trust-tasks-rs 0.35.4

//! Generated by `trust-tasks-codegen` — do not edit by hand.
//!
//! Spec slug: `external/credentials/issue`. Version: `0.2`.
#![allow(deprecated)]
/// Why this specification version is deprecated (SPEC "Superseded and
/// Withdrawn Versions"), or `None` while it is current.
pub const DEPRECATION: Option<&str> = Some("superseded by external/credentials/issue/0.3");
#[allow(unused_imports)]
use serde::{Deserialize, Serialize};
/// Error types.
pub mod error {
    /// Error from a `TryFrom` or `FromStr` implementation.
    pub struct ConversionError(::std::borrow::Cow<'static, str>);
    impl ::std::error::Error for ConversionError {}
    impl ::std::fmt::Display for ConversionError {
        fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> Result<(), ::std::fmt::Error> {
            ::std::fmt::Display::fmt(&self.0, f)
        }
    }
    impl ::std::fmt::Debug for ConversionError {
        fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> Result<(), ::std::fmt::Error> {
            ::std::fmt::Debug::fmt(&self.0, f)
        }
    }
    impl From<&'static str> for ConversionError {
        fn from(value: &'static str) -> Self {
            Self(value.into())
        }
    }
    impl From<String> for ConversionError {
        fn from(value: String) -> Self {
            Self(value.into())
        }
    }
}
///The custodian context that owns the account. Act scope in this context decides who may manage the account and who may consume it; the account's keys are derived in this context's key space.
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountContextId(::std::string::String);
impl ::std::ops::Deref for AccountContextId {
    type Target = ::std::string::String;
    fn deref(&self) -> &::std::string::String {
        &self.0
    }
}
impl ::std::convert::From<AccountContextId> for ::std::string::String {
    fn from(value: AccountContextId) -> Self {
        value.0
    }
}
impl ::std::str::FromStr for AccountContextId {
    type Err = self::error::ConversionError;
    fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        if value.chars().count() > 256usize {
            return Err("longer than 256 characters".into());
        }
        if value.chars().count() < 1usize {
            return Err("shorter than 1 characters".into());
        }
        Ok(Self(value.to_string()))
    }
}
impl ::std::convert::TryFrom<&str> for AccountContextId {
    type Error = self::error::ConversionError;
    fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountContextId {
    type Error = self::error::ConversionError;
    fn try_from(
        value: &::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<::std::string::String> for AccountContextId {
    type Error = self::error::ConversionError;
    fn try_from(
        value: ::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl<'de> ::serde::Deserialize<'de> for AccountContextId {
    fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
    where
        D: ::serde::Deserializer<'de>,
    {
        ::std::string::String::deserialize(deserializer)?
            .parse()
            .map_err(|e: self::error::ConversionError| {
                <D::Error as ::serde::de::Error>::custom(e.to_string())
            })
    }
}
///The account's identifier within its context, chosen by whoever creates it. Lowercase letters, digits and hyphens, so that it can be embedded in a certificate subject, a token subject or a provider-side condition without escaping. Unique per context; never reused after deletion while anything that names it (a provider-side trust policy, an audit row) may still exist.
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountId(::std::string::String);
impl ::std::ops::Deref for AccountId {
    type Target = ::std::string::String;
    fn deref(&self) -> &::std::string::String {
        &self.0
    }
}
impl ::std::convert::From<AccountId> for ::std::string::String {
    fn from(value: AccountId) -> Self {
        value.0
    }
}
impl ::std::str::FromStr for AccountId {
    type Err = self::error::ConversionError;
    fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        if value.chars().count() > 64usize {
            return Err("longer than 64 characters".into());
        }
        if value.chars().count() < 1usize {
            return Err("shorter than 1 characters".into());
        }
        static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
            ::std::sync::LazyLock::new(|| ::regress::Regex::new("^[a-z0-9][a-z0-9-]*$").unwrap());
        if PATTERN.find(value).is_none() {
            return Err("doesn't match pattern \"^[a-z0-9][a-z0-9-]*$\"".into());
        }
        Ok(Self(value.to_string()))
    }
}
impl ::std::convert::TryFrom<&str> for AccountId {
    type Error = self::error::ConversionError;
    fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountId {
    type Error = self::error::ConversionError;
    fn try_from(
        value: &::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<::std::string::String> for AccountId {
    type Error = self::error::ConversionError;
    fn try_from(
        value: ::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl<'de> ::serde::Deserialize<'de> for AccountId {
    fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
    where
        D: ::serde::Deserializer<'de>,
    {
        ::std::string::String::deserialize(deserializer)?
            .parse()
            .map_err(|e: self::error::ConversionError| {
                <D::Error as ::serde::de::Error>::custom(e.to_string())
            })
    }
}
///A SHA-256 digest in standard base64 (RFC 4648 §4, padded), as S3 carries it in `x-amz-checksum-sha256`.
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct ChecksumSha256(::std::string::String);
impl ::std::ops::Deref for ChecksumSha256 {
    type Target = ::std::string::String;
    fn deref(&self) -> &::std::string::String {
        &self.0
    }
}
impl ::std::convert::From<ChecksumSha256> for ::std::string::String {
    fn from(value: ChecksumSha256) -> Self {
        value.0
    }
}
impl ::std::str::FromStr for ChecksumSha256 {
    type Err = self::error::ConversionError;
    fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        if value.chars().count() > 44usize {
            return Err("longer than 44 characters".into());
        }
        if value.chars().count() < 44usize {
            return Err("shorter than 44 characters".into());
        }
        static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
            ::std::sync::LazyLock::new(|| ::regress::Regex::new("^[A-Za-z0-9+/]{43}=$").unwrap());
        if PATTERN.find(value).is_none() {
            return Err("doesn't match pattern \"^[A-Za-z0-9+/]{43}=$\"".into());
        }
        Ok(Self(value.to_string()))
    }
}
impl ::std::convert::TryFrom<&str> for ChecksumSha256 {
    type Error = self::error::ConversionError;
    fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<&::std::string::String> for ChecksumSha256 {
    type Error = self::error::ConversionError;
    fn try_from(
        value: &::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<::std::string::String> for ChecksumSha256 {
    type Error = self::error::ConversionError;
    fn try_from(
        value: ::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl<'de> ::serde::Deserialize<'de> for ChecksumSha256 {
    fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
    where
        D: ::serde::Deserializer<'de>,
    {
        ::std::string::String::deserialize(deserializer)?
            .parse()
            .map_err(|e: self::error::ConversionError| {
                <D::Error as ::serde::de::Error>::custom(e.to_string())
            })
    }
}
///What one issuance may do. For storage models, `prefix` and `actions` (both required, a rule this schema leaves to the custodian because other models use neither); for `s3-static-presign`, also `objectKey`, since a presigned URL is one operation on one object; for `oauth2-private-key-jwt`, `scopes`.
///
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct CredentialScope {
    #[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
    pub actions: ::std::option::Option<Vec<ProviderObjectAction>>,
    ///`s3-static-presign` only: the object's name within `prefix`. The presigned URL names `prefix` + `objectKey` and nothing else, and `actions` must hold exactly one action.
    #[serde(
        rename = "objectKey",
        default,
        skip_serializing_if = "::std::option::Option::is_none"
    )]
    pub object_key: ::std::option::Option<CredentialScopeObjectKey>,
    #[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
    pub prefix: ::std::option::Option<ProviderObjectPrefix>,
    ///`oauth2-private-key-jwt` only: the OAuth scopes requested.
    #[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
    pub scopes: ::std::option::Option<Vec<CredentialScopeScopesItem>>,
}
impl ::std::default::Default for CredentialScope {
    fn default() -> Self {
        Self {
            actions: Default::default(),
            object_key: Default::default(),
            prefix: Default::default(),
            scopes: Default::default(),
        }
    }
}
impl CredentialScope {
    pub fn builder() -> builder::CredentialScope {
        Default::default()
    }
}
///`s3-static-presign` only: the object's name within `prefix`. The presigned URL names `prefix` + `objectKey` and nothing else, and `actions` must hold exactly one action.
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct CredentialScopeObjectKey(::std::string::String);
impl ::std::ops::Deref for CredentialScopeObjectKey {
    type Target = ::std::string::String;
    fn deref(&self) -> &::std::string::String {
        &self.0
    }
}
impl ::std::convert::From<CredentialScopeObjectKey> for ::std::string::String {
    fn from(value: CredentialScopeObjectKey) -> Self {
        value.0
    }
}
impl ::std::str::FromStr for CredentialScopeObjectKey {
    type Err = self::error::ConversionError;
    fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        if value.chars().count() > 1024usize {
            return Err("longer than 1024 characters".into());
        }
        if value.chars().count() < 1usize {
            return Err("shorter than 1 characters".into());
        }
        static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
            ::std::sync::LazyLock::new(|| ::regress::Regex::new("^[A-Za-z0-9._-]+$").unwrap());
        if PATTERN.find(value).is_none() {
            return Err("doesn't match pattern \"^[A-Za-z0-9._-]+$\"".into());
        }
        Ok(Self(value.to_string()))
    }
}
impl ::std::convert::TryFrom<&str> for CredentialScopeObjectKey {
    type Error = self::error::ConversionError;
    fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<&::std::string::String> for CredentialScopeObjectKey {
    type Error = self::error::ConversionError;
    fn try_from(
        value: &::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<::std::string::String> for CredentialScopeObjectKey {
    type Error = self::error::ConversionError;
    fn try_from(
        value: ::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl<'de> ::serde::Deserialize<'de> for CredentialScopeObjectKey {
    fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
    where
        D: ::serde::Deserializer<'de>,
    {
        ::std::string::String::deserialize(deserializer)?
