9_-]+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[A-Za-z0-9_-]+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for PayloadCursor {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for PayloadCursor {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for PayloadCursor {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for PayloadCursor {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///A bucket name as S3 and GCS accept it. Validated rather than free so that it can be placed in a provider policy without escaping.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "ProviderBucketName",
/// "description": "A bucket name as S3 and GCS accept it. Validated rather than free so that it can be placed in a provider policy without escaping.",
/// "type": "string",
/// "maxLength": 63,
/// "minLength": 3,
/// "pattern": "^[a-z0-9][a-z0-9.-]*[a-z0-9]$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct ProviderBucketName(::std::string::String);
impl ::std::ops::Deref for ProviderBucketName {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<ProviderBucketName> for ::std::string::String {
fn from(value: ProviderBucketName) -> Self {
value.0
}
}
impl ::std::str::FromStr for ProviderBucketName {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 63usize {
return Err("longer than 63 characters".into());
}
if value.chars().count() < 3usize {
return Err("shorter than 3 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| {
::regress::Regex::new("^[a-z0-9][a-z0-9.-]*[a-z0-9]$").unwrap()
});
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[a-z0-9][a-z0-9.-]*[a-z0-9]$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for ProviderBucketName {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for ProviderBucketName {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for ProviderBucketName {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for ProviderBucketName {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`ProviderHttpsUrl`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "ProviderHttpsUrl",
/// "type": "string",
/// "format": "uri",
/// "maxLength": 2048,
/// "pattern": "^https://[^\\s\"'\\\\]+$"
///}
/// ```
/// </details>
#[derive(
::serde::Deserialize, ::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd,
)]
#[serde(transparent)]
pub struct ProviderHttpsUrl(pub ::std::string::String);
impl ::std::ops::Deref for ProviderHttpsUrl {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<ProviderHttpsUrl> for ::std::string::String {
fn from(value: ProviderHttpsUrl) -> Self {
value.0
}
}
impl ::std::convert::From<::std::string::String> for ProviderHttpsUrl {
fn from(value: ::std::string::String) -> Self {
Self(value)
}
}
impl ::std::str::FromStr for ProviderHttpsUrl {
type Err = ::std::convert::Infallible;
fn from_str(value: &str) -> ::std::result::Result<Self, Self::Err> {
Ok(Self(value.to_string()))
}
}
impl ::std::fmt::Display for ProviderHttpsUrl {
fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> ::std::fmt::Result {
self.0.fmt(f)
}
}
///`put`: write an object. `get`: read one. `delete`: remove one. No list, ACL, policy or bucket-level action exists here, so none can be granted.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "ProviderObjectAction",
/// "description": "`put`: write an object. `get`: read one. `delete`: remove one. No list, ACL, policy or bucket-level action exists here, so none can be granted.",
/// "type": "string",
/// "enum": [
/// "put",
/// "get",
/// "delete"
/// ]
///}
/// ```
/// </details>
#[derive(
::serde::Deserialize,
::serde::Serialize,
Clone,
Copy,
Debug,
Eq,
Hash,
Ord,
PartialEq,
PartialOrd,
)]
#[non_exhaustive]
pub enum ProviderObjectAction {
#[serde(rename = "put")]
Put,
#[serde(rename = "get")]
Get,
#[serde(rename = "delete")]
Delete,
}
impl ::std::fmt::Display for ProviderObjectAction {
fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> ::std::fmt::Result {
match *self {
Self::Put => f.write_str("put"),
Self::Get => f.write_str("get"),
Self::Delete => f.write_str("delete"),
}
}
}
impl ::std::str::FromStr for ProviderObjectAction {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
match value {
"put" => Ok(Self::Put),
"get" => Ok(Self::Get),
"delete" => Ok(Self::Delete),
_ => Err("invalid value".into()),
}
}
}
impl ::std::convert::TryFrom<&str> for ProviderObjectAction {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for ProviderObjectAction {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for ProviderObjectAction {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
///An object-key prefix within the account's bucket: one or more segments of lowercase letters, digits, `.`, `_` and `-`, each beginning with a letter or digit and ending with `/`. No quote, backslash, wildcard, whitespace, `..` segment or empty segment can appear. That is deliberate: the custodian places this value inside a provider policy — an IAM session policy (JSON), a GCS Credential Access Boundary condition (CEL) — and a value able to carry a metacharacter can break out of the string it is placed in and widen the policy. That is a known class of defect (CVE-2026-42811, a CEL injection in downscoped GCS credentials). Even with this pattern, a custodian MUST build provider policies with the provider language's own encoder, never by string interpolation.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "ProviderObjectPrefix",
/// "description": "An object-key prefix within the account's bucket: one or more segments of lowercase letters, digits, `.`, `_` and `-`, each beginning with a letter or digit and ending with `/`. No quote, backslash, wildcard, whitespace, `..` segment or empty segment can appear. That is deliberate: the custodian places this value inside a provider policy — an IAM session policy (JSON), a GCS Credential Access Boundary condition (CEL) — and a value able to carry a metacharacter can break out of the string it is placed in and widen the policy. That is a known class of defect (CVE-2026-42811, a CEL injection in downscoped GCS credentials). Even with this pattern, a custodian MUST build provider policies with the provider language's own encoder, never by string interpolation.",
/// "type": "string",
/// "maxLength": 512,
/// "minLength": 2,
/// "pattern": "^([a-z0-9][a-z0-9._-]{0,127}/){1,16}$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct ProviderObjectPrefix(::std::string::String);
impl ::std::ops::Deref for ProviderObjectPrefix {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<ProviderObjectPrefix> for ::std::string::String {
fn from(value: ProviderObjectPrefix) -> Self {
value.0
}
}
impl ::std::str::FromStr for ProviderObjectPrefix {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 512usize {
return Err("longer than 512 characters".into());
}
if value.chars().count() < 2usize {
return Err("shorter than 2 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| {
::regress::Regex::new("^([a-z0-9][a-z0-9._-]{0,127}/){1,16}$").unwrap()
});
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^([a-z0-9][a-z0-9._-]{0,127}/){1,16}$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for ProviderObjectPrefix {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for ProviderObjectPrefix {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for ProviderObjectPrefix {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for ProviderObjectPrefix {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`Response`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "Response",
/// "type": "object",
/// "required": [
/// "accounts"
/// ],
/// "properties": {
/// "accounts": {
/// "type": "array",
/// "items": {
/// "$ref": "#/definitions/ExternalAccount"
/// },
/// "maxItems": 200
/// },
/// "ext": {
/// "$ref": "#/definitions/Ext"
/// },
/// "nextCursor": {
/// "type": "string",
/// "maxLength": 512,
/// "pattern": "^[A-Za-z0-9_-]+$"
/// }
/// },
/// "additionalProperties": false,
/// "$anchor": "response"
///}
/// ```
/// </details>
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct Response {
pub accounts: ::std::vec::Vec<ExternalAccount>,
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub ext: ::std::option::Option<Ext>,
#[serde(
rename = "nextCursor",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
pub next_cursor: ::std::option::Option<ResponseNextCursor>,
}
impl Response {
pub fn builder() -> builder::Response {
Default::default()
}
}
///`ResponseNextCursor`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "maxLength": 512,
/// "pattern": "^[A-Za-z0-9_-]+$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct ResponseNextCursor(::std::string::String);
impl ::std::ops::Deref for ResponseNextCursor {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<ResponseNextCursor> for ::std::string::String {
fn from(value: ResponseNextCursor) -> Self {
value.0
}
}
impl ::std::str::FromStr for ResponseNextCursor {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 512usize {
return Err("longer than 512 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[A-Za-z0-9_-]+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[A-Za-z0-9_-]+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for ResponseNextCursor {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for ResponseNextCursor {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for ResponseNextCursor {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for ResponseNextCursor {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///Which secret is set, without being a way to test guesses at it. `hmacsha256:` followed by the base64url encoding, without padding, of the first 16 bytes of HMAC-SHA256 over the secret's bytes under a fingerprint key the custodian holds and never discloses. Comparable only between fingerprints made by the same custodian: a re-entered value can be confirmed, while the same secret at two custodians gives unrelated fingerprints. Never a bare hash of the secret, which would let anyone who reads it run a dictionary against it offline; and deliberately not a DigestMultibase, since multihash has no code for a keyed digest.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "SecretFingerprint",
/// "description": "Which secret is set, without being a way to test guesses at it. `hmacsha256:` followed by the base64url encoding, without padding, of the first 16 bytes of HMAC-SHA256 over the secret's bytes under a fingerprint key the custodian holds and never discloses. Comparable only between fingerprints made by the same custodian: a re-entered value can be confirmed, while the same secret at two custodians gives unrelated fingerprints. Never a bare hash of the secret, which would let anyone who reads it run a dictionary against it offline; and deliberately not a DigestMultibase, since multihash has no code for a keyed digest.",
/// "type": "string",
/// "maxLength": 33,
/// "pattern": "^hmacsha256:[A-Za-z0-9_-]{22}$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct SecretFingerprint(::std::string::String);
impl ::std::ops::Deref for SecretFingerprint {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<SecretFingerprint> for ::std::string::String {
fn from(value: SecretFingerprint) -> Self {
value.0
}
}
impl ::std::str::FromStr for SecretFingerprint {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 33usize {
return Err("longer than 33 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| {
::regress::Regex::new("^hmacsha256:[A-Za-z0-9_-]{22}$").unwrap()
});
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^hmacsha256:[A-Za-z0-9_-]{22}$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for SecretFingerprint {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for SecretFingerprint {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for SecretFingerprint {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for SecretFingerprint {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///One Move function an account's transactions may call.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "SuiMoveCall",
/// "description": "One Move function an account's transactions may call.",
/// "type": "object",
/// "required": [
/// "function",
/// "module",
/// "package"
/// ],
/// "properties": {
/// "function": {
/// "type": "string",
/// "pattern": "^[A-Za-z][A-Za-z0-9_]{0,127}$"
/// },
/// "module": {
/// "type": "string",
/// "pattern": "^[A-Za-z][A-Za-z0-9_]{0,127}$"
/// },
/// "package": {
/// "type": "string",
/// "pattern": "^0x[0-9a-f]{64}$"
/// }
/// },
/// "additionalProperties": false
///}
/// ```
/// </details>
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct SuiMoveCall {
pub function: SuiMoveCallFunction,
pub module: SuiMoveCallModule,
pub package: SuiMoveCallPackage,
}
impl SuiMoveCall {
pub fn builder() -> builder::SuiMoveCall {
Default::default()
}
}
///`SuiMoveCallFunction`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "pattern": "^[A-Za-z][A-Za-z0-9_]{0,127}$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct SuiMoveCallFunction(::std::string::String);
impl ::std::ops::Deref for SuiMoveCallFunction {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<SuiMoveCallFunction> for ::std::string::String {
fn from(value: SuiMoveCallFunction) -> Self {
value.0
}
}
impl ::std::str::FromStr for SuiMoveCallFunction {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| {
::regress::Regex::new("^[A-Za-z][A-Za-z0-9_]{0,127}$").unwrap()
});
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[A-Za-z][A-Za-z0-9_]{0,127}$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for SuiMoveCallFunction {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for SuiMoveCallFunction {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for SuiMoveCallFunction {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for SuiMoveCallFunction {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`SuiMoveCallModule`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "pattern": "^[A-Za-z][A-Za-z0-9_]{0,127}$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct SuiMoveCallModule(::std::string::String);
impl ::std::ops::Deref for SuiMoveCallModule {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<SuiMoveCallModule> for ::std::string::String {
fn from(value: SuiMoveCallModule) -> Self {
value.0
}
}
impl ::std::str::FromStr for SuiMoveCallModule {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| {
::regress::Regex::new("^[A-Za-z][A-Za-z0-9_]{0,127}$").unwrap()
});
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[A-Za-z][A-Za-z0-9_]{0,127}$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for SuiMoveCallModule {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for SuiMoveCallModule {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for SuiMoveCallModule {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for SuiMoveCallModule {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`SuiMoveCallPackage`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "pattern": "^0x[0-9a-f]{64}$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct SuiMoveCallPackage(::std::string::String);
impl ::std::ops::Deref for SuiMoveCallPackage {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<SuiMoveCallPackage> for ::std::string::String {
fn from(value: SuiMoveCallPackage) -> Self {
value.0
}
}
impl ::std::str::FromStr for SuiMoveCallPackage {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^0x[0-9a-f]{64}$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^0x[0-9a-f]{64}$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for SuiMoveCallPackage {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for SuiMoveCallPackage {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for SuiMoveCallPackage {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for SuiMoveCallPackage {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
/// Types for composing complex structures.
