//! Generated by `trust-tasks-codegen` — do not edit by hand.
//!
//! Spec slug: `external/accounts/restore`. Version: `0.2`.
/// Why this specification version is deprecated (SPEC "Superseded and
/// Withdrawn Versions"), or `None` while it is current.
pub const DEPRECATION: Option<&str> = None;
#[allow(unused_imports)]
use serde::{Deserialize, Serialize};
/// Error types.
pub mod error {
/// Error from a `TryFrom` or `FromStr` implementation.
pub struct ConversionError(::std::borrow::Cow<'static, str>);
impl ::std::error::Error for ConversionError {}
impl ::std::fmt::Display for ConversionError {
fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> Result<(), ::std::fmt::Error> {
::std::fmt::Display::fmt(&self.0, f)
}
}
impl ::std::fmt::Debug for ConversionError {
fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> Result<(), ::std::fmt::Error> {
::std::fmt::Debug::fmt(&self.0, f)
}
}
impl From<&'static str> for ConversionError {
fn from(value: &'static str) -> Self {
Self(value.into())
}
}
impl From<String> for ConversionError {
fn from(value: String) -> Self {
Self(value.into())
}
}
}
///Who may use an account, and how far. One binding per consumer per account. A binding is checked before anything is signed: the caller must be `consumer`, proven by the request's own proof; the request must sit inside `scopeCeiling`; its TTL must not exceed `maxTtlSeconds`; and the binding's rate must not be exhausted.
///
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct AccountBinding {
///The DID of the integration allowed to use the account.
pub consumer: AccountBindingConsumer,
#[serde(
rename = "grantedAt",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
pub granted_at: ::std::option::Option<::chrono::DateTime<::chrono::offset::Utc>>,
///The longest credential lifetime the consumer may request. 900 (15 minutes) is RECOMMENDED; the ceiling is one hour.
#[serde(rename = "maxTtlSeconds")]
pub max_ttl_seconds: i64,
///Issuances or signatures per minute for this binding.
#[serde(rename = "ratePerMinute")]
pub rate_per_minute: ::std::num::NonZeroU64,
///Required for storage and OAuth models; absent for `sui-signer`, whose ceiling is the account's own allow-list and caps.
#[serde(
rename = "scopeCeiling",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
pub scope_ceiling: ::std::option::Option<CredentialScopeCeiling>,
///Where the provider supports it (`aws:SourceIp`), issued credentials are pinned to these networks, so a credential lifted from the consumer is useless elsewhere.
#[serde(
rename = "sourceCidrs",
default,
skip_serializing_if = "::std::vec::Vec::is_empty"
)]
pub source_cidrs: ::std::vec::Vec<AccountBindingSourceCidrsItem>,
}
impl AccountBinding {
pub fn builder() -> builder::AccountBinding {
Default::default()
}
}
///The DID of the integration allowed to use the account.
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountBindingConsumer(::std::string::String);
impl ::std::ops::Deref for AccountBindingConsumer {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountBindingConsumer> for ::std::string::String {
fn from(value: AccountBindingConsumer) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountBindingConsumer {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 2048usize {
return Err("longer than 2048 characters".into());
}
if value.chars().count() < 7usize {
return Err("shorter than 7 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^did:[a-z0-9]+:\\S+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^did:[a-z0-9]+:\\S+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountBindingConsumer {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountBindingConsumer {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountBindingConsumer {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountBindingConsumer {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AccountBindingSourceCidrsItem`
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountBindingSourceCidrsItem(::std::string::String);
impl ::std::ops::Deref for AccountBindingSourceCidrsItem {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountBindingSourceCidrsItem> for ::std::string::String {
fn from(value: AccountBindingSourceCidrsItem) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountBindingSourceCidrsItem {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 49usize {
return Err("longer than 49 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| {
::regress::Regex::new("^[0-9a-fA-F:.]+/[0-9]{1,3}$").unwrap()
});
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[0-9a-fA-F:.]+/[0-9]{1,3}$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountBindingSourceCidrsItem {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountBindingSourceCidrsItem {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountBindingSourceCidrsItem {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountBindingSourceCidrsItem {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///The custodian context that owns the account. Act scope in this context decides who may manage the account and who may consume it; the account's keys are derived in this context's key space.
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountContextId(::std::string::String);
impl ::std::ops::Deref for AccountContextId {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountContextId> for ::std::string::String {
fn from(value: AccountContextId) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountContextId {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 256usize {
return Err("longer than 256 characters".into());
}
if value.chars().count() < 1usize {
return Err("shorter than 1 characters".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountContextId {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountContextId {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountContextId {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountContextId {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///The account's identifier within its context, chosen by whoever creates it. Lowercase letters, digits and hyphens, so that it can be embedded in a certificate subject, a token subject or a provider-side condition without escaping. Unique per context; never reused after deletion while anything that names it (a provider-side trust policy, an audit row) may still exist.