            .parse()
            .map_err(|e: self::error::ConversionError| {
                <D::Error as ::serde::de::Error>::custom(e.to_string())
            })
    }
}
///`CredentialScopeScopesItem`
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct CredentialScopeScopesItem(::std::string::String);
impl ::std::ops::Deref for CredentialScopeScopesItem {
    type Target = ::std::string::String;
    fn deref(&self) -> &::std::string::String {
        &self.0
    }
}
impl ::std::convert::From<CredentialScopeScopesItem> for ::std::string::String {
    fn from(value: CredentialScopeScopesItem) -> Self {
        value.0
    }
}
impl ::std::str::FromStr for CredentialScopeScopesItem {
    type Err = self::error::ConversionError;
    fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        if value.chars().count() > 256usize {
            return Err("longer than 256 characters".into());
        }
        static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
            ::std::sync::LazyLock::new(|| ::regress::Regex::new("^[!#-\\[\\]-~]+$").unwrap());
        if PATTERN.find(value).is_none() {
            return Err("doesn't match pattern \"^[!#-\\[\\]-~]+$\"".into());
        }
        Ok(Self(value.to_string()))
    }
}
impl ::std::convert::TryFrom<&str> for CredentialScopeScopesItem {
    type Error = self::error::ConversionError;
    fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<&::std::string::String> for CredentialScopeScopesItem {
    type Error = self::error::ConversionError;
    fn try_from(
        value: &::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<::std::string::String> for CredentialScopeScopesItem {
    type Error = self::error::ConversionError;
    fn try_from(
        value: ::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl<'de> ::serde::Deserialize<'de> for CredentialScopeScopesItem {
    fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
    where
        D: ::serde::Deserializer<'de>,
    {
        ::std::string::String::deserialize(deserializer)?
            .parse()
            .map_err(|e: self::error::ConversionError| {
                <D::Error as ::serde::de::Error>::custom(e.to_string())
            })
    }
}
///Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
///
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(transparent)]
pub struct Ext(pub ::std::collections::HashMap<ExtKey, ::serde_json::Value>);
impl ::std::ops::Deref for Ext {
    type Target = ::std::collections::HashMap<ExtKey, ::serde_json::Value>;
    fn deref(&self) -> &::std::collections::HashMap<ExtKey, ::serde_json::Value> {
        &self.0
    }
}
impl ::std::convert::From<Ext> for ::std::collections::HashMap<ExtKey, ::serde_json::Value> {
    fn from(value: Ext) -> Self {
        value.0
    }
}
impl ::std::convert::From<::std::collections::HashMap<ExtKey, ::serde_json::Value>> for Ext {
    fn from(value: ::std::collections::HashMap<ExtKey, ::serde_json::Value>) -> Self {
        Self(value)
    }
}
///`ExtKey`
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct ExtKey(::std::string::String);
impl ::std::ops::Deref for ExtKey {
    type Target = ::std::string::String;
    fn deref(&self) -> &::std::string::String {
        &self.0
    }
}
impl ::std::convert::From<ExtKey> for ::std::string::String {
    fn from(value: ExtKey) -> Self {
        value.0
    }
}
impl ::std::str::FromStr for ExtKey {
    type Err = self::error::ConversionError;
    fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
            ::std::sync::LazyLock::new(|| {
                ::regress::Regex::new("^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$").unwrap()
            });
        if PATTERN.find(value).is_none() {
            return Err("doesn't match pattern \"^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$\"".into());
        }
        Ok(Self(value.to_string()))
    }
}
impl ::std::convert::TryFrom<&str> for ExtKey {
    type Error = self::error::ConversionError;
    fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<&::std::string::String> for ExtKey {
    type Error = self::error::ConversionError;
    fn try_from(
        value: &::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<::std::string::String> for ExtKey {
    type Error = self::error::ConversionError;
    fn try_from(
        value: ::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl<'de> ::serde::Deserialize<'de> for ExtKey {
    fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
    where
        D: ::serde::Deserializer<'de>,
    {
        ::std::string::String::deserialize(deserializer)?
            .parse()
            .map_err(|e: self::error::ConversionError| {
                <D::Error as ::serde::de::Error>::custom(e.to_string())
            })
    }
}
///Obtain a short-lived, downscoped provider credential from an external account, sealed to the caller: session or token credentials under `scope`, or a batch of presigned requests on one object under `presign`. The outer document members are owned by the framework — SPEC §6.3.
///
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(untagged, deny_unknown_fields)]
#[non_exhaustive]
#[deprecated(note = "superseded by external/credentials/issue/0.3")]
pub enum Payload {
    Variant0 {
        account: AccountId,
        context: AccountContextId,
        #[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
        ext: ::std::option::Option<Ext>,
        ///For every brokered model but `s3-static-presign`: the prefix and actions, or the OAuth scopes, the session or token is downscoped to. `objectKey` is not used in this version.
        scope: CredentialScope,
        ///Requested lifetime; never more than the binding's `maxTtlSeconds`. For `presign`, the lifetime of every URL in the batch.
        #[serde(rename = "ttlSeconds")]
        ttl_seconds: i64,
    },
    Variant1 {
        account: AccountId,
        context: AccountContextId,
        #[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
        ext: ::std::option::Option<Ext>,
        presign: PresignBatch,
        ///Requested lifetime; never more than the binding's `maxTtlSeconds`. For `presign`, the lifetime of every URL in the batch.
        #[serde(rename = "ttlSeconds")]
        ttl_seconds: i64,
    },
}
///`s3-static-presign` only: up to 128 operations on **one** object, `prefix` + `objectKey`, and at most one multipart upload of it. Each operation becomes one presigned request, sealed together. Consistency rules JSON Schema cannot state, which the custodian enforces: `uploadId` is present exactly when an operation needs it (`upload-part`, `list-parts`, `complete-multipart`, `abort-multipart`) and absent when the batch holds `create-multipart`; no two operations are identical; no two `upload-part` operations name the same `partNumber`.
///
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct PresignBatch {
    ///The object's name within `prefix`. Every request in the batch names `prefix` + `objectKey` and no other object.
    #[serde(rename = "objectKey")]
    pub object_key: PresignBatchObjectKey,
    pub prefix: ProviderObjectPrefix,
    pub requests: ::std::vec::Vec<PresignRequest>,
    ///The multipart upload the batch's multipart operations act on, as storage returned it from CreateMultipartUpload. Signed into each such request's query, percent-encoded by the SigV4 encoder, never interpolated.
    #[serde(
        rename = "uploadId",
        default,
        skip_serializing_if = "::std::option::Option::is_none"
    )]
    pub upload_id: ::std::option::Option<PresignBatchUploadId>,
}
impl PresignBatch {
    pub fn builder() -> builder::PresignBatch {
        Default::default()
    }
}
///The object's name within `prefix`. Every request in the batch names `prefix` + `objectKey` and no other object.
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct PresignBatchObjectKey(::std::string::String);
impl ::std::ops::Deref for PresignBatchObjectKey {
    type Target = ::std::string::String;
    fn deref(&self) -> &::std::string::String {
        &self.0
    }
}
impl ::std::convert::From<PresignBatchObjectKey> for ::std::string::String {
    fn from(value: PresignBatchObjectKey) -> Self {
        value.0
    }
}
impl ::std::str::FromStr for PresignBatchObjectKey {
    type Err = self::error::ConversionError;
    fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        if value.chars().count() > 1024usize {
            return Err("longer than 1024 characters".into());
        }
        if value.chars().count() < 1usize {
            return Err("shorter than 1 characters".into());
        }
        static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
            ::std::sync::LazyLock::new(|| ::regress::Regex::new("^[A-Za-z0-9._-]+$").unwrap());
        if PATTERN.find(value).is_none() {
            return Err("doesn't match pattern \"^[A-Za-z0-9._-]+$\"".into());
        }
        Ok(Self(value.to_string()))
    }
}
impl ::std::convert::TryFrom<&str> for PresignBatchObjectKey {
    type Error = self::error::ConversionError;
    fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<&::std::string::String> for PresignBatchObjectKey {
    type Error = self::error::ConversionError;
    fn try_from(
        value: &::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<::std::string::String> for PresignBatchObjectKey {
    type Error = self::error::ConversionError;
    fn try_from(
        value: ::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl<'de> ::serde::Deserialize<'de> for PresignBatchObjectKey {
    fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
    where
        D: ::serde::Deserializer<'de>,
    {
        ::std::string::String::deserialize(deserializer)?
            .parse()
            .map_err(|e: self::error::ConversionError| {
                <D::Error as ::serde::de::Error>::custom(e.to_string())
            })
    }
}
///The multipart upload the batch's multipart operations act on, as storage returned it from CreateMultipartUpload. Signed into each such request's query, percent-encoded by the SigV4 encoder, never interpolated.