pub mod builder {
#[derive(Clone, Debug)]
pub struct AccountBinding {
consumer: ::std::result::Result<super::AccountBindingConsumer, ::std::string::String>,
granted_at: ::std::result::Result<
::std::option::Option<::chrono::DateTime<::chrono::offset::Utc>>,
::std::string::String,
>,
max_ttl_seconds: ::std::result::Result<i64, ::std::string::String>,
rate_per_minute: ::std::result::Result<::std::num::NonZeroU64, ::std::string::String>,
scope_ceiling: ::std::result::Result<
::std::option::Option<super::CredentialScopeCeiling>,
::std::string::String,
>,
source_cidrs: ::std::result::Result<
::std::vec::Vec<super::AccountBindingSourceCidrsItem>,
::std::string::String,
>,
}
impl ::std::default::Default for AccountBinding {
fn default() -> Self {
Self {
consumer: Err("no value supplied for consumer".to_string()),
granted_at: Ok(Default::default()),
max_ttl_seconds: Err("no value supplied for max_ttl_seconds".to_string()),
rate_per_minute: Err("no value supplied for rate_per_minute".to_string()),
scope_ceiling: Ok(Default::default()),
source_cidrs: Ok(Default::default()),
}
}
}
impl AccountBinding {
pub fn consumer<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::AccountBindingConsumer>,
T::Error: ::std::fmt::Display,
{
self.consumer = value
.try_into()
.map_err(|e| format!("error converting supplied value for consumer: {e}"));
self
}
pub fn granted_at<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<
::std::option::Option<::chrono::DateTime<::chrono::offset::Utc>>,
>,
T::Error: ::std::fmt::Display,
{
self.granted_at = value
.try_into()
.map_err(|e| format!("error converting supplied value for granted_at: {e}"));
self
}
pub fn max_ttl_seconds<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<i64>,
T::Error: ::std::fmt::Display,
{
self.max_ttl_seconds = value
.try_into()
.map_err(|e| format!("error converting supplied value for max_ttl_seconds: {e}"));
self
}
pub fn rate_per_minute<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::num::NonZeroU64>,
T::Error: ::std::fmt::Display,
{
self.rate_per_minute = value
.try_into()
.map_err(|e| format!("error converting supplied value for rate_per_minute: {e}"));
self
}
pub fn scope_ceiling<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<super::CredentialScopeCeiling>>,
T::Error: ::std::fmt::Display,
{
self.scope_ceiling = value
.try_into()
.map_err(|e| format!("error converting supplied value for scope_ceiling: {e}"));
self
}
pub fn source_cidrs<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::vec::Vec<super::AccountBindingSourceCidrsItem>>,
T::Error: ::std::fmt::Display,
{
self.source_cidrs = value
.try_into()
.map_err(|e| format!("error converting supplied value for source_cidrs: {e}"));
self
}
}
impl ::std::convert::TryFrom<AccountBinding> for super::AccountBinding {
type Error = super::error::ConversionError;
fn try_from(
value: AccountBinding,
) -> ::std::result::Result<Self, super::error::ConversionError> {
Ok(Self {
consumer: value.consumer?,
granted_at: value.granted_at?,
max_ttl_seconds: value.max_ttl_seconds?,
rate_per_minute: value.rate_per_minute?,
scope_ceiling: value.scope_ceiling?,
source_cidrs: value.source_cidrs?,
})
}
}
impl ::std::convert::From<super::AccountBinding> for AccountBinding {
fn from(value: super::AccountBinding) -> Self {
Self {
consumer: Ok(value.consumer),
granted_at: Ok(value.granted_at),
max_ttl_seconds: Ok(value.max_ttl_seconds),
rate_per_minute: Ok(value.rate_per_minute),
scope_ceiling: Ok(value.scope_ceiling),
source_cidrs: Ok(value.source_cidrs),
}
}
}
#[derive(Clone, Debug)]
pub struct AccountProbeReport {
at: ::std::result::Result<::chrono::DateTime<::chrono::offset::Utc>, ::std::string::String>,
complete: ::std::result::Result<bool, ::std::string::String>,
ok: ::std::result::Result<bool, ::std::string::String>,
steps: ::std::result::Result<
::std::vec::Vec<super::AccountProbeReportStepsItem>,
::std::string::String,
>,
}
impl ::std::default::Default for AccountProbeReport {
fn default() -> Self {
Self {
at: Err("no value supplied for at".to_string()),
complete: Err("no value supplied for complete".to_string()),
ok: Err("no value supplied for ok".to_string()),
steps: Err("no value supplied for steps".to_string()),
}
}
}
impl AccountProbeReport {
pub fn at<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::chrono::DateTime<::chrono::offset::Utc>>,
T::Error: ::std::fmt::Display,
{
self.at = value
.try_into()
.map_err(|e| format!("error converting supplied value for at: {e}"));
self
}
pub fn complete<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<bool>,
T::Error: ::std::fmt::Display,
{
self.complete = value
.try_into()
.map_err(|e| format!("error converting supplied value for complete: {e}"));
self
}
pub fn ok<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<bool>,
T::Error: ::std::fmt::Display,
{
self.ok = value
.try_into()
.map_err(|e| format!("error converting supplied value for ok: {e}"));
self
}
pub fn steps<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::vec::Vec<super::AccountProbeReportStepsItem>>,
T::Error: ::std::fmt::Display,
{
self.steps = value
.try_into()
.map_err(|e| format!("error converting supplied value for steps: {e}"));
self
}
}
impl ::std::convert::TryFrom<AccountProbeReport> for super::AccountProbeReport {
type Error = super::error::ConversionError;
fn try_from(
value: AccountProbeReport,
) -> ::std::result::Result<Self, super::error::ConversionError> {
Ok(Self {
at: value.at?,
complete: value.complete?,
ok: value.ok?,
steps: value.steps?,
})
}
}
impl ::std::convert::From<super::AccountProbeReport> for AccountProbeReport {
fn from(value: super::AccountProbeReport) -> Self {
Self {
at: Ok(value.at),
complete: Ok(value.complete),
ok: Ok(value.ok),
steps: Ok(value.steps),
}
}
}
#[derive(Clone, Debug)]
pub struct AccountProbeReportStepsItem {
duration_ms: ::std::result::Result<::std::option::Option<u64>, ::std::string::String>,
ok: ::std::result::Result<bool, ::std::string::String>,
provider_error: ::std::result::Result<
::std::option::Option<super::AccountProbeReportStepsItemProviderError>,
::std::string::String,
>,
provider_request_id: ::std::result::Result<
::std::option::Option<super::AccountProbeReportStepsItemProviderRequestId>,
::std::string::String,
>,
step: ::std::result::Result<super::AccountProbeStep, ::std::string::String>,
}
impl ::std::default::Default for AccountProbeReportStepsItem {
fn default() -> Self {
Self {
duration_ms: Ok(Default::default()),
ok: Err("no value supplied for ok".to_string()),
provider_error: Ok(Default::default()),
provider_request_id: Ok(Default::default()),
step: Err("no value supplied for step".to_string()),
}
}
}
impl AccountProbeReportStepsItem {
pub fn duration_ms<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<u64>>,
T::Error: ::std::fmt::Display,
{
self.duration_ms = value
.try_into()
.map_err(|e| format!("error converting supplied value for duration_ms: {e}"));
self
}
pub fn ok<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<bool>,
T::Error: ::std::fmt::Display,
{
self.ok = value
.try_into()
.map_err(|e| format!("error converting supplied value for ok: {e}"));
self
}
pub fn provider_error<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<
::std::option::Option<super::AccountProbeReportStepsItemProviderError>,
>,
T::Error: ::std::fmt::Display,
{
self.provider_error = value
.try_into()
.map_err(|e| format!("error converting supplied value for provider_error: {e}"));
self
}
pub fn provider_request_id<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<
::std::option::Option<super::AccountProbeReportStepsItemProviderRequestId>,
>,
T::Error: ::std::fmt::Display,
{
self.provider_request_id = value.try_into().map_err(|e| {
format!("error converting supplied value for provider_request_id: {e}")
});
self
}
pub fn step<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::AccountProbeStep>,
T::Error: ::std::fmt::Display,
{
self.step = value
.try_into()
.map_err(|e| format!("error converting supplied value for step: {e}"));
self
}
}
impl ::std::convert::TryFrom<AccountProbeReportStepsItem> for super::AccountProbeReportStepsItem {
type Error = super::error::ConversionError;
fn try_from(
value: AccountProbeReportStepsItem,
) -> ::std::result::Result<Self, super::error::ConversionError> {
Ok(Self {
duration_ms: value.duration_ms?,
ok: value.ok?,
provider_error: value.provider_error?,
provider_request_id: value.provider_request_id?,
step: value.step?,
})
}
}
impl ::std::convert::From<super::AccountProbeReportStepsItem> for AccountProbeReportStepsItem {
fn from(value: super::AccountProbeReportStepsItem) -> Self {
Self {
duration_ms: Ok(value.duration_ms),
ok: Ok(value.ok),
provider_error: Ok(value.provider_error),
provider_request_id: Ok(value.provider_request_id),
step: Ok(value.step),
}
}
}
#[derive(Clone, Debug)]
pub struct AccountPublicMaterial {
address: ::std::result::Result<
::std::option::Option<super::AccountPublicMaterialAddress>,
::std::string::String,
>,
algorithm:
::std::result::Result<super::AccountPublicMaterialAlgorithm, ::std::string::String>,
certificate_pem: ::std::result::Result<
::std::option::Option<super::AccountPublicMaterialCertificatePem>,
::std::string::String,
>,
key_fingerprint: ::std::result::Result<super::DigestMultibase, ::std::string::String>,
pending_key_fingerprint: ::std::result::Result<
::std::option::Option<super::DigestMultibase>,
::std::string::String,
>,
public_key_jwk: ::std::result::Result<
::std::option::Option<super::AccountPublicMaterialPublicKeyJwk>,
::std::string::String,
>,
}
impl ::std::default::Default for AccountPublicMaterial {
fn default() -> Self {
Self {
address: Ok(Default::default()),
algorithm: Err("no value supplied for algorithm".to_string()),
certificate_pem: Ok(Default::default()),
key_fingerprint: Err("no value supplied for key_fingerprint".to_string()),
pending_key_fingerprint: Ok(Default::default()),
public_key_jwk: Ok(Default::default()),
}
}
}
impl AccountPublicMaterial {
pub fn address<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<super::AccountPublicMaterialAddress>>,
T::Error: ::std::fmt::Display,
{
self.address = value
.try_into()
.map_err(|e| format!("error converting supplied value for address: {e}"));
self
}
pub fn algorithm<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::AccountPublicMaterialAlgorithm>,
T::Error: ::std::fmt::Display,
{
self.algorithm = value
.try_into()
.map_err(|e| format!("error converting supplied value for algorithm: {e}"));
self
}
pub fn certificate_pem<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<
::std::option::Option<super::AccountPublicMaterialCertificatePem>,
>,
T::Error: ::std::fmt::Display,
{
self.certificate_pem = value
.try_into()
.map_err(|e| format!("error converting supplied value for certificate_pem: {e}"));
self
}
pub fn key_fingerprint<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::DigestMultibase>,
T::Error: ::std::fmt::Display,
{
self.key_fingerprint = value
.try_into()
.map_err(|e| format!("error converting supplied value for key_fingerprint: {e}"));
self
}
pub fn pending_key_fingerprint<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<super::DigestMultibase>>,
T::Error: ::std::fmt::Display,
{
self.pending_key_fingerprint = value.try_into().map_err(|e| {
format!("error converting supplied value for pending_key_fingerprint: {e}")
});
self
}
pub fn public_key_jwk<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<
::std::option::Option<super::AccountPublicMaterialPublicKeyJwk>,
>,
T::Error: ::std::fmt::Display,
{
self.public_key_jwk = value
.try_into()
.map_err(|e| format!("error converting supplied value for public_key_jwk: {e}"));
self
}
}
impl ::std::convert::TryFrom<AccountPublicMaterial> for super::AccountPublicMaterial {
type Error = super::error::ConversionError;
fn try_from(
value: AccountPublicMaterial,
) -> ::std::result::Result<Self, super::error::ConversionError> {
Ok(Self {
address: value.address?,
algorithm: value.algorithm?,
certificate_pem: value.certificate_pem?,
key_fingerprint: value.key_fingerprint?,
pending_key_fingerprint: value.pending_key_fingerprint?,
public_key_jwk: value.public_key_jwk?,
})
}
}
impl ::std::convert::From<super::AccountPublicMaterial> for AccountPublicMaterial {
fn from(value: super::AccountPublicMaterial) -> Self {
Self {
address: Ok(value.address),
algorithm: Ok(value.algorithm),
certificate_pem: Ok(value.certificate_pem),
key_fingerprint: Ok(value.key_fingerprint),
pending_key_fingerprint: Ok(value.pending_key_fingerprint),
public_key_jwk: Ok(value.public_key_jwk),
}
}
}
#[derive(Clone, Debug)]
pub struct AccountPublicMaterialPublicKeyJwk {
alg: ::std::result::Result<
::std::option::Option<super::AccountPublicMaterialPublicKeyJwkAlg>,
::std::string::String,
>,
crv: ::std::result::Result<
::std::option::Option<super::AccountPublicMaterialPublicKeyJwkCrv>,
::std::string::String,
>,
e: ::std::result::Result<
::std::option::Option<super::AccountPublicMaterialPublicKeyJwkE>,
::std::string::String,
>,
kid: ::std::result::Result<
super::AccountPublicMaterialPublicKeyJwkKid,
::std::string::String,
>,
kty: ::std::result::Result<
super::AccountPublicMaterialPublicKeyJwkKty,
::std::string::String,
>,
n: ::std::result::Result<
::std::option::Option<super::AccountPublicMaterialPublicKeyJwkN>,
::std::string::String,
>,
use_: ::std::result::Result<
::std::option::Option<::std::string::String>,
::std::string::String,
>,
x: ::std::result::Result<
::std::option::Option<super::AccountPublicMaterialPublicKeyJwkX>,
::std::string::String,
>,
y: ::std::result::Result<
::std::option::Option<super::AccountPublicMaterialPublicKeyJwkY>,
::std::string::String,
>,
}