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountId(::std::string::String);
impl ::std::ops::Deref for AccountId {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountId> for ::std::string::String {
fn from(value: AccountId) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountId {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 64usize {
return Err("longer than 64 characters".into());
}
if value.chars().count() < 1usize {
return Err("shorter than 1 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[a-z0-9][a-z0-9-]*$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[a-z0-9][a-z0-9-]*$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountId {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountId {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountId {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountId {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AccountProbeReport`
///
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct AccountProbeReport {
///True only when the canary steps (`put`, `get`, `delete`, or the model's equivalent) ran, so the account was exercised end to end. A probe that stopped after `exchange` because nothing named a canary prefix is `complete: false` even when `ok` is true, and does not clear `providerSetupRequired`.
pub complete: bool,
///True when every step that ran succeeded.
pub ok: bool,
#[serde(rename = "probedAt")]
pub probed_at: ::chrono::DateTime<::chrono::offset::Utc>,
///In order; the first failing step ends the probe.
pub steps: ::std::vec::Vec<AccountProbeReportStepsItem>,
}
impl AccountProbeReport {
pub fn builder() -> builder::AccountProbeReport {
Default::default()
}
}
///`AccountProbeReportStepsItem`
///
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct AccountProbeReportStepsItem {
#[serde(
rename = "durationMs",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
pub duration_ms: ::std::option::Option<u64>,
pub ok: bool,
///The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.
#[serde(
rename = "providerError",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
pub provider_error: ::std::option::Option<AccountProbeReportStepsItemProviderError>,
#[serde(
rename = "providerRequestId",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
pub provider_request_id: ::std::option::Option<AccountProbeReportStepsItemProviderRequestId>,
pub step: AccountProbeStep,
}
impl AccountProbeReportStepsItem {
pub fn builder() -> builder::AccountProbeReportStepsItem {
Default::default()
}
}
///The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountProbeReportStepsItemProviderError(::std::string::String);
impl ::std::ops::Deref for AccountProbeReportStepsItemProviderError {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountProbeReportStepsItemProviderError> for ::std::string::String {
fn from(value: AccountProbeReportStepsItemProviderError) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountProbeReportStepsItemProviderError {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 2048usize {
return Err("longer than 2048 characters".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountProbeReportStepsItemProviderError {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountProbeReportStepsItemProviderError {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountProbeReportStepsItemProviderError {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountProbeReportStepsItemProviderError {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AccountProbeReportStepsItemProviderRequestId`
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountProbeReportStepsItemProviderRequestId(::std::string::String);
impl ::std::ops::Deref for AccountProbeReportStepsItemProviderRequestId {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountProbeReportStepsItemProviderRequestId> for ::std::string::String {
fn from(value: AccountProbeReportStepsItemProviderRequestId) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountProbeReportStepsItemProviderRequestId {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 256usize {
return Err("longer than 256 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[!-~]+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[!-~]+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountProbeReportStepsItemProviderRequestId {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String>
for AccountProbeReportStepsItemProviderRequestId
{
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String>
for AccountProbeReportStepsItemProviderRequestId
{
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountProbeReportStepsItemProviderRequestId {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`sign`: the custodian signed its assertion, session request or test transaction. `exchange`: the provider issued a credential for it. `put`, `get`, `delete`: one canary object at the narrowest scope of the account's bindings. `decode`: for `sui-signer`, a built test transaction passed the allow-list (it is never submitted).
///
#[derive(
::serde::Deserialize,
::serde::Serialize,
Clone,
Copy,
Debug,
Eq,
Hash,
Ord,
PartialEq,
PartialOrd,
)]
#[non_exhaustive]
pub enum AccountProbeStep {
#[serde(rename = "sign")]
Sign,
#[serde(rename = "exchange")]
Exchange,
#[serde(rename = "put")]
Put,
#[serde(rename = "get")]
Get,
#[serde(rename = "delete")]
Delete,
#[serde(rename = "decode")]
Decode,
}
impl ::std::fmt::Display for AccountProbeStep {
fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> ::std::fmt::Result {
match *self {
Self::Sign => f.write_str("sign"),
Self::Exchange => f.write_str("exchange"),
Self::Put => f.write_str("put"),
Self::Get => f.write_str("get"),
Self::Delete => f.write_str("delete"),
Self::Decode => f.write_str("decode"),
}
}
}
impl ::std::str::FromStr for AccountProbeStep {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
match value {
"sign" => Ok(Self::Sign),
"exchange" => Ok(Self::Exchange),
"put" => Ok(Self::Put),
"get" => Ok(Self::Get),
"delete" => Ok(Self::Delete),
"decode" => Ok(Self::Decode),
_ => Err("invalid value".into()),
}
}
}
impl ::std::convert::TryFrom<&str> for AccountProbeStep {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountProbeStep {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountProbeStep {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
///The public half of the account's key, as the provider needs it. Never a private key.
///
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct AccountPublicMaterial {
///`sui-signer`: the Sui address the key controls.
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub address: ::std::option::Option<AccountPublicMaterialAddress>,
pub algorithm: AccountPublicMaterialAlgorithm,
///`aws-roles-anywhere`: the trust anchor's CA certificate. `azure-cert`: the certificate uploaded to the app registration.
#[serde(
rename = "certificatePem",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
pub certificate_pem: ::std::option::Option<AccountPublicMaterialCertificatePem>,
///Digest of the public key's SubjectPublicKeyInfo DER.
#[serde(rename = "keyFingerprint")]
pub key_fingerprint: DigestMultibase,
///During a rotation (external/accounts/keys/rotate), the staged successor key, until it is confirmed and the current key retires.
#[serde(
rename = "pendingKeyFingerprint",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
pub pending_key_fingerprint: ::std::option::Option<DigestMultibase>,
#[serde(
rename = "publicKeyJwk",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
pub public_key_jwk: ::std::option::Option<AccountPublicMaterialPublicKeyJwk>,
}
impl AccountPublicMaterial {
pub fn builder() -> builder::AccountPublicMaterial {
Default::default()
}
}
///`sui-signer`: the Sui address the key controls.