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct PresignBatchUploadId(::std::string::String);
impl ::std::ops::Deref for PresignBatchUploadId {
    type Target = ::std::string::String;
    fn deref(&self) -> &::std::string::String {
        &self.0
    }
}
impl ::std::convert::From<PresignBatchUploadId> for ::std::string::String {
    fn from(value: PresignBatchUploadId) -> Self {
        value.0
    }
}
impl ::std::str::FromStr for PresignBatchUploadId {
    type Err = self::error::ConversionError;
    fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        if value.chars().count() > 1024usize {
            return Err("longer than 1024 characters".into());
        }
        if value.chars().count() < 1usize {
            return Err("shorter than 1 characters".into());
        }
        static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
            ::std::sync::LazyLock::new(|| ::regress::Regex::new("^[A-Za-z0-9._~+/=-]+$").unwrap());
        if PATTERN.find(value).is_none() {
            return Err("doesn't match pattern \"^[A-Za-z0-9._~+/=-]+$\"".into());
        }
        Ok(Self(value.to_string()))
    }
}
impl ::std::convert::TryFrom<&str> for PresignBatchUploadId {
    type Error = self::error::ConversionError;
    fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<&::std::string::String> for PresignBatchUploadId {
    type Error = self::error::ConversionError;
    fn try_from(
        value: &::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<::std::string::String> for PresignBatchUploadId {
    type Error = self::error::ConversionError;
    fn try_from(
        value: ::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl<'de> ::serde::Deserialize<'de> for PresignBatchUploadId {
    fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
    where
        D: ::serde::Deserializer<'de>,
    {
        ::std::string::String::deserialize(deserializer)?
            .parse()
            .map_err(|e: self::error::ConversionError| {
                <D::Error as ::serde::de::Error>::custom(e.to_string())
            })
    }
}
///One operation to presign, discriminated by `operation`. The ceiling action each needs is in `PresignOperation`.
///
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(tag = "operation", deny_unknown_fields)]
#[non_exhaustive]
pub enum PresignRequest {
    /**
    PresignPut

    PutObject of the whole object, bound to its exact length and SHA-256.*/
    #[serde(rename = "put")]
    Put {
        #[serde(rename = "checksumSha256")]
        checksum_sha256: ChecksumSha256,
        ///The object's exact length in bytes, signed into the request as `Content-Length`. At most 5 GiB, S3's single-request ceiling.
        #[serde(rename = "contentLength")]
        content_length: i64,
    },
    #[serde(rename = "get")]
    Get,
    #[serde(rename = "head")]
    Head,
    #[serde(rename = "delete")]
    Delete,
    #[serde(rename = "create-multipart")]
    CreateMultipart,
    /**
    PresignUploadPart

    UploadPart of one part of `uploadId`, bound to its number, its exact length and its SHA-256.*/
    #[serde(rename = "upload-part")]
    UploadPart {
        #[serde(rename = "checksumSha256")]
        checksum_sha256: ChecksumSha256,
        ///The part's exact length in bytes, signed into the request as `Content-Length`. At most 5 GiB, S3's part ceiling.
        #[serde(rename = "contentLength")]
        content_length: ::std::num::NonZeroU64,
        #[serde(rename = "partNumber")]
        part_number: ::std::num::NonZeroU64,
    },
    /**
    PresignListParts

    ListParts of `uploadId`: each part's number, length, ETag and checksum, up to 1000 per page.*/
    #[serde(rename = "list-parts")]
    ListParts {
        ///List parts after this number. Absent, from the first.
        #[serde(
            rename = "partNumberMarker",
            default,
            skip_serializing_if = "::std::option::Option::is_none"
        )]
        part_number_marker: ::std::option::Option<i64>,
    },
    /**
    PresignCompleteMultipart

    CompleteMultipartUpload of `uploadId`, bound to the assembled object's exact length.*/
    #[serde(rename = "complete-multipart")]
    CompleteMultipart {
        ///The assembled object's exact length in bytes, signed into the request as `x-amz-mp-object-size`, so storage refuses a completion that would assemble any other size. At most 5 TiB, S3's object ceiling.
        #[serde(rename = "contentLength")]
        content_length: i64,
    },
    #[serde(rename = "abort-multipart")]
    AbortMultipart,
}
///`put`: write an object. `get`: read one. `delete`: remove one. No list, ACL, policy or bucket-level action exists here, so none can be granted.
///
#[derive(
    ::serde::Deserialize,
    ::serde::Serialize,
    Clone,
    Copy,
    Debug,
    Eq,
    Hash,
    Ord,
    PartialEq,
    PartialOrd,
)]
#[non_exhaustive]
pub enum ProviderObjectAction {
    #[serde(rename = "put")]
    Put,
    #[serde(rename = "get")]
    Get,
    #[serde(rename = "delete")]
    Delete,
}
impl ::std::fmt::Display for ProviderObjectAction {
    fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> ::std::fmt::Result {
        match *self {
            Self::Put => f.write_str("put"),
            Self::Get => f.write_str("get"),
            Self::Delete => f.write_str("delete"),
        }
    }
}
impl ::std::str::FromStr for ProviderObjectAction {
    type Err = self::error::ConversionError;
    fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        match value {
            "put" => Ok(Self::Put),
            "get" => Ok(Self::Get),
            "delete" => Ok(Self::Delete),
            _ => Err("invalid value".into()),
        }
    }
}
impl ::std::convert::TryFrom<&str> for ProviderObjectAction {
    type Error = self::error::ConversionError;
    fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<&::std::string::String> for ProviderObjectAction {
    type Error = self::error::ConversionError;
    fn try_from(
        value: &::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<::std::string::String> for ProviderObjectAction {
    type Error = self::error::ConversionError;
    fn try_from(
        value: ::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
///An object-key prefix within the account's bucket: one or more segments of lowercase letters, digits, `.`, `_` and `-`, each beginning with a letter or digit and ending with `/`. No quote, backslash, wildcard, whitespace, `..` segment or empty segment can appear. That is deliberate: the custodian places this value inside a provider policy — an IAM session policy (JSON), a GCS Credential Access Boundary condition (CEL) — and a value able to carry a metacharacter can break out of the string it is placed in and widen the policy. That is a known class of defect (CVE-2026-42811, a CEL injection in downscoped GCS credentials). Even with this pattern, a custodian MUST build provider policies with the provider language's own encoder, never by string interpolation.
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct ProviderObjectPrefix(::std::string::String);
impl ::std::ops::Deref for ProviderObjectPrefix {
    type Target = ::std::string::String;
    fn deref(&self) -> &::std::string::String {
        &self.0
    }
}
impl ::std::convert::From<ProviderObjectPrefix> for ::std::string::String {
    fn from(value: ProviderObjectPrefix) -> Self {
        value.0
    }
}
impl ::std::str::FromStr for ProviderObjectPrefix {
    type Err = self::error::ConversionError;
    fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        if value.chars().count() > 512usize {
            return Err("longer than 512 characters".into());
        }
        if value.chars().count() < 2usize {
            return Err("shorter than 2 characters".into());
        }
        static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
            ::std::sync::LazyLock::new(|| {
                ::regress::Regex::new("^([a-z0-9][a-z0-9._-]{0,127}/){1,16}$").unwrap()
            });
        if PATTERN.find(value).is_none() {
            return Err("doesn't match pattern \"^([a-z0-9][a-z0-9._-]{0,127}/){1,16}$\"".into());
        }
        Ok(Self(value.to_string()))
    }
}
impl ::std::convert::TryFrom<&str> for ProviderObjectPrefix {
    type Error = self::error::ConversionError;
    fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<&::std::string::String> for ProviderObjectPrefix {
    type Error = self::error::ConversionError;
    fn try_from(
        value: &::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<::std::string::String> for ProviderObjectPrefix {
    type Error = self::error::ConversionError;
    fn try_from(
        value: ::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl<'de> ::serde::Deserialize<'de> for ProviderObjectPrefix {
    fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
    where
        D: ::serde::Deserializer<'de>,
    {
        ::std::string::String::deserialize(deserializer)?
            .parse()
            .map_err(|e: self::error::ConversionError| {
                <D::Error as ::serde::de::Error>::custom(e.to_string())
            })
    }
}
///`Response`
///
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(untagged, deny_unknown_fields)]
#[non_exhaustive]
#[deprecated(note = "superseded by external/credentials/issue/0.3")]
pub enum Response {
    Variant0 {
        ///The provider's expiry for the credential, in the clear; for `presign`, the earliest expiry in the batch.
        #[serde(rename = "expiresAt")]
        expires_at: ::chrono::DateTime<::chrono::offset::Utc>,
        #[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
        ext: ::std::option::Option<Ext>,
        ///The scope actually granted, which equals the requested one.
        scope: CredentialScope,
        ///A `SealedTransferBundle` (external/_shared/0.1), sealed to the caller's key-agreement key, whose cleartext is an `ExternalCredentialPayload` for `scope` or a `PresignedRequestSet` for `presign`. Bounded at 256 KiB rather than the shared 64 KiB because a batch of 128 presigned requests does not fit 64 KiB.
        #[serde(rename = "sealedCredential")]
        sealed_credential: ResponseVariant0SealedCredential,
    },
    Variant1 {
        ///The provider's expiry for the credential, in the clear; for `presign`, the earliest expiry in the batch.