impl ::std::default::Default for AccountPublicMaterialPublicKeyJwk {
fn default() -> Self {
Self {
alg: Ok(Default::default()),
crv: Ok(Default::default()),
e: Ok(Default::default()),
kid: Err("no value supplied for kid".to_string()),
kty: Err("no value supplied for kty".to_string()),
n: Ok(Default::default()),
use_: Ok(Default::default()),
x: Ok(Default::default()),
y: Ok(Default::default()),
}
}
}
impl AccountPublicMaterialPublicKeyJwk {
pub fn alg<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<
::std::option::Option<super::AccountPublicMaterialPublicKeyJwkAlg>,
>,
T::Error: ::std::fmt::Display,
{
self.alg = value
.try_into()
.map_err(|e| format!("error converting supplied value for alg: {e}"));
self
}
pub fn crv<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<
::std::option::Option<super::AccountPublicMaterialPublicKeyJwkCrv>,
>,
T::Error: ::std::fmt::Display,
{
self.crv = value
.try_into()
.map_err(|e| format!("error converting supplied value for crv: {e}"));
self
}
pub fn e<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<
::std::option::Option<super::AccountPublicMaterialPublicKeyJwkE>,
>,
T::Error: ::std::fmt::Display,
{
self.e = value
.try_into()
.map_err(|e| format!("error converting supplied value for e: {e}"));
self
}
pub fn kid<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::AccountPublicMaterialPublicKeyJwkKid>,
T::Error: ::std::fmt::Display,
{
self.kid = value
.try_into()
.map_err(|e| format!("error converting supplied value for kid: {e}"));
self
}
pub fn kty<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::AccountPublicMaterialPublicKeyJwkKty>,
T::Error: ::std::fmt::Display,
{
self.kty = value
.try_into()
.map_err(|e| format!("error converting supplied value for kty: {e}"));
self
}
pub fn n<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<
::std::option::Option<super::AccountPublicMaterialPublicKeyJwkN>,
>,
T::Error: ::std::fmt::Display,
{
self.n = value
.try_into()
.map_err(|e| format!("error converting supplied value for n: {e}"));
self
}
pub fn use_<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<::std::string::String>>,
T::Error: ::std::fmt::Display,
{
self.use_ = value
.try_into()
.map_err(|e| format!("error converting supplied value for use_: {e}"));
self
}
pub fn x<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<
::std::option::Option<super::AccountPublicMaterialPublicKeyJwkX>,
>,
T::Error: ::std::fmt::Display,
{
self.x = value
.try_into()
.map_err(|e| format!("error converting supplied value for x: {e}"));
self
}
pub fn y<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<
::std::option::Option<super::AccountPublicMaterialPublicKeyJwkY>,
>,
T::Error: ::std::fmt::Display,
{
self.y = value
.try_into()
.map_err(|e| format!("error converting supplied value for y: {e}"));
self
}
}
impl ::std::convert::TryFrom<AccountPublicMaterialPublicKeyJwk>
for super::AccountPublicMaterialPublicKeyJwk
{
type Error = super::error::ConversionError;
fn try_from(
value: AccountPublicMaterialPublicKeyJwk,
) -> ::std::result::Result<Self, super::error::ConversionError> {
Ok(Self {
alg: value.alg?,
crv: value.crv?,
e: value.e?,
kid: value.kid?,
kty: value.kty?,
n: value.n?,
use_: value.use_?,
x: value.x?,
y: value.y?,
})
}
}
impl ::std::convert::From<super::AccountPublicMaterialPublicKeyJwk>
for AccountPublicMaterialPublicKeyJwk
{
fn from(value: super::AccountPublicMaterialPublicKeyJwk) -> Self {
Self {
alg: Ok(value.alg),
crv: Ok(value.crv),
e: Ok(value.e),
kid: Ok(value.kid),
kty: Ok(value.kty),
n: Ok(value.n),
use_: Ok(value.use_),
x: Ok(value.x),
y: Ok(value.y),
}
}
}
#[derive(Clone, Debug)]
pub struct AccountSecretInfo {
fingerprint: ::std::result::Result<super::SecretFingerprint, ::std::string::String>,
set_at:
::std::result::Result<::chrono::DateTime<::chrono::offset::Utc>, ::std::string::String>,
}
impl ::std::default::Default for AccountSecretInfo {
fn default() -> Self {
Self {
fingerprint: Err("no value supplied for fingerprint".to_string()),
set_at: Err("no value supplied for set_at".to_string()),
}
}
}
impl AccountSecretInfo {
pub fn fingerprint<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::SecretFingerprint>,
T::Error: ::std::fmt::Display,
{
self.fingerprint = value
.try_into()
.map_err(|e| format!("error converting supplied value for fingerprint: {e}"));
self
}
pub fn set_at<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::chrono::DateTime<::chrono::offset::Utc>>,
T::Error: ::std::fmt::Display,
{
self.set_at = value
.try_into()
.map_err(|e| format!("error converting supplied value for set_at: {e}"));
self
}
}
impl ::std::convert::TryFrom<AccountSecretInfo> for super::AccountSecretInfo {
type Error = super::error::ConversionError;
fn try_from(
value: AccountSecretInfo,
) -> ::std::result::Result<Self, super::error::ConversionError> {
Ok(Self {
fingerprint: value.fingerprint?,
set_at: value.set_at?,
})
}
}
impl ::std::convert::From<super::AccountSecretInfo> for AccountSecretInfo {
fn from(value: super::AccountSecretInfo) -> Self {
Self {
fingerprint: Ok(value.fingerprint),
set_at: Ok(value.set_at),
}
}
}
#[derive(Clone, Debug)]
pub struct AccountSettingsMaxCoinOutPerTxItem {
amount: ::std::result::Result<u64, ::std::string::String>,
coin_type: ::std::result::Result<
super::AccountSettingsMaxCoinOutPerTxItemCoinType,
::std::string::String,
>,
}
impl ::std::default::Default for AccountSettingsMaxCoinOutPerTxItem {
fn default() -> Self {
Self {
amount: Err("no value supplied for amount".to_string()),
coin_type: Err("no value supplied for coin_type".to_string()),
}
}
}
impl AccountSettingsMaxCoinOutPerTxItem {
pub fn amount<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<u64>,
T::Error: ::std::fmt::Display,
{
self.amount = value
.try_into()
.map_err(|e| format!("error converting supplied value for amount: {e}"));
self
}
pub fn coin_type<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::AccountSettingsMaxCoinOutPerTxItemCoinType>,
T::Error: ::std::fmt::Display,
{
self.coin_type = value
.try_into()
.map_err(|e| format!("error converting supplied value for coin_type: {e}"));
self
}
}
impl ::std::convert::TryFrom<AccountSettingsMaxCoinOutPerTxItem>
for super::AccountSettingsMaxCoinOutPerTxItem
{
type Error = super::error::ConversionError;
fn try_from(
value: AccountSettingsMaxCoinOutPerTxItem,
) -> ::std::result::Result<Self, super::error::ConversionError> {
Ok(Self {
amount: value.amount?,
coin_type: value.coin_type?,
})
}
}
impl ::std::convert::From<super::AccountSettingsMaxCoinOutPerTxItem>
for AccountSettingsMaxCoinOutPerTxItem
{
fn from(value: super::AccountSettingsMaxCoinOutPerTxItem) -> Self {
Self {
amount: Ok(value.amount),
coin_type: Ok(value.coin_type),
}
}
}
#[derive(Clone, Debug)]
pub struct CredentialScopeCeiling {
actions: ::std::result::Result<
::std::option::Option<Vec<super::ProviderObjectAction>>,
::std::string::String,
>,
prefixes: ::std::result::Result<
::std::option::Option<Vec<super::ProviderObjectPrefix>>,
::std::string::String,
>,
scopes: ::std::result::Result<
::std::option::Option<Vec<super::CredentialScopeCeilingScopesItem>>,
::std::string::String,
>,
}
impl ::std::default::Default for CredentialScopeCeiling {
fn default() -> Self {
Self {
actions: Ok(Default::default()),
prefixes: Ok(Default::default()),
scopes: Ok(Default::default()),
}
}
}
impl CredentialScopeCeiling {
pub fn actions<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<Vec<super::ProviderObjectAction>>>,
T::Error: ::std::fmt::Display,
{
self.actions = value
.try_into()
.map_err(|e| format!("error converting supplied value for actions: {e}"));
self
}
pub fn prefixes<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<Vec<super::ProviderObjectPrefix>>>,
T::Error: ::std::fmt::Display,
{
self.prefixes = value
.try_into()
.map_err(|e| format!("error converting supplied value for prefixes: {e}"));
self
}
pub fn scopes<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<
::std::option::Option<Vec<super::CredentialScopeCeilingScopesItem>>,
>,
T::Error: ::std::fmt::Display,
{
self.scopes = value
.try_into()
.map_err(|e| format!("error converting supplied value for scopes: {e}"));
self
}
}
impl ::std::convert::TryFrom<CredentialScopeCeiling> for super::CredentialScopeCeiling {
type Error = super::error::ConversionError;
fn try_from(
value: CredentialScopeCeiling,
) -> ::std::result::Result<Self, super::error::ConversionError> {
Ok(Self {
actions: value.actions?,
prefixes: value.prefixes?,
scopes: value.scopes?,
})
}
}
impl ::std::convert::From<super::CredentialScopeCeiling> for CredentialScopeCeiling {
fn from(value: super::CredentialScopeCeiling) -> Self {
Self {
actions: Ok(value.actions),
prefixes: Ok(value.prefixes),
scopes: Ok(value.scopes),
}
}
}
#[derive(Clone, Debug)]
pub struct ExternalAccount {
bindings:
::std::result::Result<::std::vec::Vec<super::AccountBinding>, ::std::string::String>,
context: ::std::result::Result<super::AccountContextId, ::std::string::String>,
created_at:
::std::result::Result<::chrono::DateTime<::chrono::offset::Utc>, ::std::string::String>,
egress_hosts: ::std::result::Result<
::std::vec::Vec<super::ExternalAccountEgressHostsItem>,
::std::string::String,
>,
id: ::std::result::Result<super::AccountId, ::std::string::String>,
label: ::std::result::Result<super::ExternalAccountLabel, ::std::string::String>,
last_probe: ::std::result::Result<
::std::option::Option<super::AccountProbeReport>,
::std::string::String,
>,
provider_setup_required: ::std::result::Result<bool, ::std::string::String>,
public_material: ::std::result::Result<
::std::option::Option<super::AccountPublicMaterial>,
::std::string::String,
>,
secret: ::std::result::Result<
::std::option::Option<super::AccountSecretInfo>,
::std::string::String,
>,
settings: ::std::result::Result<super::AccountSettings, ::std::string::String>,
state: ::std::result::Result<super::AccountState, ::std::string::String>,
updated_at:
::std::result::Result<::chrono::DateTime<::chrono::offset::Utc>, ::std::string::String>,
}
impl ::std::default::Default for ExternalAccount {
fn default() -> Self {
Self {
bindings: Err("no value supplied for bindings".to_string()),
context: Err("no value supplied for context".to_string()),
created_at: Err("no value supplied for created_at".to_string()),
egress_hosts: Err("no value supplied for egress_hosts".to_string()),
id: Err("no value supplied for id".to_string()),
label: Err("no value supplied for label".to_string()),
last_probe: Ok(Default::default()),
provider_setup_required: Err(
"no value supplied for provider_setup_required".to_string()
),
public_material: Ok(Default::default()),
secret: Ok(Default::default()),
settings: Err("no value supplied for settings".to_string()),
state: Err("no value supplied for state".to_string()),
updated_at: Err("no value supplied for updated_at".to_string()),
}
}
}
impl ExternalAccount {
pub fn bindings<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::vec::Vec<super::AccountBinding>>,
T::Error: ::std::fmt::Display,
{
self.bindings = value
.try_into()
.map_err(|e| format!("error converting supplied value for bindings: {e}"));
self
}
pub fn context<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::AccountContextId>,
T::Error: ::std::fmt::Display,
{
self.context = value
.try_into()
.map_err(|e| format!("error converting supplied value for context: {e}"));
self
}
pub fn created_at<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::chrono::DateTime<::chrono::offset::Utc>>,
T::Error: ::std::fmt::Display,
{
self.created_at = value
.try_into()
.map_err(|e| format!("error converting supplied value for created_at: {e}"));
self
}
pub fn egress_hosts<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::vec::Vec<super::ExternalAccountEgressHostsItem>>,
T::Error: ::std::fmt::Display,
{
self.egress_hosts = value
.try_into()
.map_err(|e| format!("error converting supplied value for egress_hosts: {e}"));
self
}
pub fn id<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::AccountId>,
T::Error: ::std::fmt::Display,
{
self.id = value
.try_into()
.map_err(|e| format!("error converting supplied value for id: {e}"));
self
}
pub fn label<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::ExternalAccountLabel>,
T::Error: ::std::fmt::Display,
{
self.label = value
.try_into()
.map_err(|e| format!("error converting supplied value for label: {e}"));
self
}
pub fn last_probe<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<super::AccountProbeReport>>,
T::Error: ::std::fmt::Display,
{
self.last_probe = value
.try_into()
.map_err(|e| format!("error converting supplied value for last_probe: {e}"));
self
}
pub fn provider_setup_required<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<bool>,
T::Error: ::std::fmt::Display,
{
self.provider_setup_required = value.try_into().map_err(|e| {
format!("error converting supplied value for provider_setup_required: {e}")
});
self
}
pub fn public_material<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<super::AccountPublicMaterial>>,
T::Error: ::std::fmt::Display,
{
self.public_material = value
.try_into()
.map_err(|e| format!("error converting supplied value for public_material: {e}"));
self
}
pub fn secret<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<super::AccountSecretInfo>>,
T::Error: ::std::fmt::Display,
{
self.secret = value
.try_into()
.map_err(|e| format!("error converting supplied value for secret: {e}"));
self
}
pub fn settings<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::AccountSettings>,
T::Error: ::std::fmt::Display,
{
self.settings = value
.try_into()
.map_err(|e| format!("error converting supplied value for settings: {e}"));
self
}