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountPublicMaterialAddress(::std::string::String);
impl ::std::ops::Deref for AccountPublicMaterialAddress {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountPublicMaterialAddress> for ::std::string::String {
fn from(value: AccountPublicMaterialAddress) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountPublicMaterialAddress {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^0x[0-9a-f]{64}$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^0x[0-9a-f]{64}$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountPublicMaterialAddress {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountPublicMaterialAddress {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountPublicMaterialAddress {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountPublicMaterialAddress {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AccountPublicMaterialAlgorithm`
///
#[derive(
::serde::Deserialize,
::serde::Serialize,
Clone,
Copy,
Debug,
Eq,
Hash,
Ord,
PartialEq,
PartialOrd,
)]
#[non_exhaustive]
pub enum AccountPublicMaterialAlgorithm {
#[serde(rename = "ES256")]
Es256,
#[serde(rename = "RS256")]
Rs256,
Secp256r1,
}
impl ::std::fmt::Display for AccountPublicMaterialAlgorithm {
fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> ::std::fmt::Result {
match *self {
Self::Es256 => f.write_str("ES256"),
Self::Rs256 => f.write_str("RS256"),
Self::Secp256r1 => f.write_str("Secp256r1"),
}
}
}
impl ::std::str::FromStr for AccountPublicMaterialAlgorithm {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
match value {
"ES256" => Ok(Self::Es256),
"RS256" => Ok(Self::Rs256),
"Secp256r1" => Ok(Self::Secp256r1),
_ => Err("invalid value".into()),
}
}
}
impl ::std::convert::TryFrom<&str> for AccountPublicMaterialAlgorithm {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountPublicMaterialAlgorithm {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountPublicMaterialAlgorithm {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
///`aws-roles-anywhere`: the trust anchor's CA certificate. `azure-cert`: the certificate uploaded to the app registration.
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountPublicMaterialCertificatePem(::std::string::String);
impl ::std::ops::Deref for AccountPublicMaterialCertificatePem {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountPublicMaterialCertificatePem> for ::std::string::String {
fn from(value: AccountPublicMaterialCertificatePem) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountPublicMaterialCertificatePem {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 16384usize {
return Err("longer than 16384 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> = ::std::sync::LazyLock::new(
|| {
::regress::Regex::new(
"^-----BEGIN CERTIFICATE-----[A-Za-z0-9+/=\\r\\n]+-----END CERTIFICATE-----\\s*$",
)
.unwrap()
},
);
if PATTERN.find(value).is_none() {
return Err(
"doesn't match pattern \"^-----BEGIN CERTIFICATE-----[A-Za-z0-9+/=\\r\\n]+-----END CERTIFICATE-----\\s*$\""
.into(),
);
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountPublicMaterialCertificatePem {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountPublicMaterialCertificatePem {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountPublicMaterialCertificatePem {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountPublicMaterialCertificatePem {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///The public key as a JWK, with `kid`. Public members only: the schema admits no private member (`d`, `p`, `q`, `dp`, `dq`, `qi`), so a document carrying one fails validation.
///
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct AccountPublicMaterialPublicKeyJwk {
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub alg: ::std::option::Option<AccountPublicMaterialPublicKeyJwkAlg>,
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub crv: ::std::option::Option<AccountPublicMaterialPublicKeyJwkCrv>,
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub e: ::std::option::Option<AccountPublicMaterialPublicKeyJwkE>,
pub kid: AccountPublicMaterialPublicKeyJwkKid,
pub kty: AccountPublicMaterialPublicKeyJwkKty,
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub n: ::std::option::Option<AccountPublicMaterialPublicKeyJwkN>,
#[serde(
rename = "use",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
pub use_: ::std::option::Option<::std::string::String>,
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub x: ::std::option::Option<AccountPublicMaterialPublicKeyJwkX>,
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub y: ::std::option::Option<AccountPublicMaterialPublicKeyJwkY>,
}
impl AccountPublicMaterialPublicKeyJwk {
pub fn builder() -> builder::AccountPublicMaterialPublicKeyJwk {
Default::default()
}
}
///`AccountPublicMaterialPublicKeyJwkAlg`
///
#[derive(
::serde::Deserialize,
::serde::Serialize,
Clone,
Copy,
Debug,
Eq,
Hash,
Ord,
PartialEq,
PartialOrd,
)]
#[non_exhaustive]
pub enum AccountPublicMaterialPublicKeyJwkAlg {
#[serde(rename = "ES256")]
Es256,
#[serde(rename = "RS256")]
Rs256,
}
impl ::std::fmt::Display for AccountPublicMaterialPublicKeyJwkAlg {
fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> ::std::fmt::Result {
match *self {
Self::Es256 => f.write_str("ES256"),
Self::Rs256 => f.write_str("RS256"),
}
}
}
impl ::std::str::FromStr for AccountPublicMaterialPublicKeyJwkAlg {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
match value {
"ES256" => Ok(Self::Es256),
"RS256" => Ok(Self::Rs256),
_ => Err("invalid value".into()),
}
}
}
impl ::std::convert::TryFrom<&str> for AccountPublicMaterialPublicKeyJwkAlg {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountPublicMaterialPublicKeyJwkAlg {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountPublicMaterialPublicKeyJwkAlg {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
///`AccountPublicMaterialPublicKeyJwkCrv`
///
#[derive(
::serde::Deserialize,
::serde::Serialize,
Clone,
Copy,
Debug,
Eq,
Hash,
Ord,
PartialEq,
PartialOrd,
)]
#[non_exhaustive]
pub enum AccountPublicMaterialPublicKeyJwkCrv {
#[serde(rename = "P-256")]
P256,
}
impl ::std::fmt::Display for AccountPublicMaterialPublicKeyJwkCrv {
fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> ::std::fmt::Result {
match *self {
Self::P256 => f.write_str("P-256"),
}
}
}
impl ::std::str::FromStr for AccountPublicMaterialPublicKeyJwkCrv {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
match value {
"P-256" => Ok(Self::P256),
_ => Err("invalid value".into()),
}
}
}
impl ::std::convert::TryFrom<&str> for AccountPublicMaterialPublicKeyJwkCrv {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountPublicMaterialPublicKeyJwkCrv {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountPublicMaterialPublicKeyJwkCrv {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