        #[serde(rename = "expiresAt")]
        expires_at: ::chrono::DateTime<::chrono::offset::Utc>,
        #[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
        ext: ::std::option::Option<Ext>,
        ///The batch actually presigned, which equals the requested one.
        presign: PresignBatch,
        ///A `SealedTransferBundle` (external/_shared/0.1), sealed to the caller's key-agreement key, whose cleartext is an `ExternalCredentialPayload` for `scope` or a `PresignedRequestSet` for `presign`. Bounded at 256 KiB rather than the shared 64 KiB because a batch of 128 presigned requests does not fit 64 KiB.
        #[serde(rename = "sealedCredential")]
        sealed_credential: ResponseVariant1SealedCredential,
    },
}
///A `SealedTransferBundle` (external/_shared/0.1), sealed to the caller's key-agreement key, whose cleartext is an `ExternalCredentialPayload` for `scope` or a `PresignedRequestSet` for `presign`. Bounded at 256 KiB rather than the shared 64 KiB because a batch of 128 presigned requests does not fit 64 KiB.
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct ResponseVariant0SealedCredential(::std::string::String);
impl ::std::ops::Deref for ResponseVariant0SealedCredential {
    type Target = ::std::string::String;
    fn deref(&self) -> &::std::string::String {
        &self.0
    }
}
impl ::std::convert::From<ResponseVariant0SealedCredential> for ::std::string::String {
    fn from(value: ResponseVariant0SealedCredential) -> Self {
        value.0
    }
}
impl ::std::str::FromStr for ResponseVariant0SealedCredential {
    type Err = self::error::ConversionError;
    fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        if value.chars().count() > 262144usize {
            return Err("longer than 262144 characters".into());
        }
        if value.chars().count() < 64usize {
            return Err("shorter than 64 characters".into());
        }
        static PATTERN: ::std::sync::LazyLock<::regress::Regex> = ::std::sync::LazyLock::new(
            || {
                ::regress::Regex::new(
                    "^-----BEGIN VTA SEALED BUNDLE-----[\\s\\S]+-----END VTA SEALED BUNDLE-----\\s*$",
                )
                .unwrap()
            },
        );
        if PATTERN.find(value).is_none() {
            return Err(
                "doesn't match pattern \"^-----BEGIN VTA SEALED BUNDLE-----[\\s\\S]+-----END VTA SEALED BUNDLE-----\\s*$\""
                    .into(),
            );
        }
        Ok(Self(value.to_string()))
    }
}
impl ::std::convert::TryFrom<&str> for ResponseVariant0SealedCredential {
    type Error = self::error::ConversionError;
    fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<&::std::string::String> for ResponseVariant0SealedCredential {
    type Error = self::error::ConversionError;
    fn try_from(
        value: &::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<::std::string::String> for ResponseVariant0SealedCredential {
    type Error = self::error::ConversionError;
    fn try_from(
        value: ::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl<'de> ::serde::Deserialize<'de> for ResponseVariant0SealedCredential {
    fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
    where
        D: ::serde::Deserializer<'de>,
    {
        ::std::string::String::deserialize(deserializer)?
            .parse()
            .map_err(|e: self::error::ConversionError| {
                <D::Error as ::serde::de::Error>::custom(e.to_string())
            })
    }
}
///A `SealedTransferBundle` (external/_shared/0.1), sealed to the caller's key-agreement key, whose cleartext is an `ExternalCredentialPayload` for `scope` or a `PresignedRequestSet` for `presign`. Bounded at 256 KiB rather than the shared 64 KiB because a batch of 128 presigned requests does not fit 64 KiB.
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct ResponseVariant1SealedCredential(::std::string::String);
impl ::std::ops::Deref for ResponseVariant1SealedCredential {
    type Target = ::std::string::String;
    fn deref(&self) -> &::std::string::String {
        &self.0
    }
}
impl ::std::convert::From<ResponseVariant1SealedCredential> for ::std::string::String {
    fn from(value: ResponseVariant1SealedCredential) -> Self {
        value.0
    }
}
impl ::std::str::FromStr for ResponseVariant1SealedCredential {
    type Err = self::error::ConversionError;
    fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        if value.chars().count() > 262144usize {
            return Err("longer than 262144 characters".into());
        }
        if value.chars().count() < 64usize {
            return Err("shorter than 64 characters".into());
        }
        static PATTERN: ::std::sync::LazyLock<::regress::Regex> = ::std::sync::LazyLock::new(
            || {
                ::regress::Regex::new(
                    "^-----BEGIN VTA SEALED BUNDLE-----[\\s\\S]+-----END VTA SEALED BUNDLE-----\\s*$",
                )
                .unwrap()
            },
        );
        if PATTERN.find(value).is_none() {
            return Err(
                "doesn't match pattern \"^-----BEGIN VTA SEALED BUNDLE-----[\\s\\S]+-----END VTA SEALED BUNDLE-----\\s*$\""
                    .into(),
            );
        }
        Ok(Self(value.to_string()))
    }
}
impl ::std::convert::TryFrom<&str> for ResponseVariant1SealedCredential {
    type Error = self::error::ConversionError;
    fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<&::std::string::String> for ResponseVariant1SealedCredential {
    type Error = self::error::ConversionError;
    fn try_from(
        value: &::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl ::std::convert::TryFrom<::std::string::String> for ResponseVariant1SealedCredential {
    type Error = self::error::ConversionError;
    fn try_from(
        value: ::std::string::String,
    ) -> ::std::result::Result<Self, self::error::ConversionError> {
        value.parse()
    }
}
impl<'de> ::serde::Deserialize<'de> for ResponseVariant1SealedCredential {
    fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
    where
        D: ::serde::Deserializer<'de>,
    {
        ::std::string::String::deserialize(deserializer)?
            .parse()
            .map_err(|e: self::error::ConversionError| {
                <D::Error as ::serde::de::Error>::custom(e.to_string())
            })
    }
}
/// Types for composing complex structures.
pub mod builder {
    #[derive(Clone, Debug)]
    pub struct CredentialScope {
        actions: ::std::result::Result<
            ::std::option::Option<Vec<super::ProviderObjectAction>>,
            ::std::string::String,
        >,
        object_key: ::std::result::Result<
            ::std::option::Option<super::CredentialScopeObjectKey>,
            ::std::string::String,
        >,
        prefix: ::std::result::Result<
            ::std::option::Option<super::ProviderObjectPrefix>,
            ::std::string::String,
        >,
        scopes: ::std::result::Result<
            ::std::option::Option<Vec<super::CredentialScopeScopesItem>>,
            ::std::string::String,
        >,
    }
    impl ::std::default::Default for CredentialScope {
        fn default() -> Self {
            Self {
                actions: Ok(Default::default()),
                object_key: Ok(Default::default()),
                prefix: Ok(Default::default()),
                scopes: Ok(Default::default()),
            }
        }
    }
    impl CredentialScope {
        pub fn actions<T>(mut self, value: T) -> Self
        where
            T: ::std::convert::TryInto<::std::option::Option<Vec<super::ProviderObjectAction>>>,
            T::Error: ::std::fmt::Display,
        {
            self.actions = value
                .try_into()
                .map_err(|e| format!("error converting supplied value for actions: {e}"));
            self
        }
        pub fn object_key<T>(mut self, value: T) -> Self
        where
            T: ::std::convert::TryInto<::std::option::Option<super::CredentialScopeObjectKey>>,
            T::Error: ::std::fmt::Display,
        {
            self.object_key = value
                .try_into()
                .map_err(|e| format!("error converting supplied value for object_key: {e}"));
            self
        }
        pub fn prefix<T>(mut self, value: T) -> Self
        where
            T: ::std::convert::TryInto<::std::option::Option<super::ProviderObjectPrefix>>,
            T::Error: ::std::fmt::Display,
        {
            self.prefix = value
                .try_into()
                .map_err(|e| format!("error converting supplied value for prefix: {e}"));
            self
        }
        pub fn scopes<T>(mut self, value: T) -> Self
        where
            T: ::std::convert::TryInto<
                ::std::option::Option<Vec<super::CredentialScopeScopesItem>>,
            >,
            T::Error: ::std::fmt::Display,
        {
            self.scopes = value
                .try_into()
                .map_err(|e| format!("error converting supplied value for scopes: {e}"));
            self
        }
    }
    impl ::std::convert::TryFrom<CredentialScope> for super::CredentialScope {