pub fn state<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::AccountState>,
T::Error: ::std::fmt::Display,
{
self.state = value
.try_into()
.map_err(|e| format!("error converting supplied value for state: {e}"));
self
}
pub fn updated_at<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::chrono::DateTime<::chrono::offset::Utc>>,
T::Error: ::std::fmt::Display,
{
self.updated_at = value
.try_into()
.map_err(|e| format!("error converting supplied value for updated_at: {e}"));
self
}
}
impl ::std::convert::TryFrom<ExternalAccount> for super::ExternalAccount {
type Error = super::error::ConversionError;
fn try_from(
value: ExternalAccount,
) -> ::std::result::Result<Self, super::error::ConversionError> {
Ok(Self {
bindings: value.bindings?,
context: value.context?,
created_at: value.created_at?,
egress_hosts: value.egress_hosts?,
id: value.id?,
label: value.label?,
last_probe: value.last_probe?,
provider_setup_required: value.provider_setup_required?,
public_material: value.public_material?,
secret: value.secret?,
settings: value.settings?,
state: value.state?,
updated_at: value.updated_at?,
})
}
}
impl ::std::convert::From<super::ExternalAccount> for ExternalAccount {
fn from(value: super::ExternalAccount) -> Self {
Self {
bindings: Ok(value.bindings),
context: Ok(value.context),
created_at: Ok(value.created_at),
egress_hosts: Ok(value.egress_hosts),
id: Ok(value.id),
label: Ok(value.label),
last_probe: Ok(value.last_probe),
provider_setup_required: Ok(value.provider_setup_required),
public_material: Ok(value.public_material),
secret: Ok(value.secret),
settings: Ok(value.settings),
state: Ok(value.state),
updated_at: Ok(value.updated_at),
}
}
}
#[derive(Clone, Debug)]
pub struct Payload {
context: ::std::result::Result<super::AccountContextId, ::std::string::String>,
cursor: ::std::result::Result<
::std::option::Option<super::PayloadCursor>,
::std::string::String,
>,
ext: ::std::result::Result<::std::option::Option<super::Ext>, ::std::string::String>,
limit: ::std::result::Result<
::std::option::Option<::std::num::NonZeroU64>,
::std::string::String,
>,
model:
::std::result::Result<::std::option::Option<super::AuthModel>, ::std::string::String>,
state: ::std::result::Result<
::std::option::Option<super::AccountState>,
::std::string::String,
>,
}
impl ::std::default::Default for Payload {
fn default() -> Self {
Self {
context: Err("no value supplied for context".to_string()),
cursor: Ok(Default::default()),
ext: Ok(Default::default()),
limit: Ok(Default::default()),
model: Ok(Default::default()),
state: Ok(Default::default()),
}
}
}
impl Payload {
pub fn context<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::AccountContextId>,
T::Error: ::std::fmt::Display,
{
self.context = value
.try_into()
.map_err(|e| format!("error converting supplied value for context: {e}"));
self
}
pub fn cursor<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<super::PayloadCursor>>,
T::Error: ::std::fmt::Display,
{
self.cursor = value
.try_into()
.map_err(|e| format!("error converting supplied value for cursor: {e}"));
self
}
pub fn ext<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<super::Ext>>,
T::Error: ::std::fmt::Display,
{
self.ext = value
.try_into()
.map_err(|e| format!("error converting supplied value for ext: {e}"));
self
}
pub fn limit<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<::std::num::NonZeroU64>>,
T::Error: ::std::fmt::Display,
{
self.limit = value
.try_into()
.map_err(|e| format!("error converting supplied value for limit: {e}"));
self
}
pub fn model<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<super::AuthModel>>,
T::Error: ::std::fmt::Display,
{
self.model = value
.try_into()
.map_err(|e| format!("error converting supplied value for model: {e}"));
self
}
pub fn state<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<super::AccountState>>,
T::Error: ::std::fmt::Display,
{
self.state = value
.try_into()
.map_err(|e| format!("error converting supplied value for state: {e}"));
self
}
}
impl ::std::convert::TryFrom<Payload> for super::Payload {
type Error = super::error::ConversionError;
fn try_from(value: Payload) -> ::std::result::Result<Self, super::error::ConversionError> {
Ok(Self {
context: value.context?,
cursor: value.cursor?,
ext: value.ext?,
limit: value.limit?,
model: value.model?,
state: value.state?,
})
}
}
impl ::std::convert::From<super::Payload> for Payload {
fn from(value: super::Payload) -> Self {
Self {
context: Ok(value.context),
cursor: Ok(value.cursor),
ext: Ok(value.ext),
limit: Ok(value.limit),
model: Ok(value.model),
state: Ok(value.state),
}
}
}
#[derive(Clone, Debug)]
pub struct Response {
accounts:
::std::result::Result<::std::vec::Vec<super::ExternalAccount>, ::std::string::String>,
ext: ::std::result::Result<::std::option::Option<super::Ext>, ::std::string::String>,
next_cursor: ::std::result::Result<
::std::option::Option<super::ResponseNextCursor>,
::std::string::String,
>,
}
impl ::std::default::Default for Response {
fn default() -> Self {
Self {
accounts: Err("no value supplied for accounts".to_string()),
ext: Ok(Default::default()),
next_cursor: Ok(Default::default()),
}
}
}
impl Response {
pub fn accounts<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::vec::Vec<super::ExternalAccount>>,
T::Error: ::std::fmt::Display,
{
self.accounts = value
.try_into()
.map_err(|e| format!("error converting supplied value for accounts: {e}"));
self
}
pub fn ext<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<super::Ext>>,
T::Error: ::std::fmt::Display,
{
self.ext = value
.try_into()
.map_err(|e| format!("error converting supplied value for ext: {e}"));
self
}
pub fn next_cursor<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<super::ResponseNextCursor>>,
T::Error: ::std::fmt::Display,
{
self.next_cursor = value
.try_into()
.map_err(|e| format!("error converting supplied value for next_cursor: {e}"));
self
}
}
impl ::std::convert::TryFrom<Response> for super::Response {
type Error = super::error::ConversionError;
fn try_from(value: Response) -> ::std::result::Result<Self, super::error::ConversionError> {
Ok(Self {
accounts: value.accounts?,
ext: value.ext?,
next_cursor: value.next_cursor?,
})
}
}
impl ::std::convert::From<super::Response> for Response {
fn from(value: super::Response) -> Self {
Self {
accounts: Ok(value.accounts),
ext: Ok(value.ext),
next_cursor: Ok(value.next_cursor),
}
}
}
#[derive(Clone, Debug)]
pub struct SuiMoveCall {
function: ::std::result::Result<super::SuiMoveCallFunction, ::std::string::String>,
module: ::std::result::Result<super::SuiMoveCallModule, ::std::string::String>,
package: ::std::result::Result<super::SuiMoveCallPackage, ::std::string::String>,
}
impl ::std::default::Default for SuiMoveCall {
fn default() -> Self {
Self {
function: Err("no value supplied for function".to_string()),
module: Err("no value supplied for module".to_string()),
package: Err("no value supplied for package".to_string()),
}
}
}
impl SuiMoveCall {
pub fn function<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::SuiMoveCallFunction>,
T::Error: ::std::fmt::Display,
{
self.function = value
.try_into()
.map_err(|e| format!("error converting supplied value for function: {e}"));
self
}
pub fn module<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::SuiMoveCallModule>,
T::Error: ::std::fmt::Display,
{
self.module = value
.try_into()
.map_err(|e| format!("error converting supplied value for module: {e}"));
self
}
pub fn package<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::SuiMoveCallPackage>,
T::Error: ::std::fmt::Display,
{
self.package = value
.try_into()
.map_err(|e| format!("error converting supplied value for package: {e}"));
self
}
}
impl ::std::convert::TryFrom<SuiMoveCall> for super::SuiMoveCall {
type Error = super::error::ConversionError;
fn try_from(
value: SuiMoveCall,
) -> ::std::result::Result<Self, super::error::ConversionError> {
Ok(Self {
function: value.function?,
module: value.module?,
package: value.package?,
})
}
}
impl ::std::convert::From<super::SuiMoveCall> for SuiMoveCall {
fn from(value: super::SuiMoveCall) -> Self {
Self {
function: Ok(value.function),
module: Ok(value.module),
package: Ok(value.package),
}
}
}
}
impl crate::Payload for Payload {
const TYPE_URI: &'static str = "https://trusttasks.org/spec/external/accounts/list/0.1";
const IS_RECIPIENT_REQUIRED: bool = true;
const PAYLOAD_SCHEMA: Option<&'static str> = Some(
"{\n \"$defs\": {\n \"AccountBinding\": {\n \"additionalProperties\": false,\n \"description\": \"Who may use an account, and how far. One binding per consumer per account. A binding is checked before anything is signed: the caller must be `consumer`, proven by the request's own proof; the request must sit inside `scopeCeiling`; its TTL must not exceed `maxTtlSeconds`; and the binding's rate must not be exhausted.\",\n \"properties\": {\n \"consumer\": {\n \"description\": \"The DID of the integration allowed to use the account.\",\n \"maxLength\": 2048,\n \"minLength\": 7,\n \"pattern\": \"^did:[a-z0-9]+:\\\\S+$\",\n \"type\": \"string\"\n },\n \"grantedAt\": {\n \"format\": \"date-time\",\n \"type\": \"string\"\n },\n \"maxTtlSeconds\": {\n \"description\": \"The longest credential lifetime the consumer may request. 900 (15 minutes) is RECOMMENDED; the ceiling is one hour.\",\n \"maximum\": 3600,\n \"minimum\": 60,\n \"type\": \"integer\"\n },\n \"ratePerMinute\": {\n \"description\": \"Issuances or signatures per minute for this binding.\",\n \"maximum\": 600,\n \"minimum\": 1,\n \"type\": \"integer\"\n },\n \"scopeCeiling\": {\n \"$ref\": \"#/$defs/CredentialScopeCeiling\",\n \"description\": \"Required for storage and OAuth models; absent for `sui-signer`, whose ceiling is the account's own allow-list and caps.\"\n },\n \"sourceCidrs\": {\n \"description\": \"Where the provider supports it (`aws:SourceIp`), issued credentials are pinned to these networks, so a credential lifted from the consumer is useless elsewhere.\",\n \"items\": {\n \"maxLength\": 49,\n \"pattern\": \"^[0-9a-fA-F:.]+/[0-9]{1,3}$\",\n \"type\": \"string\"\n },\n \"maxItems\": 16,\n \"type\": \"array\"\n }\n },\n \"required\": [\n \"consumer\",\n \"maxTtlSeconds\",\n \"ratePerMinute\"\n ],\n \"title\": \"AccountBinding\",\n \"type\": \"object\"\n },\n \"AccountContextId\": {\n \"description\": \"The custodian context that owns the account. Act scope in this context decides who may manage the account and who may consume it; the account's keys are derived in this context's key space.\",\n \"maxLength\": 256,\n \"minLength\": 1,\n \"title\": \"AccountContextId\",\n \"type\": \"string\"\n },\n \"AccountId\": {\n \"description\": \"The account's identifier within its context, chosen by whoever creates it. Lowercase letters, digits and hyphens, so that it can be embedded in a certificate subject, a token subject or a provider-side condition without escaping. Unique per context; never reused after deletion while anything that names it (a provider-side trust policy, an audit row) may still exist.\",\n \"maxLength\": 64,\n \"minLength\": 1,\n \"pattern\": \"^[a-z0-9][a-z0-9-]*$\",\n \"title\": \"AccountId\",\n \"type\": \"string\"\n },\n \"AccountProbeReport\": {\n \"additionalProperties\": false,\n \"properties\": {\n \"at\": {\n \"format\": \"date-time\",\n \"type\": \"string\"\n },\n \"complete\": {\n \"description\": \"True only when the canary steps (`put`, `get`, `delete`, or the model's equivalent) ran, so the account was exercised end to end. A probe that stopped after `exchange` because nothing named a canary prefix is `complete: false` even when `ok` is true, and does not clear `providerSetupRequired`.\",\n \"type\": \"boolean\"\n },\n \"ok\": {\n \"description\": \"True when every step that ran succeeded.\",\n \"type\": \"boolean\"\n },\n \"steps\": {\n \"description\": \"In order; the first failing step ends the probe.\",\n \"items\": {\n \"additionalProperties\": false,\n \"properties\": {\n \"durationMs\": {\n \"minimum\": 0,\n \"type\": \"integer\"\n },\n \"ok\": {\n \"type\": \"boolean\"\n },\n \"providerError\": {\n \"description\": \"The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.\",\n \"maxLength\": 2048,\n \"type\": \"string\"\n },\n \"providerRequestId\": {\n \"maxLength\": 256,\n \"pattern\": \"^[!-~]+$\",\n \"type\": \"string\"\n },\n \"step\": {\n \"$ref\": \"#/$defs/AccountProbeStep\"\n }\n },\n \"required\": [\n \"step\",\n \"ok\"\n ],\n \"type\": \"object\"\n },\n \"maxItems\": 8,\n \"type\": \"array\"\n }\n },\n \"required\": [\n \"at\",\n \"ok\",\n \"complete\",\n \"steps\"\n ],\n \"title\": \"AccountProbeReport\",\n \"type\": \"object\"\n },\n \"AccountProbeStep\": {\n \"description\": \"`sign`: the custodian signed its assertion, session request or test transaction. `exchange`: the provider issued a credential for it. `put`, `get`, `delete`: one canary object at the narrowest scope of the account's bindings. `decode`: for `sui-signer`, a built test transaction passed the allow-list (it is never submitted).\",\n \"enum\": [\n \"sign\",\n \"exchange\",\n \"put\",\n \"get\",\n \"delete\",\n \"decode\"\n ],\n \"title\": \"AccountProbeStep\",\n \"type\": \"string\"\n },\n \"AccountPublicMaterial\": {\n \"additionalProperties\": false,\n \"description\": \"The public half of the account's key, as the provider needs it. Never a private key.\",\n \"properties\": {\n \"address\": {\n \"description\": \"`sui-signer`: the Sui address the key controls.