///`AccountPublicMaterialPublicKeyJwkE`
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountPublicMaterialPublicKeyJwkE(::std::string::String);
impl ::std::ops::Deref for AccountPublicMaterialPublicKeyJwkE {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountPublicMaterialPublicKeyJwkE> for ::std::string::String {
fn from(value: AccountPublicMaterialPublicKeyJwkE) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountPublicMaterialPublicKeyJwkE {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 16usize {
return Err("longer than 16 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[A-Za-z0-9_-]+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[A-Za-z0-9_-]+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountPublicMaterialPublicKeyJwkE {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountPublicMaterialPublicKeyJwkE {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountPublicMaterialPublicKeyJwkE {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountPublicMaterialPublicKeyJwkE {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AccountPublicMaterialPublicKeyJwkKid`
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountPublicMaterialPublicKeyJwkKid(::std::string::String);
impl ::std::ops::Deref for AccountPublicMaterialPublicKeyJwkKid {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountPublicMaterialPublicKeyJwkKid> for ::std::string::String {
fn from(value: AccountPublicMaterialPublicKeyJwkKid) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountPublicMaterialPublicKeyJwkKid {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 128usize {
return Err("longer than 128 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[!-~]+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[!-~]+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountPublicMaterialPublicKeyJwkKid {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountPublicMaterialPublicKeyJwkKid {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountPublicMaterialPublicKeyJwkKid {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountPublicMaterialPublicKeyJwkKid {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AccountPublicMaterialPublicKeyJwkKty`
///
#[derive(
::serde::Deserialize,
::serde::Serialize,
Clone,
Copy,
Debug,
Eq,
Hash,
Ord,
PartialEq,
PartialOrd,
)]
#[non_exhaustive]
pub enum AccountPublicMaterialPublicKeyJwkKty {
#[serde(rename = "EC")]
Ec,
#[serde(rename = "RSA")]
Rsa,
}
impl ::std::fmt::Display for AccountPublicMaterialPublicKeyJwkKty {
fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> ::std::fmt::Result {
match *self {
Self::Ec => f.write_str("EC"),
Self::Rsa => f.write_str("RSA"),
}
}
}
impl ::std::str::FromStr for AccountPublicMaterialPublicKeyJwkKty {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
match value {
"EC" => Ok(Self::Ec),
"RSA" => Ok(Self::Rsa),
_ => Err("invalid value".into()),
}
}
}
impl ::std::convert::TryFrom<&str> for AccountPublicMaterialPublicKeyJwkKty {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountPublicMaterialPublicKeyJwkKty {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountPublicMaterialPublicKeyJwkKty {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
///`AccountPublicMaterialPublicKeyJwkN`
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountPublicMaterialPublicKeyJwkN(::std::string::String);
impl ::std::ops::Deref for AccountPublicMaterialPublicKeyJwkN {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountPublicMaterialPublicKeyJwkN> for ::std::string::String {
fn from(value: AccountPublicMaterialPublicKeyJwkN) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountPublicMaterialPublicKeyJwkN {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 1024usize {
return Err("longer than 1024 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[A-Za-z0-9_-]+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[A-Za-z0-9_-]+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountPublicMaterialPublicKeyJwkN {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountPublicMaterialPublicKeyJwkN {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountPublicMaterialPublicKeyJwkN {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountPublicMaterialPublicKeyJwkN {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AccountPublicMaterialPublicKeyJwkX`
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountPublicMaterialPublicKeyJwkX(::std::string::String);
impl ::std::ops::Deref for AccountPublicMaterialPublicKeyJwkX {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountPublicMaterialPublicKeyJwkX> for ::std::string::String {
fn from(value: AccountPublicMaterialPublicKeyJwkX) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountPublicMaterialPublicKeyJwkX {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 1024usize {
return Err("longer than 1024 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[A-Za-z0-9_-]+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[A-Za-z0-9_-]+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountPublicMaterialPublicKeyJwkX {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountPublicMaterialPublicKeyJwkX {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountPublicMaterialPublicKeyJwkX {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountPublicMaterialPublicKeyJwkX {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AccountPublicMaterialPublicKeyJwkY`
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountPublicMaterialPublicKeyJwkY(::std::string::String);
impl ::std::ops::Deref for AccountPublicMaterialPublicKeyJwkY {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountPublicMaterialPublicKeyJwkY> for ::std::string::String {
fn from(value: AccountPublicMaterialPublicKeyJwkY) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountPublicMaterialPublicKeyJwkY {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 1024usize {
return Err("longer than 1024 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[A-Za-z0-9_-]+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[A-Za-z0-9_-]+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountPublicMaterialPublicKeyJwkY {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountPublicMaterialPublicKeyJwkY {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountPublicMaterialPublicKeyJwkY {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountPublicMaterialPublicKeyJwkY {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///That a static model's secret is set, and which one. Never its value.