        type Error = super::error::ConversionError;
        fn try_from(
            value: CredentialScope,
        ) -> ::std::result::Result<Self, super::error::ConversionError> {
            Ok(Self {
                actions: value.actions?,
                object_key: value.object_key?,
                prefix: value.prefix?,
                scopes: value.scopes?,
            })
        }
    }
    impl ::std::convert::From<super::CredentialScope> for CredentialScope {
        fn from(value: super::CredentialScope) -> Self {
            Self {
                actions: Ok(value.actions),
                object_key: Ok(value.object_key),
                prefix: Ok(value.prefix),
                scopes: Ok(value.scopes),
            }
        }
    }
    #[derive(Clone, Debug)]
    pub struct PresignBatch {
        object_key: ::std::result::Result<super::PresignBatchObjectKey, ::std::string::String>,
        prefix: ::std::result::Result<super::ProviderObjectPrefix, ::std::string::String>,
        requests:
            ::std::result::Result<::std::vec::Vec<super::PresignRequest>, ::std::string::String>,
        upload_id: ::std::result::Result<
            ::std::option::Option<super::PresignBatchUploadId>,
            ::std::string::String,
        >,
    }
    impl ::std::default::Default for PresignBatch {
        fn default() -> Self {
            Self {
                object_key: Err("no value supplied for object_key".to_string()),
                prefix: Err("no value supplied for prefix".to_string()),
                requests: Err("no value supplied for requests".to_string()),
                upload_id: Ok(Default::default()),
            }
        }
    }
    impl PresignBatch {
        pub fn object_key<T>(mut self, value: T) -> Self
        where
            T: ::std::convert::TryInto<super::PresignBatchObjectKey>,
            T::Error: ::std::fmt::Display,
        {
            self.object_key = value
                .try_into()
                .map_err(|e| format!("error converting supplied value for object_key: {e}"));
            self
        }
        pub fn prefix<T>(mut self, value: T) -> Self
        where
            T: ::std::convert::TryInto<super::ProviderObjectPrefix>,
            T::Error: ::std::fmt::Display,
        {
            self.prefix = value
                .try_into()
                .map_err(|e| format!("error converting supplied value for prefix: {e}"));
            self
        }
        pub fn requests<T>(mut self, value: T) -> Self
        where
            T: ::std::convert::TryInto<::std::vec::Vec<super::PresignRequest>>,
            T::Error: ::std::fmt::Display,
        {
            self.requests = value
                .try_into()
                .map_err(|e| format!("error converting supplied value for requests: {e}"));
            self
        }
        pub fn upload_id<T>(mut self, value: T) -> Self
        where
            T: ::std::convert::TryInto<::std::option::Option<super::PresignBatchUploadId>>,
            T::Error: ::std::fmt::Display,
        {
            self.upload_id = value
                .try_into()
                .map_err(|e| format!("error converting supplied value for upload_id: {e}"));
            self
        }
    }
    impl ::std::convert::TryFrom<PresignBatch> for super::PresignBatch {
        type Error = super::error::ConversionError;
        fn try_from(
            value: PresignBatch,
        ) -> ::std::result::Result<Self, super::error::ConversionError> {
            Ok(Self {
                object_key: value.object_key?,
                prefix: value.prefix?,
                requests: value.requests?,
                upload_id: value.upload_id?,
            })
        }
    }
    impl ::std::convert::From<super::PresignBatch> for PresignBatch {
        fn from(value: super::PresignBatch) -> Self {
            Self {
                object_key: Ok(value.object_key),
                prefix: Ok(value.prefix),
                requests: Ok(value.requests),
                upload_id: Ok(value.upload_id),
            }
        }
    }
}
impl crate::Payload for Payload {
    const TYPE_URI: &'static str = "https://trusttasks.org/spec/external/credentials/issue/0.2";
    const IS_PROOF_REQUIRED: bool = true;
    const IS_ISSUED_AT_REQUIRED: bool = true;
    const MAX_DOCUMENT_BYTES: Option<usize> = Some(65536usize);
    const IS_RECIPIENT_REQUIRED: bool = true;
    const PAYLOAD_SCHEMA: Option<&'static str> = Some(
        "{\"$defs\":{\"AccountContextId\":{\"description\":\"The custodian context that owns the account. Act scope in this context decides who may manage the account and who may consume it; the account's keys are derived in this context's key space.\",\"maxLength\":256,\"minLength\":1,\"title\":\"AccountContextId\",\"type\":\"string\"},\"AccountId\":{\"description\":\"The account's identifier within its context, chosen by whoever creates it. Lowercase letters, digits and hyphens, so that it can be embedded in a certificate subject, a token subject or a provider-side condition without escaping. Unique per context; never reused after deletion while anything that names it (a provider-side trust policy, an audit row) may still exist.\",\"maxLength\":64,\"minLength\":1,\"pattern\":\"^[a-z0-9][a-z0-9-]*$\",\"title\":\"AccountId\",\"type\":\"string\"},\"ChecksumSha256\":{\"description\":\"A SHA-256 digest in standard base64 (RFC 4648 §4, padded), as S3 carries it in `x-amz-checksum-sha256`.\",\"maxLength\":44,\"minLength\":44,\"pattern\":\"^[A-Za-z0-9+/]{43}=$\",\"title\":\"ChecksumSha256\",\"type\":\"string\"},\"CredentialScope\":{\"additionalProperties\":false,\"description\":\"What one issuance may do. For storage models, `prefix` and `actions` (both required, a rule this schema leaves to the custodian because other models use neither); for `s3-static-presign`, also `objectKey`, since a presigned URL is one operation on one object; for `oauth2-private-key-jwt`, `scopes`.\",\"properties\":{\"actions\":{\"items\":{\"$ref\":\"#/$defs/ProviderObjectAction\"},\"maxItems\":3,\"minItems\":1,\"type\":\"array\",\"uniqueItems\":true},\"objectKey\":{\"description\":\"`s3-static-presign` only: the object's name within `prefix`. The presigned URL names `prefix` + `objectKey` and nothing else, and `actions` must hold exactly one action.\",\"maxLength\":1024,\"minLength\":1,\"pattern\":\"^[A-Za-z0-9._-]+$\",\"type\":\"string\"},\"prefix\":{\"$ref\":\"#/$defs/ProviderObjectPrefix\"},\"scopes\":{\"description\":\"`oauth2-private-key-jwt` only: the OAuth scopes requested.\",\"items\":{\"maxLength\":256,\"pattern\":\"^[!#-\\\\[\\\\]-~]+$\",\"type\":\"string\"},\"maxItems\":64,\"type\":\"array\",\"uniqueItems\":true}},\"title\":\"CredentialScope\",\"type\":\"object\"},\"Ext\":{\"additionalProperties\":true,\"description\":\"Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.\",\"minProperties\":1,\"propertyNames\":{\"pattern\":\"^[a-z][a-z0-9-]*(\\\\.[a-z0-9-]+)+$\"},\"title\":\"Ext\",\"type\":\"object\"},\"PresignBatch\":{\"additionalProperties\":false,\"description\":\"`s3-static-presign` only: up to 128 operations on **one** object, `prefix` + `objectKey`, and at most one multipart upload of it. Each operation becomes one presigned request, sealed together. Consistency rules JSON Schema cannot state, which the custodian enforces: `uploadId` is present exactly when an operation needs it (`upload-part`, `list-parts`, `complete-multipart`, `abort-multipart`) and absent when the batch holds `create-multipart`; no two operations are identical; no two `upload-part` operations name the same `partNumber`.\",\"properties\":{\"objectKey\":{\"description\":\"The object's name within `prefix`. Every request in the batch names `prefix` + `objectKey` and no other object.\",\"maxLength\":1024,\"minLength\":1,\"pattern\":\"^[A-Za-z0-9._-]+$\",\"type\":\"string\"},\"prefix\":{\"$ref\":\"#/$defs/ProviderObjectPrefix\"},\"requests\":{\"items\":{\"$ref\":\"#/$defs/PresignRequest\"},\"maxItems\":128,\"minItems\":1,\"type\":\"array\"},\"uploadId\":{\"description\":\"The multipart upload the batch's multipart operations act on, as storage returned it from CreateMultipartUpload. Signed into each such request's query, percent-encoded by the SigV4 encoder, never interpolated.\",\"maxLength\":1024,\"minLength\":1,\"pattern\":\"^[A-Za-z0-9._~+/=-]+$\",\"type\":\"string\"}},\"required\":[\"prefix\",\"objectKey\",\"requests\"],\"title\":\"PresignBatch\",\"type\":\"object\"},\"PresignRequest\":{\"description\":\"One operation to presign, discriminated by `operation`. The ceiling action each needs is in `PresignOperation`.\",\"oneOf\":[{\"additionalProperties\":false,\"description\":\"PutObject of the whole object, bound to its exact length and SHA-256.\",\"properties\":{\"checksumSha256\":{\"$ref\":\"#/$defs/ChecksumSha256\"},\"contentLength\":{\"description\":\"The object's exact length in bytes, signed into the request as `Content-Length`. At most 5 GiB, S3's single-request ceiling.\",\"maximum\":5368709120,\"minimum\":0,\"type\":\"integer\"},\"operation\":{\"const\":\"put\",\"type\":\"string\"}},\"required\":[\"operation\",\"contentLength\",\"checksumSha256\"],\"title\":\"PresignPut\",\"type\":\"object\"},{\"additionalProperties\":false,\"description\":\"GetObject.