\",\n \"pattern\": \"^0x[0-9a-f]{64}$\",\n \"type\": \"string\"\n },\n \"algorithm\": {\n \"enum\": [\n \"ES256\",\n \"RS256\",\n \"Secp256r1\"\n ],\n \"type\": \"string\"\n },\n \"certificatePem\": {\n \"description\": \"`aws-roles-anywhere`: the trust anchor's CA certificate. `azure-cert`: the certificate uploaded to the app registration.\",\n \"maxLength\": 16384,\n \"pattern\": \"^-----BEGIN CERTIFICATE-----[A-Za-z0-9+/=\\\\r\\\\n]+-----END CERTIFICATE-----\\\\s*$\",\n \"type\": \"string\"\n },\n \"keyFingerprint\": {\n \"$ref\": \"#/$defs/DigestMultibase\",\n \"description\": \"Digest of the public key's SubjectPublicKeyInfo DER.\"\n },\n \"pendingKeyFingerprint\": {\n \"$ref\": \"#/$defs/DigestMultibase\",\n \"description\": \"During a rotation (external/accounts/keys/rotate), the staged successor key, until it is confirmed and the current key retires.\"\n },\n \"publicKeyJwk\": {\n \"additionalProperties\": false,\n \"description\": \"The public key as a JWK, with `kid`. Public members only: the schema admits no private member (`d`, `p`, `q`, `dp`, `dq`, `qi`), so a document carrying one fails validation.\",\n \"properties\": {\n \"alg\": {\n \"enum\": [\n \"ES256\",\n \"RS256\"\n ],\n \"type\": \"string\"\n },\n \"crv\": {\n \"enum\": [\n \"P-256\"\n ],\n \"type\": \"string\"\n },\n \"e\": {\n \"maxLength\": 16,\n \"pattern\": \"^[A-Za-z0-9_-]+$\",\n \"type\": \"string\"\n },\n \"kid\": {\n \"maxLength\": 128,\n \"pattern\": \"^[!-~]+$\",\n \"type\": \"string\"\n },\n \"kty\": {\n \"enum\": [\n \"EC\",\n \"RSA\"\n ],\n \"type\": \"string\"\n },\n \"n\": {\n \"maxLength\": 1024,\n \"pattern\": \"^[A-Za-z0-9_-]+$\",\n \"type\": \"string\"\n },\n \"use\": {\n \"const\": \"sig\",\n \"type\": \"string\"\n },\n \"x\": {\n \"maxLength\": 1024,\n \"pattern\": \"^[A-Za-z0-9_-]+$\",\n \"type\": \"string\"\n },\n \"y\": {\n \"maxLength\": 1024,\n \"pattern\": \"^[A-Za-z0-9_-]+$\",\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"kty\",\n \"kid\"\n ],\n \"type\": \"object\"\n }\n },\n \"required\": [\n \"algorithm\",\n \"keyFingerprint\"\n ],\n \"title\": \"AccountPublicMaterial\",\n \"type\": \"object\"\n },\n \"AccountSecretInfo\": {\n \"additionalProperties\": false,\n \"description\": \"That a static model's secret is set, and which one. Never its value.\",\n \"properties\": {\n \"fingerprint\": {\n \"$ref\": \"#/$defs/SecretFingerprint\"\n },\n \"setAt\": {\n \"format\": \"date-time\",\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"fingerprint\",\n \"setAt\"\n ],\n \"title\": \"AccountSecretInfo\",\n \"type\": \"object\"\n },\n \"AccountSettings\": {\n \"description\": \"Per-model account settings, discriminated by `model`: every branch is an object whose `model` member is a `const`, which is what lets each generated binding emit a tagged union, so an unusable setting is answered as `external:invalidSettings` naming the member rather than as an unparseable payload. Never a secret: every value here is returned to anyone who may read the account. Branches are referred to by their `model` (\\\"the `sui-signer` settings\\\"). They carry no `title`, so that every binding renders each as a plain variant of this union.\",\n \"oneOf\": [\n {\n \"additionalProperties\": false,\n \"description\": \"Egress: `rolesanywhere.<region>.amazonaws.com`, plus `sts.<region>.amazonaws.com` when `chainedRoleArn` is set.\",\n \"properties\": {\n \"bucket\": {\n \"$ref\": \"#/$defs/ProviderBucketName\",\n \"description\": \"The S3 bucket issuances are scoped within. Required for an account whose bindings issue storage scopes.\"\n },\n \"chainedRoleArn\": {\n \"$ref\": \"#/$defs/AwsArn\",\n \"description\": \"When set, every issuance chains an AssumeRole into this role carrying the downscoping session policy, for deployments whose Roles Anywhere profile cannot carry one per request. Caps a credential at one hour.\"\n },\n \"model\": {\n \"const\": \"aws-roles-anywhere\",\n \"type\": \"string\"\n },\n \"probePrefix\": {\n \"$ref\": \"#/$defs/ProviderObjectPrefix\",\n \"description\": \"Where external/accounts/probe writes its canary when no binding names a narrower prefix. Lets a new account be probed before anything is bound to it. Absent, a probe of an account with no bindings stops after `exchange` and reports `complete: false`.\"\n },\n \"profileArn\": {\n \"$ref\": \"#/$defs/AwsArn\"\n },\n \"region\": {\n \"$ref\": \"#/$defs/AwsRegion\"\n },\n \"roleArn\": {\n \"$ref\": \"#/$defs/AwsArn\"\n },\n \"trustAnchorArn\": {\n \"$ref\": \"#/$defs/AwsArn\",\n \"description\": \"The trust anchor holding the custodian's CA certificate. Recorded after the administrator creates it from external/accounts/setup.\"\n }\n },\n \"required\": [\n \"model\",\n \"region\",\n \"profileArn\",\n \"roleArn\",\n \"trustAnchorArn\"\n ],\n \"type\": \"object\"\n },\n {\n \"additionalProperties\": false,\n \"description\": \"Egress: `sts.googleapis.com`, plus `iamcredentials.googleapis.com` when `serviceAccount` is set.\",\n \"properties\": {\n \"bucket\": {\n \"$ref\": \"#/$defs/ProviderBucketName\",\n \"description\": \"The GCS bucket issuances are scoped within, by a Credential Access Boundary.\"\n },\n \"model\": {\n \"const\": \"gcp-wif-pinned\",\n \"type\": \"string\"\n },\n \"poolId\": {\n \"pattern\": \"^[a-z0-9-]{4,32}$\",\n \"type\": \"string\"\n },\n \"probePrefix\": {\n \"$ref\": \"#/$defs/ProviderObjectPrefix\",\n \"description\": \"Where external/accounts/probe writes its canary when no binding names a narrower prefix. Lets a new account be probed before anything is bound to it. Absent, a probe of an account with no bindings stops after `exchange` and reports `complete: false`.\"\n },\n \"projectNumber\": {\n \"pattern\": \"^[0-9]{1,20}$\",\n \"type\": \"string\"\n },\n \"providerId\": {\n \"pattern\": \"^[a-z0-9-]{4,32}$\",\n \"type\": \"string\"\n },\n \"serviceAccount\": {\n \"description\": \"When set, the federated token is exchanged for this service account's access token.\",\n \"maxLength\": 254,\n \"pattern\": \"^[a-z0-9-]+@[a-z0-9-]+\\\\.iam\\\\.gserviceaccount\\\\.com$\",\n \"type\": \"string\"\n },\n \"signingAlgorithm\": {\n \"description\": \"The ID-token algorithm. ES256 unless the provider refuses it. Absent means ES256.\",\n \"enum\": [\n \"ES256\",\n \"RS256\"\n ],\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"model\",\n \"projectNumber\",\n \"poolId\",\n \"providerId\"\n ],\n \"type\": \"object\"\n },\n {\n \"additionalProperties\": false,\n \"description\": \"Egress: `login.microsoftonline.com`, or the sovereign-cloud authority named in `authorityHost`.\",\n \"properties\": {\n \"authorityHost\": {\n \"description\": \"Absent means `login.microsoftonline.com`.\",\n \"maxLength\": 253,\n \"pattern\": \"^[a-z0-9.-]+$\",\n \"type\": \"string\"\n },\n \"clientId\": {\n \"pattern\": \"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$\",\n \"type\": \"string\"\n },\n \"model\": {\n \"const\": \"azure-cert\",\n \"type\": \"string\"\n },\n \"tenantId\": {\n \"pattern\": \"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$\",\n \"type\": \"string\"\n },\n \"tokenScope\": {\n \"description\": \"The `scope` requested at the token endpoint, such as `https://storage.azure.com/.default`.\",\n \"maxLength\": 512,\n \"pattern\": \"^[A-Za-z0-9:/._-]+$\",\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"model\",\n \"tenantId\",\n \"clientId\",\n \"tokenScope\"\n ],\n \"type\": \"object\"\n },\n {\n \"additionalProperties\": false,\n \"description\": \"Egress: the host of `tokenEndpoint`, and nothing else.\",\n \"properties\": {\n \"audience\": {\n \"description\": \"The assertion's `aud`. Absent means `tokenEndpoint`.\",\n \"maxLength\": 2048,\n \"pattern\": \"^[!-~]+$\",\n \"type\": \"string\"\n },\n \"clientId\": {\n \"maxLength\": 512,\n \"minLength\": 1,\n \"pattern\": \"^[!-~]+$\",\n \"type\": \"string\"\n },\n \"model\": {\n \"const\": \"oauth2-private-key-jwt\",\n \"type\": \"string\"\n },\n \"scopes\": {\n \"description\": \"The scopes a binding may request, the ceiling for every issuance.\",\n \"items\": {\n \"maxLength\": 256,\n \"pattern\": \"^[!#-\\\\[\\\\]-~]+$\",\n \"type\": \"string\"\n },\n \"maxItems\": 64,\n \"type\": \"array\",\n \"uniqueItems\": true\n },\n \"signingAlgorithm\": {\n \"enum\": [\n \"ES256\",\n \"RS256\"\n ],\n \"type\": \"string\"\n },\n \"tokenEndpoint\": {\n \"$ref\": \"#/$defs/ProviderHttpsUrl\"\n }\n },\n \"required\": [\n \"model\",\n \"tokenEndpoint\",\n \"clientId\"\n ],\n \"type\": \"object\"\n },\n {\n \"additionalProperties\": false,\n \"description\": \"Issuance needs no egress: presigning is a computation inside the custodian, and the consumer uses the URL itself. The probe connects to the host of `endpoint`, which `egressHosts` therefore lists.\",\n \"properties\": {\n \"accessKeyId\": {\n \"description\": \"The access key's identifier. Not a secret: it appears in every presigned URL. The secret half is set with external/accounts/secret/set and never returned.\",\n \"maxLength\": 128,\n \"pattern\": \"^[A-Za-z0-9]+$\",\n \"type\": \"string\"\n },\n \"bucket\": {\n \"$ref\": \"#/$defs/ProviderBucketName\"\n },\n \"endpoint\": {\n \"$ref\": \"#/$defs/ProviderHttpsUrl\"\n },\n \"model\": {\n \"const\": \"s3-static-presign\",\n \"type\": \"string\"\n },\n \"pathStyle\": {\n \"description\": \"Address the bucket in the path rather than the host name, as MinIO usually needs.\",\n \"type\": \"boolean\"\n },\n \"probePrefix\": {\n \"$ref\": \"#/$defs/ProviderObjectPrefix\",\n \"description\": \"Where external/accounts/probe writes its canary when no binding names a narrower prefix. Lets a new account be probed before anything is bound to it. Absent, a probe of an account with no bindings stops after `exchange` and reports `complete: false`.\"\n },\n \"region\": {\n \"description\": \"The SigV4 signing region; `auto` for Cloudflare R2.\",\n \"maxLength\": 64,\n \"pattern\": \"^[a-z0-9-]+$\",\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"model\",\n \"endpoint\",\n \"region\",\n \"bucket\",\n \"accessKeyId\"\n ],\n \"type\": \"object\"\n },\n {\n \"additionalProperties\": false,\n \"description\": \"No egress: the custodian signs and the consumer submits the transaction. The allow-list, the gas caps and the coin caps are the account's whole authority; a transaction outside them is refused before anything is signed.\",\n \"properties\": {\n \"allowedCalls\": {\n \"description\": \"Every MoveCall command in a signed transaction must name one of these. For Walrus storage: the system package's `register_blob`, `certify_blob`, `extend_blob` and `delete_blob`, and the coin calls needed to pay for them.\",\n \"items\": {\n \"$ref\": \"#/$defs/SuiMoveCall\"\n },\n \"maxItems\": 32,\n \"minItems\": 1,\n \"type\": \"array\"\n },\n \"allowedObjects\": {\n \"description\": \"Shared objects a transaction may take as input, such as the Walrus system and staking objects. Absent means any object the allowed calls accept.\",\n \"items\": {\n \"pattern\": \"^0x[0-9a-f]{64}$\",\n \"type\": \"string\"\n },\n \"maxItems\": 32,\n \"type\": \"array\"\n },\n \"maxCoinOutPerTx\": {\n \"description\": \"Per coin type, the most a single transaction may spend or transfer out of the account's address, in the coin's smallest unit. A coin type not listed may not leave the address at all.\",\n \"items\": {\n \"additionalProperties\": false,\n \"properties\": {\n \"amount\": {\n \"minimum\": 0,\n \"type\": \"integer\"\n },\n \"coinType\": {\n \"maxLength\": 512,\n \"pattern\": \"^0x[0-9a-f]{1,64}::[A-Za-z0-9_]+::[A-Za-z0-9_]+$\",\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"coinType\",\n \"amount\"\n ],\n \"type\": \"object\"\n },\n \"maxItems\": 8,\n \"type\": \"array\"\n },\n \"maxGasBudgetMist\": {\n \"description\": \"The largest gas budget one transaction may declare.\",\n \"minimum\": 1,\n \"type\": \"integer\"\n },\n \"maxGasPerDayMist\": {\n \"description\": \"The total gas budget signed per rolling 24 hours.\",\n \"minimum\": 1,\n \"type\": \"integer\"\n },\n \"model\": {\n \"const\": \"sui-signer\",\n \"type\": \"string\"\n },\n \"network\": {\n \"enum\": [\n \"mainnet\",\n \"testnet\",\n \"devnet\"\n ],\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"model\",\n \"network\",\n \"allowedCalls\",\n \"maxGasBudgetMist\",\n \"maxGasPerDayMist\"\n ],\n \"type\": \"object\"\n },\n {\n \"additionalProperties\": false,\n \"description\": \"Egress: the host of `baseUrl`. The secret is set with external/accounts/secret/set and used only inside the custodian by `driver`; a provider reachable only by handing the consumer the raw key is not supported.\",\n \"properties\": {\n \"baseUrl\": {\n \"$ref\": \"#/$defs/ProviderHttpsUrl\"\n },\n \"driver\": {\n \"description\": \"The custodian's driver that uses the secret: performs a login or token exchange and returns a short-lived result. A custodian refuses a driver it does not implement.\",\n \"maxLength\": 64,\n \"pattern\": \"^[a-z0-9][a-z0-9-]*$\",\n \"type\": \"string\"\n },\n \"model\": {\n \"const\": \"static-secret\",\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"model\",\n \"driver\",\n \"baseUrl\"\n ],\n \"type\": \"object\"\n }\n ],\n \"title\": \"AccountSettings\"\n },\n \"AccountState\": {\n \"description\": \"`active`: usable by its bindings. `suspended`: every issuance and signature is refused at once; management reads continue; resumable. `archived`: hidden from default listings, refused for use, restorable. Deletion removes the record.