///
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct AccountSecretInfo {
pub fingerprint: SecretFingerprint,
#[serde(rename = "setAt")]
pub set_at: ::chrono::DateTime<::chrono::offset::Utc>,
}
impl AccountSecretInfo {
pub fn builder() -> builder::AccountSecretInfo {
Default::default()
}
}
///Per-model account settings, discriminated by `model`: every branch is an object whose `model` member is a `const`, which is what lets each generated binding emit a tagged union, so an unusable setting is answered as `external:invalidSettings` naming the member rather than as an unparseable payload. Never a secret: every value here is returned to anyone who may read the account. Branches are referred to by their `model` ("the `sui-signer` settings"). They carry no `title`, so that every binding renders each as a plain variant of this union.
///
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(tag = "model", deny_unknown_fields)]
#[non_exhaustive]
pub enum AccountSettings {
///Egress: `rolesanywhere.<region>.amazonaws.com`, plus `sts.<region>.amazonaws.com` when `chainedRoleArn` is set.
#[serde(rename = "aws-roles-anywhere")]
AwsRolesAnywhere {
///The S3 bucket issuances are scoped within. Required for an account whose bindings issue storage scopes.
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
bucket: ::std::option::Option<ProviderBucketName>,
///When set, every issuance chains an AssumeRole into this role carrying the downscoping session policy, for deployments whose Roles Anywhere profile cannot carry one per request. Caps a credential at one hour.
#[serde(
rename = "chainedRoleArn",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
chained_role_arn: ::std::option::Option<AwsArn>,
///Where external/accounts/probe writes its canary when no binding names a narrower prefix. Lets a new account be probed before anything is bound to it. Absent, a probe of an account with no bindings stops after `exchange` and reports `complete: false`.
#[serde(
rename = "probePrefix",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
probe_prefix: ::std::option::Option<ProviderObjectPrefix>,
#[serde(rename = "profileArn")]
profile_arn: AwsArn,
region: AwsRegion,
#[serde(rename = "roleArn")]
role_arn: AwsArn,
///The trust anchor holding the custodian's CA certificate. Recorded after the administrator creates it from external/accounts/setup.
#[serde(rename = "trustAnchorArn")]
trust_anchor_arn: AwsArn,
},
///Egress: `sts.googleapis.com`, plus `iamcredentials.googleapis.com` when `serviceAccount` is set.
#[serde(rename = "gcp-wif-pinned")]
GcpWifPinned {
///The GCS bucket issuances are scoped within, by a Credential Access Boundary.
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
bucket: ::std::option::Option<ProviderBucketName>,
#[serde(rename = "poolId")]
pool_id: AccountSettingsPoolId,
///Where external/accounts/probe writes its canary when no binding names a narrower prefix. Lets a new account be probed before anything is bound to it. Absent, a probe of an account with no bindings stops after `exchange` and reports `complete: false`.
#[serde(
rename = "probePrefix",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
probe_prefix: ::std::option::Option<ProviderObjectPrefix>,
#[serde(rename = "projectNumber")]
project_number: AccountSettingsProjectNumber,
#[serde(rename = "providerId")]
provider_id: AccountSettingsProviderId,
///When set, the federated token is exchanged for this service account's access token.
#[serde(
rename = "serviceAccount",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
service_account: ::std::option::Option<AccountSettingsServiceAccount>,
///The ID-token algorithm. ES256 unless the provider refuses it. Absent means ES256.
#[serde(
rename = "signingAlgorithm",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
signing_algorithm: ::std::option::Option<AccountSettingsSigningAlgorithm>,
},
///Egress: `login.microsoftonline.com`, or the sovereign-cloud authority named in `authorityHost`.
#[serde(rename = "azure-cert")]
AzureCert {
///Absent means `login.microsoftonline.com`.
#[serde(
rename = "authorityHost",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
authority_host: ::std::option::Option<AccountSettingsAuthorityHost>,
#[serde(rename = "clientId")]
client_id: AccountSettingsClientId,
#[serde(rename = "tenantId")]
tenant_id: AccountSettingsTenantId,
///The `scope` requested at the token endpoint, such as `https://storage.azure.com/.default`.
#[serde(rename = "tokenScope")]
token_scope: AccountSettingsTokenScope,
},
///Egress: the host of `tokenEndpoint`, and nothing else.
#[serde(rename = "oauth2-private-key-jwt")]
Oauth2PrivateKeyJwt {
///The assertion's `aud`. Absent means `tokenEndpoint`.
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
audience: ::std::option::Option<AccountSettingsAudience>,
#[serde(rename = "clientId")]
client_id: AccountSettingsClientId,
///The scopes a binding may request, the ceiling for every issuance.
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
scopes: ::std::option::Option<Vec<AccountSettingsScopesItem>>,
#[serde(
rename = "signingAlgorithm",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
signing_algorithm: ::std::option::Option<AccountSettingsSigningAlgorithm>,
#[serde(rename = "tokenEndpoint")]
token_endpoint: ProviderHttpsUrl,
},
///Issuance needs no egress: presigning is a computation inside the custodian, and the consumer uses the URL itself. The probe connects to the host of `endpoint`, which `egressHosts` therefore lists.
#[serde(rename = "s3-static-presign")]
S3StaticPresign {
///The access key's identifier. Not a secret: it appears in every presigned URL. The secret half is set with external/accounts/secret/set and never returned.
#[serde(rename = "accessKeyId")]
access_key_id: AccountSettingsAccessKeyId,
bucket: ProviderBucketName,
endpoint: ProviderHttpsUrl,
///Address the bucket in the path rather than the host name, as MinIO usually needs.