\",\"properties\":{\"operation\":{\"const\":\"get\",\"type\":\"string\"}},\"required\":[\"operation\"],\"title\":\"PresignGet\",\"type\":\"object\"},{\"additionalProperties\":false,\"description\":\"HeadObject, with `x-amz-checksum-mode: ENABLED` signed so storage reports the object's checksum.\",\"properties\":{\"operation\":{\"const\":\"head\",\"type\":\"string\"}},\"required\":[\"operation\"],\"title\":\"PresignHead\",\"type\":\"object\"},{\"additionalProperties\":false,\"description\":\"DeleteObject.\",\"properties\":{\"operation\":{\"const\":\"delete\",\"type\":\"string\"}},\"required\":[\"operation\"],\"title\":\"PresignDelete\",\"type\":\"object\"},{\"additionalProperties\":false,\"description\":\"CreateMultipartUpload, with `x-amz-checksum-algorithm: SHA256` signed so every part of the upload must carry a SHA-256 checksum.\",\"properties\":{\"operation\":{\"const\":\"create-multipart\",\"type\":\"string\"}},\"required\":[\"operation\"],\"title\":\"PresignCreateMultipart\",\"type\":\"object\"},{\"additionalProperties\":false,\"description\":\"UploadPart of one part of `uploadId`, bound to its number, its exact length and its SHA-256.\",\"properties\":{\"checksumSha256\":{\"$ref\":\"#/$defs/ChecksumSha256\"},\"contentLength\":{\"description\":\"The part's exact length in bytes, signed into the request as `Content-Length`. At most 5 GiB, S3's part ceiling.\",\"maximum\":5368709120,\"minimum\":1,\"type\":\"integer\"},\"operation\":{\"const\":\"upload-part\",\"type\":\"string\"},\"partNumber\":{\"maximum\":10000,\"minimum\":1,\"type\":\"integer\"}},\"required\":[\"operation\",\"partNumber\",\"contentLength\",\"checksumSha256\"],\"title\":\"PresignUploadPart\",\"type\":\"object\"},{\"additionalProperties\":false,\"description\":\"ListParts of `uploadId`: each part's number, length, ETag and checksum, up to 1000 per page.\",\"properties\":{\"operation\":{\"const\":\"list-parts\",\"type\":\"string\"},\"partNumberMarker\":{\"description\":\"List parts after this number. Absent, from the first.\",\"maximum\":10000,\"minimum\":0,\"type\":\"integer\"}},\"required\":[\"operation\"],\"title\":\"PresignListParts\",\"type\":\"object\"},{\"additionalProperties\":false,\"description\":\"CompleteMultipartUpload of `uploadId`, bound to the assembled object's exact length.\",\"properties\":{\"contentLength\":{\"description\":\"The assembled object's exact length in bytes, signed into the request as `x-amz-mp-object-size`, so storage refuses a completion that would assemble any other size. At most 5 TiB, S3's object ceiling.\",\"maximum\":5497558138880,\"minimum\":0,\"type\":\"integer\"},\"operation\":{\"const\":\"complete-multipart\",\"type\":\"string\"}},\"required\":[\"operation\",\"contentLength\"],\"title\":\"PresignCompleteMultipart\",\"type\":\"object\"},{\"additionalProperties\":false,\"description\":\"AbortMultipartUpload of `uploadId`.\",\"properties\":{\"operation\":{\"const\":\"abort-multipart\",\"type\":\"string\"}},\"required\":[\"operation\"],\"title\":\"PresignAbortMultipart\",\"type\":\"object\"}],\"title\":\"PresignRequest\"},\"ProviderObjectAction\":{\"description\":\"`put`: write an object. `get`: read one. `delete`: remove one. No list, ACL, policy or bucket-level action exists here, so none can be granted.\",\"enum\":[\"put\",\"get\",\"delete\"],\"title\":\"ProviderObjectAction\",\"type\":\"string\"},\"ProviderObjectPrefix\":{\"description\":\"An object-key prefix within the account's bucket: one or more segments of lowercase letters, digits, `.`, `_` and `-`, each beginning with a letter or digit and ending with `/`. No quote, backslash, wildcard, whitespace, `..` segment or empty segment can appear. That is deliberate: the custodian places this value inside a provider policy — an IAM session policy (JSON), a GCS Credential Access Boundary condition (CEL) — and a value able to carry a metacharacter can break out of the string it is placed in and widen the policy. That is a known class of defect (CVE-2026-42811, a CEL injection in downscoped GCS credentials). Even with this pattern, a custodian MUST build provider policies with the provider language's own encoder, never by string interpolation.\",\"maxLength\":512,\"minLength\":2,\"pattern\":\"^([a-z0-9][a-z0-9._-]{0,127}/){1,16}$\",\"title\":\"ProviderObjectPrefix\",\"type\":\"string\"},\"Response\":{\"$anchor\":\"response\",\"additionalProperties\":false,\"oneOf\":[{\"not\":{\"required\":[\"presign\"]},\"required\":[\"scope\"]},{\"not\":{\"required\":[\"scope\"]},\"required\":[\"presign\"]}],\"properties\":{\"expiresAt\":{\"description\":\"The provider's expiry for the credential, in the clear; for `presign`, the earliest expiry in the batch.\",\"format\":\"date-time\",\"type\":\"string\"},\"ext\":{\"$ref\":\"#/$defs/Ext\"},\"presign\":{\"$ref\":\"#/$defs/PresignBatch\",\"description\":\"The batch actually presigned, which equals the requested one.\"},\"scope\":{\"$ref\":\"#/$defs/CredentialScope\",\"description\":\"The scope actually granted, which equals the requested one.\"},\"sealedCredential\":{\"description\":\"A `SealedTransferBundle` (external/_shared/0.1), sealed to the caller's key-agreement key, whose cleartext is an `ExternalCredentialPayload` for `scope` or a `PresignedRequestSet` for `presign`. Bounded at 256 KiB rather than the shared 64 KiB because a batch of 128 presigned requests does not fit 64 KiB.\",\"maxLength\":262144,\"minLength\":64,\"pattern\":\"^-----BEGIN VTA SEALED BUNDLE-----[\\\\s\\\\S]+-----END VTA SEALED BUNDLE-----\\\\s*$\",\"type\":\"string\"}},\"required\":[\"sealedCredential\",\"expiresAt\"],\"title\":\"External Credentials — Issue — response payload\",\"type\":\"object\"}},\"$id\":\"https://trusttasks.org/spec/external/credentials/issue/0.2\",\"$schema\":\"https://json-schema.org/draft/2020-12/schema\",\"additionalProperties\":false,\"description\":\"Obtain a short-lived, downscoped provider credential from an external account, sealed to the caller: session or token credentials under `scope`, or a batch of presigned requests on one object under `presign`. The outer document members are owned by the framework — SPEC §6.3.\",\"oneOf\":[{\"not\":{\"required\":[\"presign\"]},\"required\":[\"scope\"]},{\"not\":{\"required\":[\"scope\"]},\"required\":[\"presign\"]}],\"properties\":{\"account\":{\"$ref\":\"#/$defs/AccountId\"},\"context\":{\"$ref\":\"#/$defs/AccountContextId\"},\"ext\":{\"$ref\":\"#/$defs/Ext\"},\"presign\":{\"$ref\":\"#/$defs/PresignBatch\"},\"scope\":{\"$ref\":\"#/$defs/CredentialScope\",\"description\":\"For every brokered model but `s3-static-presign`: the prefix and actions, or the OAuth scopes, the session or token is downscoped to. `objectKey` is not used in this version.\"},\"ttlSeconds\":{\"description\":\"Requested lifetime; never more than the binding's `maxTtlSeconds`. For `presign`, the lifetime of every URL in the batch.\",\"maximum\":3600,\"minimum\":60,\"type\":\"integer\"}},\"required\":[\"context\",\"account\",\"ttlSeconds\"],\"title\":\"External Credentials — Issue — payload\",\"type\":\"object\"}\n",
    );
}
impl crate::Payload for Response {
    const TYPE_URI: &'static str =
        "https://trusttasks.org/spec/external/credentials/issue/0.2#response";
    const IS_PROOF_REQUIRED: bool = true;
    const IS_ISSUED_AT_REQUIRED: bool = true;
    const MAX_DOCUMENT_BYTES: Option<usize> = Some(294912usize);
    const IS_RECIPIENT_REQUIRED: bool = true;
    const PAYLOAD_SCHEMA: Option<&'static str> = Some(
        "{\"$defs\":{\"AccountContextId\":{\"description\":\"The custodian context that owns the account. Act scope in this context decides who may manage the account and who may consume it; the account's keys are derived in this context's key space.\",\"maxLength\":256,\"minLength\":1,\"title\":\"AccountContextId\",\"type\":\"string\"},\"AccountId\":{\"description\":\"The account's identifier within its context, chosen by whoever creates it. Lowercase letters, digits and hyphens, so that it can be embedded in a certificate subject, a token subject or a provider-side condition without escaping. Unique per context; never reused after deletion while anything that names it (a provider-side trust policy, an audit row) may still exist.\",\"maxLength\":64,\"minLength\":1,\"pattern\":\"^[a-z0-9][a-z0-9-]*$\",\"title\":\"AccountId\",\"type\":\"string\"},\"ChecksumSha256\":{\"description\":\"A SHA-256 digest in standard base64 (RFC 4648 §4, padded), as S3 carries it in `x-amz-checksum-sha256`.\",\"maxLength\":44,\"minLength\":44,\"pattern\":\"^[A-Za-z0-9+/]{43}=$\",\"title\":\"ChecksumSha256\",\"type\":\"string\"},\"CredentialScope\":{\"additionalProperties\":false,\"description\":\"What one issuance may do. For storage models, `prefix` and `actions` (both required, a rule this schema leaves to the custodian because other models use neither); for `s3-static-presign`, also `objectKey`, since a presigned URL is one operation on one object; for `oauth2-private-key-jwt`, `scopes`.\",\"properties\":{\"actions\":{\"items\":{\"$ref\":\"#/$defs/ProviderObjectAction\"},\"maxItems\":3,\"minItems\":1,\"type\":\"array\",\"uniqueItems\":true},\"objectKey\":{\"description\":\"`s3-static-presign` only: the object's name within `prefix`. The presigned URL names `prefix` + `objectKey` and nothing else, and `actions` must hold exactly one action.