\",\n \"enum\": [\n \"active\",\n \"suspended\",\n \"archived\"\n ],\n \"title\": \"AccountState\",\n \"type\": \"string\"\n },\n \"AuthModel\": {\n \"description\": \"How the account authenticates to its provider. Every model pins the custodian's verification material in the provider's own account, uploaded once, so no model requires the custodian to be reachable from the internet. `aws-roles-anywhere`: the custodian is the certificate authority of an IAM Roles Anywhere trust anchor, and signs CreateSession with a short-lived end-entity certificate it issued to the account's own key. `gcp-wif-pinned`: a Workload Identity Federation pool provider holds an uploaded JWKS; the custodian signs an ID token and exchanges it at Google's STS. `azure-cert`: a certificate uploaded to an Entra app registration; the custodian signs an RFC 7523 client assertion. `oauth2-private-key-jwt`: the same RFC 7523 client authentication against any token endpoint that registered the custodian's public key. `s3-static-presign`: an access-key pair for an S3-compatible store that cannot federate; the custodian presigns per-object URLs and never releases the key. `sui-signer`: a Sui address derived from the custodian's key; the custodian signs only allow-listed transactions. `static-secret`: an API key or token used inside the custodian by a named driver; last resort, never released.\\n\\nPlain OpenID Connect discovery federation is deliberately absent. It works by the provider fetching the issuer's JWKS from a public URL, which either makes the custodian reachable from the internet or makes whoever hosts a copy of the JWKS able to mint credentials for every federated role.\",\n \"enum\": [\n \"aws-roles-anywhere\",\n \"gcp-wif-pinned\",\n \"azure-cert\",\n \"oauth2-private-key-jwt\",\n \"s3-static-presign\",\n \"sui-signer\",\n \"static-secret\"\n ],\n \"title\": \"AuthModel\",\n \"type\": \"string\"\n },\n \"AwsArn\": {\n \"maxLength\": 2048,\n \"pattern\": \"^arn:aws[a-z-]*:[a-z0-9-]+:[a-z0-9-]*:[0-9]{0,12}:[A-Za-z0-9+=,.@_/:-]+$\",\n \"title\": \"AwsArn\",\n \"type\": \"string\"\n },\n \"AwsRegion\": {\n \"maxLength\": 32,\n \"pattern\": \"^[a-z]{2}(-gov)?-[a-z]+-[0-9]$\",\n \"title\": \"AwsRegion\",\n \"type\": \"string\"\n },\n \"CredentialScopeCeiling\": {\n \"additionalProperties\": false,\n \"description\": \"The widest scope a binding's consumer may request. An issuance is inside the ceiling when its `prefix` begins with one of `prefixes`, every one of its `actions` is in `actions`, and every one of its `scopes` is in `scopes`. Absent members confer nothing: a ceiling with no `prefixes` permits no storage issuance.\",\n \"properties\": {\n \"actions\": {\n \"items\": {\n \"$ref\": \"#/$defs/ProviderObjectAction\"\n },\n \"maxItems\": 3,\n \"minItems\": 1,\n \"type\": \"array\",\n \"uniqueItems\": true\n },\n \"prefixes\": {\n \"items\": {\n \"$ref\": \"#/$defs/ProviderObjectPrefix\"\n },\n \"maxItems\": 64,\n \"minItems\": 1,\n \"type\": \"array\",\n \"uniqueItems\": true\n },\n \"scopes\": {\n \"items\": {\n \"maxLength\": 256,\n \"pattern\": \"^[!#-\\\\[\\\\]-~]+$\",\n \"type\": \"string\"\n },\n \"maxItems\": 64,\n \"type\": \"array\",\n \"uniqueItems\": true\n }\n },\n \"title\": \"CredentialScopeCeiling\",\n \"type\": \"object\"\n },\n \"DigestMultibase\": {\n \"description\": \"A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.\\n\\nMultihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.\\n\\nThis definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.\\n\\nRestricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that \\\"interoperability is not guaranteed between implementations using such values\\\", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.\",\n \"examples\": [\n \"zQmbWqxBEKC3P8tqsKc98xmWNzrzDtRLMiMPL8wBuTGsMnR\"\n ],\n \"minLength\": 16,\n \"pattern\": \"^(z[1-9A-HJ-NP-Za-km-z]+|u[A-Za-z0-9_-]+)$\",\n \"title\": \"DigestMultibase\",\n \"type\": \"string\"\n },\n \"Ext\": {\n \"additionalProperties\": true,\n \"description\": \"Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.\",\n \"minProperties\": 1,\n \"propertyNames\": {\n \"pattern\": \"^[a-z][a-z0-9-]*(\\\\.[a-z0-9-]+)+$\"\n },\n \"title\": \"Ext\",\n \"type\": \"object\"\n },\n \"ExternalAccount\": {\n \"additionalProperties\": false,\n \"description\": \"An account as every read returns it. Contains no private key, no secret and no issued credential, to any reader.\",\n \"properties\": {\n \"bindings\": {\n \"items\": {\n \"$ref\": \"#/$defs/AccountBinding\"\n },\n \"maxItems\": 256,\n \"type\": \"array\"\n },\n \"context\": {\n \"$ref\": \"#/$defs/AccountContextId\"\n },\n \"createdAt\": {\n \"format\": \"date-time\",\n \"type\": \"string\"\n },\n \"egressHosts\": {\n \"description\": \"The provider hosts the custodian connects to on this account's behalf, derived by the custodian from its settings: the token or session endpoints issuance uses, and the destinations external/accounts/probe dials (the object store's host, for a storage model). The custodian MUST NOT connect anywhere else on the account's behalf, so an egress proxy can allow exactly this set. Empty only for a model that neither exchanges nor probes over the network.\",\n \"items\": {\n \"maxLength\": 253,\n \"pattern\": \"^[a-z0-9.-]+$\",\n \"type\": \"string\"\n },\n \"maxItems\": 8,\n \"type\": \"array\"\n },\n \"id\": {\n \"$ref\": \"#/$defs/AccountId\"\n },\n \"label\": {\n \"description\": \"Display name. Untrusted text: render it, never interpret it.\",\n \"maxLength\": 128,\n \"minLength\": 1,\n \"type\": \"string\"\n },\n \"lastProbe\": {\n \"$ref\": \"#/$defs/AccountProbeReport\"\n },\n \"providerSetupRequired\": {\n \"description\": \"True when the account cannot be used until its provider-side setup is redone: after a restore that could not carry its key or secret (a wrapped RSA key, a static secret), or after a rotation awaiting confirmation.\",\n \"type\": \"boolean\"\n },\n \"publicMaterial\": {\n \"$ref\": \"#/$defs/AccountPublicMaterial\",\n \"description\": \"Absent for the static models, which hold a secret rather than a key.\"\n },\n \"secret\": {\n \"$ref\": \"#/$defs/AccountSecretInfo\",\n \"description\": \"Static models only; absent until the secret is set.\"\n },\n \"settings\": {\n \"$ref\": \"#/$defs/AccountSettings\"\n },\n \"state\": {\n \"$ref\": \"#/$defs/AccountState\"\n },\n \"updatedAt\": {\n \"format\": \"date-time\",\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"id\",\n \"label\",\n \"context\",\n \"settings\",\n \"state\",\n \"bindings\",\n \"egressHosts\",\n \"providerSetupRequired\",\n \"createdAt\",\n \"updatedAt\"\n ],\n \"title\": \"ExternalAccount\",\n \"type\": \"object\"\n },\n \"ProviderBucketName\": {\n \"description\": \"A bucket name as S3 and GCS accept it. Validated rather than free so that it can be placed in a provider policy without escaping.\",\n \"maxLength\": 63,\n \"minLength\": 3,\n \"pattern\": \"^[a-z0-9][a-z0-9.-]*[a-z0-9]$\",\n \"title\": \"ProviderBucketName\",\n \"type\": \"string\"\n },\n \"ProviderHttpsUrl\": {\n \"format\": \"uri\",\n \"maxLength\": 2048,\n \"pattern\": \"^https://[^\\\\s\\\"'\\\\\\\\]+$\",\n \"title\": \"ProviderHttpsUrl\",\n \"type\": \"string\"\n },\n \"ProviderObjectAction\": {\n \"description\": \"`put`: write an object. `get`: read one. `delete`: remove one. No list, ACL, policy or bucket-level action exists here, so none can be granted.\",\n \"enum\": [\n \"put\",\n \"get\",\n \"delete\"\n ],\n \"title\": \"ProviderObjectAction\",\n \"type\": \"string\"\n },\n \"ProviderObjectPrefix\": {\n \"description\": \"An object-key prefix within the account's bucket: one or more segments of lowercase letters, digits, `.`, `_` and `-`, each beginning with a letter or digit and ending with `/`. No quote, backslash, wildcard, whitespace, `..` segment or empty segment can appear. That is deliberate: the custodian places this value inside a provider policy — an IAM session policy (JSON), a GCS Credential Access Boundary condition (CEL) — and a value able to carry a metacharacter can break out of the string it is placed in and widen the policy. That is a known class of defect (CVE-2026-42811, a CEL injection in downscoped GCS credentials). Even with this pattern, a custodian MUST build provider policies with the provider language's own encoder, never by string interpolation.\",\n \"maxLength\": 512,\n \"minLength\": 2,\n \"pattern\": \"^([a-z0-9][a-z0-9._-]{0,127}/){1,16}$\",\n \"title\": \"ProviderObjectPrefix\",\n \"type\": \"string\"\n },\n \"Response\": {\n \"$anchor\": \"response\",\n \"additionalProperties\": false,\n \"properties\": {\n \"accounts\": {\n \"items\": {\n \"$ref\": \"#/$defs/ExternalAccount\"\n },\n \"maxItems\": 200,\n \"type\": \"array\"\n },\n \"ext\": {\n \"$ref\": \"#/$defs/Ext\"\n },\n \"nextCursor\": {\n \"maxLength\": 512,\n \"pattern\": \"^[A-Za-z0-9_-]+$\",\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"accounts\"\n ],\n \"title\": \"External Accounts — List — response payload\",\n \"type\": \"object\"\n },\n \"SecretFingerprint\": {\n \"description\": \"Which secret is set, without being a way to test guesses at it. `hmacsha256:` followed by the base64url encoding, without padding, of the first 16 bytes of HMAC-SHA256 over the secret's bytes under a fingerprint key the custodian holds and never discloses. Comparable only between fingerprints made by the same custodian: a re-entered value can be confirmed, while the same secret at two custodians gives unrelated fingerprints. Never a bare hash of the secret, which would let anyone who reads it run a dictionary against it offline; and deliberately not a DigestMultibase, since multihash has no code for a keyed digest.\",\n \"maxLength\": 33,\n \"pattern\": \"^hmacsha256:[A-Za-z0-9_-]{22}$\",\n \"title\": \"SecretFingerprint\",\n \"type\": \"string\"\n },\n \"SuiMoveCall\": {\n \"additionalProperties\": false,\n \"description\": \"One Move function an account's transactions may call.\",\n \"properties\": {\n \"function\": {\n \"pattern\": \"^[A-Za-z][A-Za-z0-9_]{0,127}$\",\n \"type\": \"string\"\n },\n \"module\": {\n \"pattern\": \"^[A-Za-z][A-Za-z0-9_]{0,127}$\",\n \"type\": \"string\"\n },\n \"package\": {\n \"pattern\": \"^0x[0-9a-f]{64}$\",\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"package\",\n \"module\",\n \"function\"\n ],\n \"title\": \"SuiMoveCall\",\n \"type\": \"object\"\n }\n },\n \"$id\": \"https://trusttasks.org/spec/external/accounts/list/0.1\",\n \"$schema\": \"https://json-schema.org/draft/2020-12/schema\",\n \"additionalProperties\": false,\n \"description\": \"List the external accounts in a context. The outer document members are owned by the framework — SPEC §6.3.\",\n \"properties\": {\n \"context\": {\n \"$ref\": \"#/$defs/AccountContextId\"\n },\n \"cursor\": {\n \"description\": \"Opaque; quote the previous page's `nextCursor`.\",\n \"maxLength\": 512,\n \"pattern\": \"^[A-Za-z0-9_-]+$\",\n \"type\": \"string\"\n },\n \"ext\": {\n \"$ref\": \"#/$defs/Ext\"\n },\n \"limit\": {\n \"maximum\": 200,\n \"minimum\": 1,\n \"type\": \"integer\"\n },\n \"model\": {\n \"$ref\": \"#/$defs/AuthModel\"\n },\n \"state\": {\n \"$ref\": \"#/$defs/AccountState\",\n \"description\": \"Only accounts in this state. Absent means `active` and `suspended`.\"\n }\n },\n \"required\": [\n \"context\"\n ],\n \"title\": \"External Accounts — List — payload\",\n \"type\": \"object\"\n}\n",
);
}
impl crate::Payload for Response {
const TYPE_URI: &'static str =
"https://trusttasks.org/spec/external/accounts/list/0.1#response";
const IS_RECIPIENT_REQUIRED: bool = true;
const PAYLOAD_SCHEMA: Option<&'static str> = Some(
"{\n \"$defs\": {\n \"AccountBinding\": {\n \"additionalProperties\": false,\n \"description\": \"Who may use an account, and how far. One binding per consumer per account. A binding is checked before anything is signed: the caller must be `consumer`, proven by the request's own proof; the request must sit inside `scopeCeiling`; its TTL must not exceed `maxTtlSeconds`; and the binding's rate must not be exhausted.\",\n \"properties\": {\n \"consumer\": {\n \"description\": \"The DID of the integration allowed to use the account.\",\n \"maxLength\": 2048,\n \"minLength\": 7,\n \"pattern\": \"^did:[a-z0-9]+:\\\\S+$\",\n \"type\": \"string\"\n },\n \"grantedAt\": {\n \"format\": \"date-time\",\n \"type\": \"string\"\n },\n \"maxTtlSeconds\": {\n \"description\": \"The longest credential lifetime the consumer may request. 900 (15 minutes) is RECOMMENDED; the ceiling is one hour.\",\n \"maximum\": 3600,\n \"minimum\": 60,\n \"type\": \"integer\"\n },\n \"ratePerMinute\": {\n \"description\": \"Issuances or signatures per minute for this binding.\",\n \"maximum\": 600,\n \"minimum\": 1,\n \"type\": \"integer\"\n },\n \"scopeCeiling\": {\n \"$ref\": \"#/$defs/CredentialScopeCeiling\",\n \"description\": \"Required for storage and OAuth models; absent for `sui-signer`, whose ceiling is the account's own allow-list and caps.\"\n },\n \"sourceCidrs\": {\n \"description\": \"Where the provider supports it (`aws:SourceIp`), issued credentials are pinned to these networks, so a credential lifted from the consumer is useless elsewhere.\",\n \"items\": {\n \"maxLength\": 49,\n \"pattern\": \"^[0-9a-fA-F:.]+/[0-9]{1,3}$\",\n \"type\": \"string\"\n },\n \"maxItems\": 16,\n \"type\": \"array\"\n }\n },\n \"required\": [\n \"consumer\",\n \"maxTtlSeconds\",\n \"ratePerMinute\"\n ],\n \"title\": \"AccountBinding\",\n \"type\": \"object\"\n },\n \"AccountContextId\": {\n \"description\": \"The custodian context that owns the account. Act scope in this context decides who may manage the account and who may consume it; the account's keys are derived in this context's key space.