#[serde(
rename = "pathStyle",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
path_style: ::std::option::Option<bool>,
///Where external/accounts/probe writes its canary when no binding names a narrower prefix. Lets a new account be probed before anything is bound to it. Absent, a probe of an account with no bindings stops after `exchange` and reports `complete: false`.
#[serde(
rename = "probePrefix",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
probe_prefix: ::std::option::Option<ProviderObjectPrefix>,
///The SigV4 signing region; `auto` for Cloudflare R2.
region: AccountSettingsRegion,
},
///No egress: the custodian signs and the consumer submits the transaction. The allow-list, the gas caps and the coin caps are the account's whole authority; a transaction outside them is refused before anything is signed.
#[serde(rename = "sui-signer")]
SuiSigner {
///Every MoveCall command in a signed transaction must name one of these. For Walrus storage: the system package's `register_blob`, `certify_blob`, `extend_blob` and `delete_blob`, and the coin calls needed to pay for them.
#[serde(rename = "allowedCalls")]
allowed_calls: ::std::vec::Vec<SuiMoveCall>,
///Shared objects a transaction may take as input, such as the Walrus system and staking objects. Absent means any object the allowed calls accept.
#[serde(
rename = "allowedObjects",
default,
skip_serializing_if = "::std::vec::Vec::is_empty"
)]
allowed_objects: ::std::vec::Vec<AccountSettingsAllowedObjectsItem>,
///Per coin type, the most a single transaction may spend or transfer out of the account's address, in the coin's smallest unit. A coin type not listed may not leave the address at all.
#[serde(
rename = "maxCoinOutPerTx",
default,
skip_serializing_if = "::std::vec::Vec::is_empty"
)]
max_coin_out_per_tx: ::std::vec::Vec<AccountSettingsMaxCoinOutPerTxItem>,
///The largest gas budget one transaction may declare.
#[serde(rename = "maxGasBudgetMist")]
max_gas_budget_mist: ::std::num::NonZeroU64,
///The total gas budget signed per rolling 24 hours.
#[serde(rename = "maxGasPerDayMist")]
max_gas_per_day_mist: ::std::num::NonZeroU64,
network: AccountSettingsNetwork,
},
///Egress: the host of `baseUrl`. The secret is set with external/accounts/secret/set and used only inside the custodian by `driver`; a provider reachable only by handing the consumer the raw key is not supported.
#[serde(rename = "static-secret")]
StaticSecret {
#[serde(rename = "baseUrl")]
base_url: ProviderHttpsUrl,
///The custodian's driver that uses the secret: performs a login or token exchange and returns a short-lived result. A custodian refuses a driver it does not implement.
driver: AccountSettingsDriver,
},
}
///The access key's identifier. Not a secret: it appears in every presigned URL. The secret half is set with external/accounts/secret/set and never returned.
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountSettingsAccessKeyId(::std::string::String);
impl ::std::ops::Deref for AccountSettingsAccessKeyId {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountSettingsAccessKeyId> for ::std::string::String {
fn from(value: AccountSettingsAccessKeyId) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountSettingsAccessKeyId {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 128usize {
return Err("longer than 128 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[A-Za-z0-9]+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[A-Za-z0-9]+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsAccessKeyId {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSettingsAccessKeyId {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsAccessKeyId {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountSettingsAccessKeyId {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AccountSettingsAllowedObjectsItem`
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountSettingsAllowedObjectsItem(::std::string::String);
impl ::std::ops::Deref for AccountSettingsAllowedObjectsItem {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountSettingsAllowedObjectsItem> for ::std::string::String {
fn from(value: AccountSettingsAllowedObjectsItem) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountSettingsAllowedObjectsItem {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^0x[0-9a-f]{64}$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^0x[0-9a-f]{64}$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsAllowedObjectsItem {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSettingsAllowedObjectsItem {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsAllowedObjectsItem {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountSettingsAllowedObjectsItem {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///The assertion's `aud`. Absent means `tokenEndpoint`.
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountSettingsAudience(::std::string::String);
impl ::std::ops::Deref for AccountSettingsAudience {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountSettingsAudience> for ::std::string::String {
fn from(value: AccountSettingsAudience) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountSettingsAudience {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 2048usize {
return Err("longer than 2048 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[!-~]+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[!-~]+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsAudience {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSettingsAudience {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsAudience {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountSettingsAudience {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///Absent means `login.microsoftonline.com`.
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountSettingsAuthorityHost(::std::string::String);
impl ::std::ops::Deref for AccountSettingsAuthorityHost {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountSettingsAuthorityHost> for ::std::string::String {
fn from(value: AccountSettingsAuthorityHost) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountSettingsAuthorityHost {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 253usize {
return Err("longer than 253 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[a-z0-9.-]+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[a-z0-9.-]+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsAuthorityHost {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSettingsAuthorityHost {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsAuthorityHost {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountSettingsAuthorityHost {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AccountSettingsClientId`
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountSettingsClientId(::std::string::String);
impl ::std::ops::Deref for AccountSettingsClientId {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountSettingsClientId> for ::std::string::String {
fn from(value: AccountSettingsClientId) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountSettingsClientId {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| {
::regress::Regex::new(
"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$",
)
.unwrap()
});
if PATTERN.find(value).is_none() {
return Err(
"doesn't match pattern \"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$\""
.into(),
);
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsClientId {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSettingsClientId {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsClientId {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountSettingsClientId {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///The custodian's driver that uses the secret: performs a login or token exchange and returns a short-lived result. A custodian refuses a driver it does not implement.