\",\"maxLength\":1024,\"minLength\":1,\"pattern\":\"^[A-Za-z0-9._-]+$\",\"type\":\"string\"},\"prefix\":{\"$ref\":\"#/$defs/ProviderObjectPrefix\"},\"scopes\":{\"description\":\"`oauth2-private-key-jwt` only: the OAuth scopes requested.\",\"items\":{\"maxLength\":256,\"pattern\":\"^[!#-\\\\[\\\\]-~]+$\",\"type\":\"string\"},\"maxItems\":64,\"type\":\"array\",\"uniqueItems\":true}},\"title\":\"CredentialScope\",\"type\":\"object\"},\"Ext\":{\"additionalProperties\":true,\"description\":\"Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.\",\"minProperties\":1,\"propertyNames\":{\"pattern\":\"^[a-z][a-z0-9-]*(\\\\.[a-z0-9-]+)+$\"},\"title\":\"Ext\",\"type\":\"object\"},\"PresignBatch\":{\"additionalProperties\":false,\"description\":\"`s3-static-presign` only: up to 128 operations on **one** object, `prefix` + `objectKey`, and at most one multipart upload of it. Each operation becomes one presigned request, sealed together. Consistency rules JSON Schema cannot state, which the custodian enforces: `uploadId` is present exactly when an operation needs it (`upload-part`, `list-parts`, `complete-multipart`, `abort-multipart`) and absent when the batch holds `create-multipart`; no two operations are identical; no two `upload-part` operations name the same `partNumber`.\",\"properties\":{\"objectKey\":{\"description\":\"The object's name within `prefix`. Every request in the batch names `prefix` + `objectKey` and no other object.\",\"maxLength\":1024,\"minLength\":1,\"pattern\":\"^[A-Za-z0-9._-]+$\",\"type\":\"string\"},\"prefix\":{\"$ref\":\"#/$defs/ProviderObjectPrefix\"},\"requests\":{\"items\":{\"$ref\":\"#/$defs/PresignRequest\"},\"maxItems\":128,\"minItems\":1,\"type\":\"array\"},\"uploadId\":{\"description\":\"The multipart upload the batch's multipart operations act on, as storage returned it from CreateMultipartUpload. Signed into each such request's query, percent-encoded by the SigV4 encoder, never interpolated.\",\"maxLength\":1024,\"minLength\":1,\"pattern\":\"^[A-Za-z0-9._~+/=-]+$\",\"type\":\"string\"}},\"required\":[\"prefix\",\"objectKey\",\"requests\"],\"title\":\"PresignBatch\",\"type\":\"object\"},\"PresignRequest\":{\"description\":\"One operation to presign, discriminated by `operation`. The ceiling action each needs is in `PresignOperation`.\",\"oneOf\":[{\"additionalProperties\":false,\"description\":\"PutObject of the whole object, bound to its exact length and SHA-256.\",\"properties\":{\"checksumSha256\":{\"$ref\":\"#/$defs/ChecksumSha256\"},\"contentLength\":{\"description\":\"The object's exact length in bytes, signed into the request as `Content-Length`. At most 5 GiB, S3's single-request ceiling.\",\"maximum\":5368709120,\"minimum\":0,\"type\":\"integer\"},\"operation\":{\"const\":\"put\",\"type\":\"string\"}},\"required\":[\"operation\",\"contentLength\",\"checksumSha256\"],\"title\":\"PresignPut\",\"type\":\"object\"},{\"additionalProperties\":false,\"description\":\"GetObject.\",\"properties\":{\"operation\":{\"const\":\"get\",\"type\":\"string\"}},\"required\":[\"operation\"],\"title\":\"PresignGet\",\"type\":\"object\"},{\"additionalProperties\":false,\"description\":\"HeadObject, with `x-amz-checksum-mode: ENABLED` signed so storage reports the object's checksum.\",\"properties\":{\"operation\":{\"const\":\"head\",\"type\":\"string\"}},\"required\":[\"operation\"],\"title\":\"PresignHead\",\"type\":\"object\"},{\"additionalProperties\":false,\"description\":\"DeleteObject.\",\"properties\":{\"operation\":{\"const\":\"delete\",\"type\":\"string\"}},\"required\":[\"operation\"],\"title\":\"PresignDelete\",\"type\":\"object\"},{\"additionalProperties\":false,\"description\":\"CreateMultipartUpload, with `x-amz-checksum-algorithm: SHA256` signed so every part of the upload must carry a SHA-256 checksum.\",\"properties\":{\"operation\":{\"const\":\"create-multipart\",\"type\":\"string\"}},\"required\":[\"operation\"],\"title\":\"PresignCreateMultipart\",\"type\":\"object\"},{\"additionalProperties\":false,\"description\":\"UploadPart of one part of `uploadId`, bound to its number, its exact length and its SHA-256.\",\"properties\":{\"checksumSha256\":{\"$ref\":\"#/$defs/ChecksumSha256\"},\"contentLength\":{\"description\":\"The part's exact length in bytes, signed into the request as `Content-Length`. At most 5 GiB, S3's part ceiling.\",\"maximum\":5368709120,\"minimum\":1,\"type\":\"integer\"},\"operation\":{\"const\":\"upload-part\",\"type\":\"string\"},\"partNumber\":{\"maximum\":10000,\"minimum\":1,\"type\":\"integer\"}},\"required\":[\"operation\",\"partNumber\",\"contentLength\",\"checksumSha256\"],\"title\":\"PresignUploadPart\",\"type\":\"object\"},{\"additionalProperties\":false,\"description\":\"ListParts of `uploadId`: each part's number, length, ETag and checksum, up to 1000 per page.\",\"properties\":{\"operation\":{\"const\":\"list-parts\",\"type\":\"string\"},\"partNumberMarker\":{\"description\":\"List parts after this number. Absent, from the first.\",\"maximum\":10000,\"minimum\":0,\"type\":\"integer\"}},\"required\":[\"operation\"],\"title\":\"PresignListParts\",\"type\":\"object\"},{\"additionalProperties\":false,\"description\":\"CompleteMultipartUpload of `uploadId`, bound to the assembled object's exact length.\",\"properties\":{\"contentLength\":{\"description\":\"The assembled object's exact length in bytes, signed into the request as `x-amz-mp-object-size`, so storage refuses a completion that would assemble any other size. At most 5 TiB, S3's object ceiling.\",\"maximum\":5497558138880,\"minimum\":0,\"type\":\"integer\"},\"operation\":{\"const\":\"complete-multipart\",\"type\":\"string\"}},\"required\":[\"operation\",\"contentLength\"],\"title\":\"PresignCompleteMultipart\",\"type\":\"object\"},{\"additionalProperties\":false,\"description\":\"AbortMultipartUpload of `uploadId`.\",\"properties\":{\"operation\":{\"const\":\"abort-multipart\",\"type\":\"string\"}},\"required\":[\"operation\"],\"title\":\"PresignAbortMultipart\",\"type\":\"object\"}],\"title\":\"PresignRequest\"},\"ProviderObjectAction\":{\"description\":\"`put`: write an object. `get`: read one. `delete`: remove one. No list, ACL, policy or bucket-level action exists here, so none can be granted.\",\"enum\":[\"put\",\"get\",\"delete\"],\"title\":\"ProviderObjectAction\",\"type\":\"string\"},\"ProviderObjectPrefix\":{\"description\":\"An object-key prefix within the account's bucket: one or more segments of lowercase letters, digits, `.`, `_` and `-`, each beginning with a letter or digit and ending with `/`. No quote, backslash, wildcard, whitespace, `..` segment or empty segment can appear. That is deliberate: the custodian places this value inside a provider policy — an IAM session policy (JSON), a GCS Credential Access Boundary condition (CEL) — and a value able to carry a metacharacter can break out of the string it is placed in and widen the policy. That is a known class of defect (CVE-2026-42811, a CEL injection in downscoped GCS credentials). Even with this pattern, a custodian MUST build provider policies with the provider language's own encoder, never by string interpolation.\",\"maxLength\":512,\"minLength\":2,\"pattern\":\"^([a-z0-9][a-z0-9._-]{0,127}/){1,16}$\",\"title\":\"ProviderObjectPrefix\",\"type\":\"string\"},\"Response\":{\"$anchor\":\"response\",\"additionalProperties\":false,\"oneOf\":[{\"not\":{\"required\":[\"presign\"]},\"required\":[\"scope\"]},{\"not\":{\"required\":[\"scope\"]},\"required\":[\"presign\"]}],\"properties\":{\"expiresAt\":{\"description\":\"The provider's expiry for the credential, in the clear; for `presign`, the earliest expiry in the batch.\",\"format\":\"date-time\",\"type\":\"string\"},\"ext\":{\"$ref\":\"#/$defs/Ext\"},\"presign\":{\"$ref\":\"#/$defs/PresignBatch\",\"description\":\"The batch actually presigned, which equals the requested one.\"},\"scope\":{\"$ref\":\"#/$defs/CredentialScope\",\"description\":\"The scope actually granted, which equals the requested one.\"},\"sealedCredential\":{\"description\":\"A `SealedTransferBundle` (external/_shared/0.1), sealed to the caller's key-agreement key, whose cleartext is an `ExternalCredentialPayload` for `scope` or a `PresignedRequestSet` for `presign`. Bounded at 256 KiB rather than the shared 64 KiB because a batch of 128 presigned requests does not fit 64 KiB.\",\"maxLength\":262144,\"minLength\":64,\"pattern\":\"^-----BEGIN VTA SEALED BUNDLE-----[\\\\s\\\\S]+-----END VTA SEALED BUNDLE-----\\\\s*$\",\"type\":\"string\"}},\"required\":[\"sealedCredential\",\"expiresAt\"],\"title\":\"External Credentials — Issue — response payload\",\"type\":\"object\"}},\"$ref\":\"#/$defs/Response\",\"$schema\":\"https://json-schema.org/draft/2020-12/schema\"}\n",
    );
}
impl crate::RequestPayload for Payload {
    type Response = Response;
}
/// The earlier `MAJOR.MINOR` of this slug that this version declares it
/// extends (front matter `extends`, SPEC §5.2 "Declared extension"), or
/// `None`. Only the direct declaration; walk a chain with
/// [`crate::extension::extends_for`].