\",\n \"maxLength\": 256,\n \"minLength\": 1,\n \"title\": \"AccountContextId\",\n \"type\": \"string\"\n },\n \"AccountId\": {\n \"description\": \"The account's identifier within its context, chosen by whoever creates it. Lowercase letters, digits and hyphens, so that it can be embedded in a certificate subject, a token subject or a provider-side condition without escaping. Unique per context; never reused after deletion while anything that names it (a provider-side trust policy, an audit row) may still exist.\",\n \"maxLength\": 64,\n \"minLength\": 1,\n \"pattern\": \"^[a-z0-9][a-z0-9-]*$\",\n \"title\": \"AccountId\",\n \"type\": \"string\"\n },\n \"AccountProbeReport\": {\n \"additionalProperties\": false,\n \"properties\": {\n \"at\": {\n \"format\": \"date-time\",\n \"type\": \"string\"\n },\n \"complete\": {\n \"description\": \"True only when the canary steps (`put`, `get`, `delete`, or the model's equivalent) ran, so the account was exercised end to end. A probe that stopped after `exchange` because nothing named a canary prefix is `complete: false` even when `ok` is true, and does not clear `providerSetupRequired`.\",\n \"type\": \"boolean\"\n },\n \"ok\": {\n \"description\": \"True when every step that ran succeeded.\",\n \"type\": \"boolean\"\n },\n \"steps\": {\n \"description\": \"In order; the first failing step ends the probe.\",\n \"items\": {\n \"additionalProperties\": false,\n \"properties\": {\n \"durationMs\": {\n \"minimum\": 0,\n \"type\": \"integer\"\n },\n \"ok\": {\n \"type\": \"boolean\"\n },\n \"providerError\": {\n \"description\": \"The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.\",\n \"maxLength\": 2048,\n \"type\": \"string\"\n },\n \"providerRequestId\": {\n \"maxLength\": 256,\n \"pattern\": \"^[!-~]+$\",\n \"type\": \"string\"\n },\n \"step\": {\n \"$ref\": \"#/$defs/AccountProbeStep\"\n }\n },\n \"required\": [\n \"step\",\n \"ok\"\n ],\n \"type\": \"object\"\n },\n \"maxItems\": 8,\n \"type\": \"array\"\n }\n },\n \"required\": [\n \"at\",\n \"ok\",\n \"complete\",\n \"steps\"\n ],\n \"title\": \"AccountProbeReport\",\n \"type\": \"object\"\n },\n \"AccountProbeStep\": {\n \"description\": \"`sign`: the custodian signed its assertion, session request or test transaction. `exchange`: the provider issued a credential for it. `put`, `get`, `delete`: one canary object at the narrowest scope of the account's bindings. `decode`: for `sui-signer`, a built test transaction passed the allow-list (it is never submitted).\",\n \"enum\": [\n \"sign\",\n \"exchange\",\n \"put\",\n \"get\",\n \"delete\",\n \"decode\"\n ],\n \"title\": \"AccountProbeStep\",\n \"type\": \"string\"\n },\n \"AccountPublicMaterial\": {\n \"additionalProperties\": false,\n \"description\": \"The public half of the account's key, as the provider needs it. Never a private key.\",\n \"properties\": {\n \"address\": {\n \"description\": \"`sui-signer`: the Sui address the key controls.\",\n \"pattern\": \"^0x[0-9a-f]{64}$\",\n \"type\": \"string\"\n },\n \"algorithm\": {\n \"enum\": [\n \"ES256\",\n \"RS256\",\n \"Secp256r1\"\n ],\n \"type\": \"string\"\n },\n \"certificatePem\": {\n \"description\": \"`aws-roles-anywhere`: the trust anchor's CA certificate. `azure-cert`: the certificate uploaded to the app registration.\",\n \"maxLength\": 16384,\n \"pattern\": \"^-----BEGIN CERTIFICATE-----[A-Za-z0-9+/=\\\\r\\\\n]+-----END CERTIFICATE-----\\\\s*$\",\n \"type\": \"string\"\n },\n \"keyFingerprint\": {\n \"$ref\": \"#/$defs/DigestMultibase\",\n \"description\": \"Digest of the public key's SubjectPublicKeyInfo DER.\"\n },\n \"pendingKeyFingerprint\": {\n \"$ref\": \"#/$defs/DigestMultibase\",\n \"description\": \"During a rotation (external/accounts/keys/rotate), the staged successor key, until it is confirmed and the current key retires.\"\n },\n \"publicKeyJwk\": {\n \"additionalProperties\": false,\n \"description\": \"The public key as a JWK, with `kid`. Public members only: the schema admits no private member (`d`, `p`, `q`, `dp`, `dq`, `qi`), so a document carrying one fails validation.\",\n \"properties\": {\n \"alg\": {\n \"enum\": [\n \"ES256\",\n \"RS256\"\n ],\n \"type\": \"string\"\n },\n \"crv\": {\n \"enum\": [\n \"P-256\"\n ],\n \"type\": \"string\"\n },\n \"e\": {\n \"maxLength\": 16,\n \"pattern\": \"^[A-Za-z0-9_-]+$\",\n \"type\": \"string\"\n },\n \"kid\": {\n \"maxLength\": 128,\n \"pattern\": \"^[!-~]+$\",\n \"type\": \"string\"\n },\n \"kty\": {\n \"enum\": [\n \"EC\",\n \"RSA\"\n ],\n \"type\": \"string\"\n },\n \"n\": {\n \"maxLength\": 1024,\n \"pattern\": \"^[A-Za-z0-9_-]+$\",\n \"type\": \"string\"\n },\n \"use\": {\n \"const\": \"sig\",\n \"type\": \"string\"\n },\n \"x\": {\n \"maxLength\": 1024,\n \"pattern\": \"^[A-Za-z0-9_-]+$\",\n \"type\": \"string\"\n },\n \"y\": {\n \"maxLength\": 1024,\n \"pattern\": \"^[A-Za-z0-9_-]+$\",\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"kty\",\n \"kid\"\n ],\n \"type\": \"object\"\n }\n },\n \"required\": [\n \"algorithm\",\n \"keyFingerprint\"\n ],\n \"title\": \"AccountPublicMaterial\",\n \"type\": \"object\"\n },\n \"AccountSecretInfo\": {\n \"additionalProperties\": false,\n \"description\": \"That a static model's secret is set, and which one. Never its value.\",\n \"properties\": {\n \"fingerprint\": {\n \"$ref\": \"#/$defs/SecretFingerprint\"\n },\n \"setAt\": {\n \"format\": \"date-time\",\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"fingerprint\",\n \"setAt\"\n ],\n \"title\": \"AccountSecretInfo\",\n \"type\": \"object\"\n },\n \"AccountSettings\": {\n \"description\": \"Per-model account settings, discriminated by `model`: every branch is an object whose `model` member is a `const`, which is what lets each generated binding emit a tagged union, so an unusable setting is answered as `external:invalidSettings` naming the member rather than as an unparseable payload. Never a secret: every value here is returned to anyone who may read the account. Branches are referred to by their `model` (\\\"the `sui-signer` settings\\\"). They carry no `title`, so that every binding renders each as a plain variant of this union.\",\n \"oneOf\": [\n {\n \"additionalProperties\": false,\n \"description\": \"Egress: `rolesanywhere.<region>.amazonaws.com`, plus `sts.<region>.amazonaws.com` when `chainedRoleArn` is set.\",\n \"properties\": {\n \"bucket\": {\n \"$ref\": \"#/$defs/ProviderBucketName\",\n \"description\": \"The S3 bucket issuances are scoped within. Required for an account whose bindings issue storage scopes.\"\n },\n \"chainedRoleArn\": {\n \"$ref\": \"#/$defs/AwsArn\",\n \"description\": \"When set, every issuance chains an AssumeRole into this role carrying the downscoping session policy, for deployments whose Roles Anywhere profile cannot carry one per request. Caps a credential at one hour.\"\n },\n \"model\": {\n \"const\": \"aws-roles-anywhere\",\n \"type\": \"string\"\n },\n \"probePrefix\": {\n \"$ref\": \"#/$defs/ProviderObjectPrefix\",\n \"description\": \"Where external/accounts/probe writes its canary when no binding names a narrower prefix. Lets a new account be probed before anything is bound to it. Absent, a probe of an account with no bindings stops after `exchange` and reports `complete: false`.\"\n },\n \"profileArn\": {\n \"$ref\": \"#/$defs/AwsArn\"\n },\n \"region\": {\n \"$ref\": \"#/$defs/AwsRegion\"\n },\n \"roleArn\": {\n \"$ref\": \"#/$defs/AwsArn\"\n },\n \"trustAnchorArn\": {\n \"$ref\": \"#/$defs/AwsArn\",\n \"description\": \"The trust anchor holding the custodian's CA certificate. Recorded after the administrator creates it from external/accounts/setup.\"\n }\n },\n \"required\": [\n \"model\",\n \"region\",\n \"profileArn\",\n \"roleArn\",\n \"trustAnchorArn\"\n ],\n \"type\": \"object\"\n },\n {\n \"additionalProperties\": false,\n \"description\": \"Egress: `sts.googleapis.com`, plus `iamcredentials.googleapis.com` when `serviceAccount` is set.\",\n \"properties\": {\n \"bucket\": {\n \"$ref\": \"#/$defs/ProviderBucketName\",\n \"description\": \"The GCS bucket issuances are scoped within, by a Credential Access Boundary.\"\n },\n \"model\": {\n \"const\": \"gcp-wif-pinned\",\n \"type\": \"string\"\n },\n \"poolId\": {\n \"pattern\": \"^[a-z0-9-]{4,32}$\",\n \"type\": \"string\"\n },\n \"probePrefix\": {\n \"$ref\": \"#/$defs/ProviderObjectPrefix\",\n \"description\": \"Where external/accounts/probe writes its canary when no binding names a narrower prefix. Lets a new account be probed before anything is bound to it. Absent, a probe of an account with no bindings stops after `exchange` and reports `complete: false`.\"\n },\n \"projectNumber\": {\n \"pattern\": \"^[0-9]{1,20}$\",\n \"type\": \"string\"\n },\n \"providerId\": {\n \"pattern\": \"^[a-z0-9-]{4,32}$\",\n \"type\": \"string\"\n },\n \"serviceAccount\": {\n \"description\": \"When set, the federated token is exchanged for this service account's access token.\",\n \"maxLength\": 254,\n \"pattern\": \"^[a-z0-9-]+@[a-z0-9-]+\\\\.iam\\\\.gserviceaccount\\\\.com$\",\n \"type\": \"string\"\n },\n \"signingAlgorithm\": {\n \"description\": \"The ID-token algorithm. ES256 unless the provider refuses it. Absent means ES256.\",\n \"enum\": [\n \"ES256\",\n \"RS256\"\n ],\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"model\",\n \"projectNumber\",\n \"poolId\",\n \"providerId\"\n ],\n \"type\": \"object\"\n },\n {\n \"additionalProperties\": false,\n \"description\": \"Egress: `login.microsoftonline.com`, or the sovereign-cloud authority named in `authorityHost`.\",\n \"properties\": {\n \"authorityHost\": {\n \"description\": \"Absent means `login.microsoftonline.com`.\",\n \"maxLength\": 253,\n \"pattern\": \"^[a-z0-9.-]+$\",\n \"type\": \"string\"\n },\n \"clientId\": {\n \"pattern\": \"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$\",\n \"type\": \"string\"\n },\n \"model\": {\n \"const\": \"azure-cert\",\n \"type\": \"string\"\n },\n \"tenantId\": {\n \"pattern\": \"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$\",\n \"type\": \"string\"\n },\n \"tokenScope\": {\n \"description\": \"The `scope` requested at the token endpoint, such as `https://storage.azure.com/.default`.\",\n \"maxLength\": 512,\n \"pattern\": \"^[A-Za-z0-9:/._-]+$\",\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"model\",\n \"tenantId\",\n \"clientId\",\n \"tokenScope\"\n ],\n \"type\": \"object\"\n },\n {\n \"additionalProperties\": false,\n \"description\": \"Egress: the host of `tokenEndpoint`, and nothing else.\",\n \"properties\": {\n \"audience\": {\n \"description\": \"The assertion's `aud`. Absent means `tokenEndpoint`.\",\n \"maxLength\": 2048,\n \"pattern\": \"^[!-~]+$\",\n \"type\": \"string\"\n },\n \"clientId\": {\n \"maxLength\": 512,\n \"minLength\": 1,\n \"pattern\": \"^[!-~]+$\",\n \"type\": \"string\"\n },\n \"model\": {\n \"const\": \"oauth2-private-key-jwt\",\n \"type\": \"string\"\n },\n \"scopes\": {\n \"description\": \"The scopes a binding may request, the ceiling for every issuance.\",\n \"items\": {\n \"maxLength\": 256,\n \"pattern\": \"^[!#-\\\\[\\\\]-~]+$\",\n \"type\": \"string\"\n },\n \"maxItems\": 64,\n \"type\": \"array\",\n \"uniqueItems\": true\n },\n \"signingAlgorithm\": {\n \"enum\": [\n \"ES256\",\n \"RS256\"\n ],\n \"type\": \"string\"\n },\n \"tokenEndpoint\": {\n \"$ref\": \"#/$defs/ProviderHttpsUrl\"\n }\n },\n \"required\": [\n \"model\",\n \"tokenEndpoint\",\n \"clientId\"\n ],\n \"type\": \"object\"\n },\n {\n \"additionalProperties\": false,\n \"description\": \"Issuance needs no egress: presigning is a computation inside the custodian, and the consumer uses the URL itself. The probe connects to the host of `endpoint`, which `egressHosts` therefore lists.\",\n \"properties\": {\n \"accessKeyId\": {\n \"description\": \"The access key's identifier. Not a secret: it appears in every presigned URL. The secret half is set with external/accounts/secret/set and never returned.\",\n \"maxLength\": 128,\n \"pattern\": \"^[A-Za-z0-9]+$\",\n \"type\": \"string\"\n },\n \"bucket\": {\n \"$ref\": \"#/$defs/ProviderBucketName\"\n },\n \"endpoint\": {\n \"$ref\": \"#/$defs/ProviderHttpsUrl\"\n },\n \"model\": {\n \"const\": \"s3-static-presign\",\n \"type\": \"string\"\n },\n \"pathStyle\": {\n \"description\": \"Address the bucket in the path rather than the host name, as MinIO usually needs.\",\n \"type\": \"boolean\"\n },\n \"probePrefix\": {\n \"$ref\": \"#/$defs/ProviderObjectPrefix\",\n \"description\": \"Where external/accounts/probe writes its canary when no binding names a narrower prefix. Lets a new account be probed before anything is bound to it. Absent, a probe of an account with no bindings stops after `exchange` and reports `complete: false`.\"\n },\n \"region\": {\n \"description\": \"The SigV4 signing region; `auto` for Cloudflare R2.\",\n \"maxLength\": 64,\n \"pattern\": \"^[a-z0-9-]+$\",\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"model\",\n \"endpoint\",\n \"region\",\n \"bucket\",\n \"accessKeyId\"\n ],\n \"type\": \"object\"\n },\n {\n \"additionalProperties\": false,\n \"description\": \"No egress: the custodian signs and the consumer submits the transaction. The allow-list, the gas caps and the coin caps are the account's whole authority; a transaction outside them is refused before anything is signed.\",\n \"properties\": {\n \"allowedCalls\": {\n \"description\": \"Every MoveCall command in a signed transaction must name one of these. For Walrus storage: the system package's `register_blob`, `certify_blob`, `extend_blob` and `delete_blob`, and the coin calls needed to pay for them.