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountSettingsDriver(::std::string::String);
impl ::std::ops::Deref for AccountSettingsDriver {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountSettingsDriver> for ::std::string::String {
fn from(value: AccountSettingsDriver) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountSettingsDriver {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 64usize {
return Err("longer than 64 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[a-z0-9][a-z0-9-]*$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[a-z0-9][a-z0-9-]*$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsDriver {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSettingsDriver {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsDriver {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountSettingsDriver {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AccountSettingsMaxCoinOutPerTxItem`
///
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct AccountSettingsMaxCoinOutPerTxItem {
pub amount: u64,
#[serde(rename = "coinType")]
pub coin_type: AccountSettingsMaxCoinOutPerTxItemCoinType,
}
impl AccountSettingsMaxCoinOutPerTxItem {
pub fn builder() -> builder::AccountSettingsMaxCoinOutPerTxItem {
Default::default()
}
}
///`AccountSettingsMaxCoinOutPerTxItemCoinType`
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountSettingsMaxCoinOutPerTxItemCoinType(::std::string::String);
impl ::std::ops::Deref for AccountSettingsMaxCoinOutPerTxItemCoinType {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountSettingsMaxCoinOutPerTxItemCoinType> for ::std::string::String {
fn from(value: AccountSettingsMaxCoinOutPerTxItemCoinType) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountSettingsMaxCoinOutPerTxItemCoinType {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 512usize {
return Err("longer than 512 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| {
::regress::Regex::new("^0x[0-9a-f]{1,64}::[A-Za-z0-9_]+::[A-Za-z0-9_]+$").unwrap()
});
if PATTERN.find(value).is_none() {
return Err(
"doesn't match pattern \"^0x[0-9a-f]{1,64}::[A-Za-z0-9_]+::[A-Za-z0-9_]+$\"".into(),
);
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsMaxCoinOutPerTxItemCoinType {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String>
for AccountSettingsMaxCoinOutPerTxItemCoinType
{
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsMaxCoinOutPerTxItemCoinType {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountSettingsMaxCoinOutPerTxItemCoinType {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AccountSettingsNetwork`
///
#[derive(
::serde::Deserialize,
::serde::Serialize,
Clone,
Copy,
Debug,
Eq,
Hash,
Ord,
PartialEq,
PartialOrd,
)]
#[non_exhaustive]
pub enum AccountSettingsNetwork {
#[serde(rename = "mainnet")]
Mainnet,
#[serde(rename = "testnet")]
Testnet,
#[serde(rename = "devnet")]
Devnet,
}
impl ::std::fmt::Display for AccountSettingsNetwork {
fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> ::std::fmt::Result {
match *self {
Self::Mainnet => f.write_str("mainnet"),
Self::Testnet => f.write_str("testnet"),
Self::Devnet => f.write_str("devnet"),
}
}
}
impl ::std::str::FromStr for AccountSettingsNetwork {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
match value {
"mainnet" => Ok(Self::Mainnet),
"testnet" => Ok(Self::Testnet),
"devnet" => Ok(Self::Devnet),
_ => Err("invalid value".into()),
}
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsNetwork {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSettingsNetwork {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsNetwork {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
///`AccountSettingsPoolId`
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountSettingsPoolId(::std::string::String);
impl ::std::ops::Deref for AccountSettingsPoolId {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountSettingsPoolId> for ::std::string::String {
fn from(value: AccountSettingsPoolId) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountSettingsPoolId {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[a-z0-9-]{4,32}$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[a-z0-9-]{4,32}$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsPoolId {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSettingsPoolId {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsPoolId {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountSettingsPoolId {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AccountSettingsProjectNumber`
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountSettingsProjectNumber(::std::string::String);
impl ::std::ops::Deref for AccountSettingsProjectNumber {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountSettingsProjectNumber> for ::std::string::String {
fn from(value: AccountSettingsProjectNumber) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountSettingsProjectNumber {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[0-9]{1,20}$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[0-9]{1,20}$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsProjectNumber {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSettingsProjectNumber {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsProjectNumber {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountSettingsProjectNumber {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AccountSettingsProviderId`
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountSettingsProviderId(::std::string::String);
impl ::std::ops::Deref for AccountSettingsProviderId {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountSettingsProviderId> for ::std::string::String {
fn from(value: AccountSettingsProviderId) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountSettingsProviderId {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[a-z0-9-]{4,32}$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[a-z0-9-]{4,32}$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsProviderId {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSettingsProviderId {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsProviderId {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountSettingsProviderId {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///The SigV4 signing region; `auto` for Cloudflare R2.
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountSettingsRegion(::std::string::String);
impl ::std::ops::Deref for AccountSettingsRegion {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountSettingsRegion> for ::std::string::String {
fn from(value: AccountSettingsRegion) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountSettingsRegion {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 64usize {
return Err("longer than 64 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[a-z0-9-]+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[a-z0-9-]+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsRegion {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSettingsRegion {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsRegion {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountSettingsRegion {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AccountSettingsScopesItem`
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountSettingsScopesItem(::std::string::String);
impl ::std::ops::Deref for AccountSettingsScopesItem {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountSettingsScopesItem> for ::std::string::String {
fn from(value: AccountSettingsScopesItem) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountSettingsScopesItem {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 256usize {
return Err("longer than 256 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[!#-\\[\\]-~]+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[!#-\\[\\]-~]+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsScopesItem {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSettingsScopesItem {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsScopesItem {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountSettingsScopesItem {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///When set, the federated token is exchanged for this service account's access token.