pub const EXTENDS: Option<&str> = None;
/// The extended error codes this specification declares (SPEC §7.3 item 9,
/// §8.5), in declaration order. Empty when it declares none.
pub const ERROR_CODES: &[crate::DeclaredErrorCode] = &[
    error_codes::NOT_FOUND,
    error_codes::NOT_ACTIVE,
    error_codes::NOT_BOUND,
    error_codes::REQUEST_SHAPE_MISMATCH,
    error_codes::INVALID_BATCH,
    error_codes::SCOPE_OUTSIDE_CEILING,
    error_codes::TTL_TOO_LONG,
    error_codes::RATE_LIMITED,
    error_codes::PROVIDER_SETUP_REQUIRED,
    error_codes::PROVIDER_REFUSED,
    error_codes::PROVIDER_UNAVAILABLE,
    error_codes::NOT_BROKERED,
    error_codes::NO_KEY_AGREEMENT,
];
/// One constant per extended error code this specification declares
/// (SPEC §7.3 item 9), named for its local part.
///
/// Emit these rather than a string literal: the code is read from the
/// specification, so it cannot name a code the specification never
/// declared.
pub mod error_codes {
    /// `external:notFound`
    ///
    /// No account with this id exists in the named context that the caller may see. See the family conventions §2.
    ///
    /// Declared `retryable: false`.
    pub const NOT_FOUND: crate::DeclaredErrorCode = crate::DeclaredErrorCode {
        code: "external:notFound",
        retryable: false,
        details_schema: ::core::option::Option::None,
    };
    /// `external:notActive`
    ///
    /// The account is `suspended` or `archived` and cannot be used.
    ///
    /// Declared `retryable: false`.
    pub const NOT_ACTIVE: crate::DeclaredErrorCode = crate::DeclaredErrorCode {
        code: "external:notActive",
        retryable: false,
        details_schema: ::core::option::Option::None,
    };
    /// `external:notBound`
    ///
    /// The caller is not the consumer of any binding on this account.
    ///
    /// Declared `retryable: false`.
    pub const NOT_BOUND: crate::DeclaredErrorCode = crate::DeclaredErrorCode {
        code: "external:notBound",
        retryable: false,
        details_schema: ::core::option::Option::None,
    };
    /// `external/credentials/issue:requestShapeMismatch`
    ///
    /// The request uses the shape the account's model does not take: `presign` for a model that issues sessions or tokens, which can bind neither an operation, a length nor a checksum into what it issues; or `scope` for `s3-static-presign`, which in this version issues only presigned requests. `details.expected` names the shape the model takes.
    ///
    /// Declared `retryable: false`.
    /// Declares a `detailsSchema` for the error's `details` member.
    pub const REQUEST_SHAPE_MISMATCH: crate::DeclaredErrorCode = crate::DeclaredErrorCode {
        code: "external/credentials/issue:requestShapeMismatch",
        retryable: false,
        details_schema: ::core::option::Option::Some(
            "{\"additionalProperties\":false,\"properties\":{\"expected\":{\"enum\":[\"scope\",\"presign\"],\"type\":\"string\"}},\"required\":[\"expected\"],\"type\":\"object\"}",
        ),
    };
    /// `external/credentials/issue:invalidBatch`
    ///
    /// The presign batch breaks a rule its schema cannot state: an `uploadId` missing for an operation that needs one, present beside `create-multipart`, two identical operations, or two `upload-part` operations naming the same part.
    ///
    /// Declared `retryable: false`.
    pub const INVALID_BATCH: crate::DeclaredErrorCode = crate::DeclaredErrorCode {
        code: "external/credentials/issue:invalidBatch",
        retryable: false,
        details_schema: ::core::option::Option::None,
    };
    /// `external/credentials/issue:scopeOutsideCeiling`
    ///
    /// The requested scope is not inside the binding's ceiling: a prefix no ceiling prefix begins, an action the ceiling lacks, or — for `presign` — an operation whose required ceiling action the ceiling lacks.
    ///
    /// Declared `retryable: false`.
    pub const SCOPE_OUTSIDE_CEILING: crate::DeclaredErrorCode = crate::DeclaredErrorCode {
        code: "external/credentials/issue:scopeOutsideCeiling",
        retryable: false,
        details_schema: ::core::option::Option::None,
    };
    /// `external/credentials/issue:ttlTooLong`
    ///
    /// `ttlSeconds` exceeds the binding's `maxTtlSeconds`. `details.maxTtlSeconds` states it.
    ///
    /// Declared `retryable: false`.
    /// Declares a `detailsSchema` for the error's `details` member.
    pub const TTL_TOO_LONG: crate::DeclaredErrorCode = crate::DeclaredErrorCode {
        code: "external/credentials/issue:ttlTooLong",
        retryable: false,
        details_schema: ::core::option::Option::Some(
            "{\"additionalProperties\":false,\"properties\":{\"maxTtlSeconds\":{\"minimum\":60,\"type\":\"integer\"}},\"required\":[\"maxTtlSeconds\"],\"type\":\"object\"}",
        ),
    };
    /// `external:rateLimited`
    ///
    /// The binding's rate is exhausted. `details.retryAfterSeconds` says when to try again.
    ///
    /// Declared `retryable: true`.
    /// Declares a `detailsSchema` for the error's `details` member.
    pub const RATE_LIMITED: crate::DeclaredErrorCode = crate::DeclaredErrorCode {
        code: "external:rateLimited",
        retryable: true,
        details_schema: ::core::option::Option::Some(
            "{\"additionalProperties\":false,\"properties\":{\"retryAfterSeconds\":{\"minimum\":1,\"type\":\"integer\"}},\"required\":[\"retryAfterSeconds\"],\"type\":\"object\"}",
        ),
    };
    /// `external:providerSetupRequired`
    ///
    /// The account cannot be used until its provider-side setup is redone: after a restore that could not carry its key or secret, or while a rotation awaits confirmation.
    ///
    /// Declared `retryable: false`.
    pub const PROVIDER_SETUP_REQUIRED: crate::DeclaredErrorCode = crate::DeclaredErrorCode {
        code: "external:providerSetupRequired",
        retryable: false,
        details_schema: ::core::option::Option::None,
    };
    /// `external:providerRefused`
    ///
    /// The provider refused the custodian's request. `details.providerError` carries the provider's words, verbatim, truncated, with any credential removed.
    ///
    /// Declared `retryable: false`.
    /// Declares a `detailsSchema` for the error's `details` member.
    pub const PROVIDER_REFUSED: crate::DeclaredErrorCode = crate::DeclaredErrorCode {
        code: "external:providerRefused",
        retryable: false,
        details_schema: ::core::option::Option::Some(
            "{\"additionalProperties\":false,\"properties\":{\"providerError\":{\"maxLength\":2048,\"type\":\"string\"},\"providerRequestId\":{\"maxLength\":256,\"type\":\"string\"}},\"required\":[\"providerError\"],\"type\":\"object\"}",
        ),
    };
    /// `external:providerUnavailable`
    ///
    /// The provider could not be reached or did not answer in time.
    ///
    /// Declared `retryable: true`.
    pub const PROVIDER_UNAVAILABLE: crate::DeclaredErrorCode = crate::DeclaredErrorCode {
        code: "external:providerUnavailable",
        retryable: true,
        details_schema: ::core::option::Option::None,
    };
    /// `external/credentials/issue:notBrokered`
    ///
    /// The account is `sui-signer`, which issues no credentials; use external/sign.
    ///
    /// Declared `retryable: false`.
    pub const NOT_BROKERED: crate::DeclaredErrorCode = crate::DeclaredErrorCode {
        code: "external/credentials/issue:notBrokered",
        retryable: false,
        details_schema: ::core::option::Option::None,
    };
    /// `external/credentials/issue:noKeyAgreement`
    ///
    /// The caller's DID offers no X25519 key-agreement key to seal the credential to: it is not a `did:key`, and its resolved DID document has no X25519 `keyAgreement` verification method.
    ///
    /// Declared `retryable: false`.
    pub const NO_KEY_AGREEMENT: crate::DeclaredErrorCode = crate::DeclaredErrorCode {
        code: "external/credentials/issue:noKeyAgreement",
        retryable: false,
        details_schema: ::core::option::Option::None,
    };
}