\",\n \"items\": {\n \"$ref\": \"#/$defs/SuiMoveCall\"\n },\n \"maxItems\": 32,\n \"minItems\": 1,\n \"type\": \"array\"\n },\n \"allowedObjects\": {\n \"description\": \"Shared objects a transaction may take as input, such as the Walrus system and staking objects. Absent means any object the allowed calls accept.\",\n \"items\": {\n \"pattern\": \"^0x[0-9a-f]{64}$\",\n \"type\": \"string\"\n },\n \"maxItems\": 32,\n \"type\": \"array\"\n },\n \"maxCoinOutPerTx\": {\n \"description\": \"Per coin type, the most a single transaction may spend or transfer out of the account's address, in the coin's smallest unit. A coin type not listed may not leave the address at all.\",\n \"items\": {\n \"additionalProperties\": false,\n \"properties\": {\n \"amount\": {\n \"minimum\": 0,\n \"type\": \"integer\"\n },\n \"coinType\": {\n \"maxLength\": 512,\n \"pattern\": \"^0x[0-9a-f]{1,64}::[A-Za-z0-9_]+::[A-Za-z0-9_]+$\",\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"coinType\",\n \"amount\"\n ],\n \"type\": \"object\"\n },\n \"maxItems\": 8,\n \"type\": \"array\"\n },\n \"maxGasBudgetMist\": {\n \"description\": \"The largest gas budget one transaction may declare.\",\n \"minimum\": 1,\n \"type\": \"integer\"\n },\n \"maxGasPerDayMist\": {\n \"description\": \"The total gas budget signed per rolling 24 hours.\",\n \"minimum\": 1,\n \"type\": \"integer\"\n },\n \"model\": {\n \"const\": \"sui-signer\",\n \"type\": \"string\"\n },\n \"network\": {\n \"enum\": [\n \"mainnet\",\n \"testnet\",\n \"devnet\"\n ],\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"model\",\n \"network\",\n \"allowedCalls\",\n \"maxGasBudgetMist\",\n \"maxGasPerDayMist\"\n ],\n \"type\": \"object\"\n },\n {\n \"additionalProperties\": false,\n \"description\": \"Egress: the host of `baseUrl`. The secret is set with external/accounts/secret/set and used only inside the custodian by `driver`; a provider reachable only by handing the consumer the raw key is not supported.\",\n \"properties\": {\n \"baseUrl\": {\n \"$ref\": \"#/$defs/ProviderHttpsUrl\"\n },\n \"driver\": {\n \"description\": \"The custodian's driver that uses the secret: performs a login or token exchange and returns a short-lived result. A custodian refuses a driver it does not implement.\",\n \"maxLength\": 64,\n \"pattern\": \"^[a-z0-9][a-z0-9-]*$\",\n \"type\": \"string\"\n },\n \"model\": {\n \"const\": \"static-secret\",\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"model\",\n \"driver\",\n \"baseUrl\"\n ],\n \"type\": \"object\"\n }\n ],\n \"title\": \"AccountSettings\"\n },\n \"AccountState\": {\n \"description\": \"`active`: usable by its bindings. `suspended`: every issuance and signature is refused at once; management reads continue; resumable. `archived`: hidden from default listings, refused for use, restorable. Deletion removes the record.\",\n \"enum\": [\n \"active\",\n \"suspended\",\n \"archived\"\n ],\n \"title\": \"AccountState\",\n \"type\": \"string\"\n },\n \"AuthModel\": {\n \"description\": \"How the account authenticates to its provider. Every model pins the custodian's verification material in the provider's own account, uploaded once, so no model requires the custodian to be reachable from the internet. `aws-roles-anywhere`: the custodian is the certificate authority of an IAM Roles Anywhere trust anchor, and signs CreateSession with a short-lived end-entity certificate it issued to the account's own key. `gcp-wif-pinned`: a Workload Identity Federation pool provider holds an uploaded JWKS; the custodian signs an ID token and exchanges it at Google's STS. `azure-cert`: a certificate uploaded to an Entra app registration; the custodian signs an RFC 7523 client assertion. `oauth2-private-key-jwt`: the same RFC 7523 client authentication against any token endpoint that registered the custodian's public key. `s3-static-presign`: an access-key pair for an S3-compatible store that cannot federate; the custodian presigns per-object URLs and never releases the key. `sui-signer`: a Sui address derived from the custodian's key; the custodian signs only allow-listed transactions. `static-secret`: an API key or token used inside the custodian by a named driver; last resort, never released.\\n\\nPlain OpenID Connect discovery federation is deliberately absent. It works by the provider fetching the issuer's JWKS from a public URL, which either makes the custodian reachable from the internet or makes whoever hosts a copy of the JWKS able to mint credentials for every federated role.\",\n \"enum\": [\n \"aws-roles-anywhere\",\n \"gcp-wif-pinned\",\n \"azure-cert\",\n \"oauth2-private-key-jwt\",\n \"s3-static-presign\",\n \"sui-signer\",\n \"static-secret\"\n ],\n \"title\": \"AuthModel\",\n \"type\": \"string\"\n },\n \"AwsArn\": {\n \"maxLength\": 2048,\n \"pattern\": \"^arn:aws[a-z-]*:[a-z0-9-]+:[a-z0-9-]*:[0-9]{0,12}:[A-Za-z0-9+=,.@_/:-]+$\",\n \"title\": \"AwsArn\",\n \"type\": \"string\"\n },\n \"AwsRegion\": {\n \"maxLength\": 32,\n \"pattern\": \"^[a-z]{2}(-gov)?-[a-z]+-[0-9]$\",\n \"title\": \"AwsRegion\",\n \"type\": \"string\"\n },\n \"CredentialScopeCeiling\": {\n \"additionalProperties\": false,\n \"description\": \"The widest scope a binding's consumer may request. An issuance is inside the ceiling when its `prefix` begins with one of `prefixes`, every one of its `actions` is in `actions`, and every one of its `scopes` is in `scopes`. Absent members confer nothing: a ceiling with no `prefixes` permits no storage issuance.\",\n \"properties\": {\n \"actions\": {\n \"items\": {\n \"$ref\": \"#/$defs/ProviderObjectAction\"\n },\n \"maxItems\": 3,\n \"minItems\": 1,\n \"type\": \"array\",\n \"uniqueItems\": true\n },\n \"prefixes\": {\n \"items\": {\n \"$ref\": \"#/$defs/ProviderObjectPrefix\"\n },\n \"maxItems\": 64,\n \"minItems\": 1,\n \"type\": \"array\",\n \"uniqueItems\": true\n },\n \"scopes\": {\n \"items\": {\n \"maxLength\": 256,\n \"pattern\": \"^[!#-\\\\[\\\\]-~]+$\",\n \"type\": \"string\"\n },\n \"maxItems\": 64,\n \"type\": \"array\",\n \"uniqueItems\": true\n }\n },\n \"title\": \"CredentialScopeCeiling\",\n \"type\": \"object\"\n },\n \"DigestMultibase\": {\n \"description\": \"A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.\\n\\nMultihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.\\n\\nThis definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.\\n\\nRestricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that \\\"interoperability is not guaranteed between implementations using such values\\\", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.\",\n \"examples\": [\n \"zQmbWqxBEKC3P8tqsKc98xmWNzrzDtRLMiMPL8wBuTGsMnR\"\n ],\n \"minLength\": 16,\n \"pattern\": \"^(z[1-9A-HJ-NP-Za-km-z]+|u[A-Za-z0-9_-]+)$\",\n \"title\": \"DigestMultibase\",\n \"type\": \"string\"\n },\n \"Ext\": {\n \"additionalProperties\": true,\n \"description\": \"Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.\",\n \"minProperties\": 1,\n \"propertyNames\": {\n \"pattern\": \"^[a-z][a-z0-9-]*(\\\\.[a-z0-9-]+)+$\"\n },\n \"title\": \"Ext\",\n \"type\": \"object\"\n },\n \"ExternalAccount\": {\n \"additionalProperties\": false,\n \"description\": \"An account as every read returns it. Contains no private key, no secret and no issued credential, to any reader.\",\n \"properties\": {\n \"bindings\": {\n \"items\": {\n \"$ref\": \"#/$defs/AccountBinding\"\n },\n \"maxItems\": 256,\n \"type\": \"array\"\n },\n \"context\": {\n \"$ref\": \"#/$defs/AccountContextId\"\n },\n \"createdAt\": {\n \"format\": \"date-time\",\n \"type\": \"string\"\n },\n \"egressHosts\": {\n \"description\": \"The provider hosts the custodian connects to on this account's behalf, derived by the custodian from its settings: the token or session endpoints issuance uses, and the destinations external/accounts/probe dials (the object store's host, for a storage model). The custodian MUST NOT connect anywhere else on the account's behalf, so an egress proxy can allow exactly this set. Empty only for a model that neither exchanges nor probes over the network.\",\n \"items\": {\n \"maxLength\": 253,\n \"pattern\": \"^[a-z0-9.-]+$\",\n \"type\": \"string\"\n },\n \"maxItems\": 8,\n \"type\": \"array\"\n },\n \"id\": {\n \"$ref\": \"#/$defs/AccountId\"\n },\n \"label\": {\n \"description\": \"Display name. Untrusted text: render it, never interpret it.\",\n \"maxLength\": 128,\n \"minLength\": 1,\n \"type\": \"string\"\n },\n \"lastProbe\": {\n \"$ref\": \"#/$defs/AccountProbeReport\"\n },\n \"providerSetupRequired\": {\n \"description\": \"True when the account cannot be used until its provider-side setup is redone: after a restore that could not carry its key or secret (a wrapped RSA key, a static secret), or after a rotation awaiting confirmation.\",\n \"type\": \"boolean\"\n },\n \"publicMaterial\": {\n \"$ref\": \"#/$defs/AccountPublicMaterial\",\n \"description\": \"Absent for the static models, which hold a secret rather than a key.\"\n },\n \"secret\": {\n \"$ref\": \"#/$defs/AccountSecretInfo\",\n \"description\": \"Static models only; absent until the secret is set.\"\n },\n \"settings\": {\n \"$ref\": \"#/$defs/AccountSettings\"\n },\n \"state\": {\n \"$ref\": \"#/$defs/AccountState\"\n },\n \"updatedAt\": {\n \"format\": \"date-time\",\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"id\",\n \"label\",\n \"context\",\n \"settings\",\n \"state\",\n \"bindings\",\n \"egressHosts\",\n \"providerSetupRequired\",\n \"createdAt\",\n \"updatedAt\"\n ],\n \"title\": \"ExternalAccount\",\n \"type\": \"object\"\n },\n \"ProviderBucketName\": {\n \"description\": \"A bucket name as S3 and GCS accept it. Validated rather than free so that it can be placed in a provider policy without escaping.\",\n \"maxLength\": 63,\n \"minLength\": 3,\n \"pattern\": \"^[a-z0-9][a-z0-9.-]*[a-z0-9]$\",\n \"title\": \"ProviderBucketName\",\n \"type\": \"string\"\n },\n \"ProviderHttpsUrl\": {\n \"format\": \"uri\",\n \"maxLength\": 2048,\n \"pattern\": \"^https://[^\\\\s\\\"'\\\\\\\\]+$\",\n \"title\": \"ProviderHttpsUrl\",\n \"type\": \"string\"\n },\n \"ProviderObjectAction\": {\n \"description\": \"`put`: write an object. `get`: read one. `delete`: remove one. No list, ACL, policy or bucket-level action exists here, so none can be granted.\",\n \"enum\": [\n \"put\",\n \"get\",\n \"delete\"\n ],\n \"title\": \"ProviderObjectAction\",\n \"type\": \"string\"\n },\n \"ProviderObjectPrefix\": {\n \"description\": \"An object-key prefix within the account's bucket: one or more segments of lowercase letters, digits, `.`, `_` and `-`, each beginning with a letter or digit and ending with `/`. No quote, backslash, wildcard, whitespace, `..` segment or empty segment can appear. That is deliberate: the custodian places this value inside a provider policy — an IAM session policy (JSON), a GCS Credential Access Boundary condition (CEL) — and a value able to carry a metacharacter can break out of the string it is placed in and widen the policy. That is a known class of defect (CVE-2026-42811, a CEL injection in downscoped GCS credentials). Even with this pattern, a custodian MUST build provider policies with the provider language's own encoder, never by string interpolation.\",\n \"maxLength\": 512,\n \"minLength\": 2,\n \"pattern\": \"^([a-z0-9][a-z0-9._-]{0,127}/){1,16}$\",\n \"title\": \"ProviderObjectPrefix\",\n \"type\": \"string\"\n },\n \"Response\": {\n \"$anchor\": \"response\",\n \"additionalProperties\": false,\n \"properties\": {\n \"accounts\": {\n \"items\": {\n \"$ref\": \"#/$defs/ExternalAccount\"\n },\n \"maxItems\": 200,\n \"type\": \"array\"\n },\n \"ext\": {\n \"$ref\": \"#/$defs/Ext\"\n },\n \"nextCursor\": {\n \"maxLength\": 512,\n \"pattern\": \"^[A-Za-z0-9_-]+$\",\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"accounts\"\n ],\n \"title\": \"External Accounts — List — response payload\",\n \"type\": \"object\"\n },\n \"SecretFingerprint\": {\n \"description\": \"Which secret is set, without being a way to test guesses at it. `hmacsha256:` followed by the base64url encoding, without padding, of the first 16 bytes of HMAC-SHA256 over the secret's bytes under a fingerprint key the custodian holds and never discloses. Comparable only between fingerprints made by the same custodian: a re-entered value can be confirmed, while the same secret at two custodians gives unrelated fingerprints. Never a bare hash of the secret, which would let anyone who reads it run a dictionary against it offline; and deliberately not a DigestMultibase, since multihash has no code for a keyed digest.\",\n \"maxLength\": 33,\n \"pattern\": \"^hmacsha256:[A-Za-z0-9_-]{22}$\",\n \"title\": \"SecretFingerprint\",\n \"type\": \"string\"\n },\n \"SuiMoveCall\": {\n \"additionalProperties\": false,\n \"description\": \"One Move function an account's transactions may call.\",\n \"properties\": {\n \"function\": {\n \"pattern\": \"^[A-Za-z][A-Za-z0-9_]{0,127}$\",\n \"type\": \"string\"\n },\n \"module\": {\n \"pattern\": \"^[A-Za-z][A-Za-z0-9_]{0,127}$\",\n \"type\": \"string\"\n },\n \"package\": {\n \"pattern\": \"^0x[0-9a-f]{64}$\",\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"package\",\n \"module\",\n \"function\"\n ],\n \"title\": \"SuiMoveCall\",\n \"type\": \"object\"\n }\n },\n \"$ref\": \"#/$defs/Response\",\n \"$schema\": \"https://json-schema.org/draft/2020-12/schema\"\n}\n",
);
}
impl crate::RequestPayload for Payload {
type Response = Response;
}
/// The extended error codes this specification declares (SPEC §7.3 item 9,
/// §8.5), in declaration order. Empty when it declares none.
pub const ERROR_CODES: &[crate::DeclaredErrorCode] = &[];