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountSettingsServiceAccount(::std::string::String);
impl ::std::ops::Deref for AccountSettingsServiceAccount {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountSettingsServiceAccount> for ::std::string::String {
fn from(value: AccountSettingsServiceAccount) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountSettingsServiceAccount {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 254usize {
return Err("longer than 254 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| {
::regress::Regex::new("^[a-z0-9-]+@[a-z0-9-]+\\.iam\\.gserviceaccount\\.com$")
.unwrap()
});
if PATTERN.find(value).is_none() {
return Err(
"doesn't match pattern \"^[a-z0-9-]+@[a-z0-9-]+\\.iam\\.gserviceaccount\\.com$\""
.into(),
);
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsServiceAccount {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSettingsServiceAccount {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsServiceAccount {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountSettingsServiceAccount {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///The ID-token algorithm. ES256 unless the provider refuses it. Absent means ES256.
///
#[derive(
::serde::Deserialize,
::serde::Serialize,
Clone,
Copy,
Debug,
Eq,
Hash,
Ord,
PartialEq,
PartialOrd,
)]
#[non_exhaustive]
pub enum AccountSettingsSigningAlgorithm {
#[serde(rename = "ES256")]
Es256,
#[serde(rename = "RS256")]
Rs256,
}
impl ::std::fmt::Display for AccountSettingsSigningAlgorithm {
fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> ::std::fmt::Result {
match *self {
Self::Es256 => f.write_str("ES256"),
Self::Rs256 => f.write_str("RS256"),
}
}
}
impl ::std::str::FromStr for AccountSettingsSigningAlgorithm {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
match value {
"ES256" => Ok(Self::Es256),
"RS256" => Ok(Self::Rs256),
_ => Err("invalid value".into()),
}
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsSigningAlgorithm {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSettingsSigningAlgorithm {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsSigningAlgorithm {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
///`AccountSettingsTenantId`
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountSettingsTenantId(::std::string::String);
impl ::std::ops::Deref for AccountSettingsTenantId {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountSettingsTenantId> for ::std::string::String {
fn from(value: AccountSettingsTenantId) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountSettingsTenantId {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| {
::regress::Regex::new(
"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$",
)
.unwrap()
});
if PATTERN.find(value).is_none() {
return Err(
"doesn't match pattern \"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$\""
.into(),
);
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsTenantId {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSettingsTenantId {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsTenantId {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountSettingsTenantId {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///The `scope` requested at the token endpoint, such as `https://storage.azure.com/.default`.
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountSettingsTokenScope(::std::string::String);
impl ::std::ops::Deref for AccountSettingsTokenScope {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountSettingsTokenScope> for ::std::string::String {
fn from(value: AccountSettingsTokenScope) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountSettingsTokenScope {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 512usize {
return Err("longer than 512 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[A-Za-z0-9:/._-]+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[A-Za-z0-9:/._-]+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountSettingsTokenScope {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSettingsTokenScope {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSettingsTokenScope {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountSettingsTokenScope {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`active`: usable by its bindings. `suspended`: every issuance and signature is refused at once; management reads continue; resumable. `archived`: hidden from default listings, refused for use, restorable. Deletion removes the record.
///
#[derive(
::serde::Deserialize,
::serde::Serialize,
Clone,
Copy,
Debug,
Eq,
Hash,
Ord,
PartialEq,
PartialOrd,
)]
#[non_exhaustive]
pub enum AccountState {
#[serde(rename = "active")]
Active,
#[serde(rename = "suspended")]
Suspended,
#[serde(rename = "archived")]
Archived,
}
impl ::std::fmt::Display for AccountState {
fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> ::std::fmt::Result {
match *self {
Self::Active => f.write_str("active"),
Self::Suspended => f.write_str("suspended"),
Self::Archived => f.write_str("archived"),
}
}
}
impl ::std::str::FromStr for AccountState {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
match value {
"active" => Ok(Self::Active),
"suspended" => Ok(Self::Suspended),
"archived" => Ok(Self::Archived),
_ => Err("invalid value".into()),
}
}
}
impl ::std::convert::TryFrom<&str> for AccountState {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountState {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountState {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
///`AwsArn`
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AwsArn(::std::string::String);
impl ::std::ops::Deref for AwsArn {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AwsArn> for ::std::string::String {
fn from(value: AwsArn) -> Self {
value.0
}
}
impl ::std::str::FromStr for AwsArn {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 2048usize {
return Err("longer than 2048 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| {
::regress::Regex::new(
"^arn:aws[a-z-]*:[a-z0-9-]+:[a-z0-9-]*:[0-9]{0,12}:[A-Za-z0-9+=,.@_/:-]+$",
)
.unwrap()
});
if PATTERN.find(value).is_none() {
return Err(
"doesn't match pattern \"^arn:aws[a-z-]*:[a-z0-9-]+:[a-z0-9-]*:[0-9]{0,12}:[A-Za-z0-9+=,.@_/:-]+$\""
.into(),
);
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AwsArn {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AwsArn {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AwsArn {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AwsArn {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AwsRegion`
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AwsRegion(::std::string::String);
impl ::std::ops::Deref for AwsRegion {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AwsRegion> for ::std::string::String {
fn from(value: AwsRegion) -> Self {
value.0
}
}
impl ::std::str::FromStr for AwsRegion {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 32usize {
return Err("longer than 32 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| {
::regress::Regex::new("^[a-z]{2}(-gov)?-[a-z]+-[0-9]$").unwrap()
});
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[a-z]{2}(-gov)?-[a-z]+-[0-9]$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AwsRegion {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AwsRegion {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AwsRegion {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AwsRegion {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///The widest scope a binding's consumer may request. An issuance is inside the ceiling when its `prefix` begins with one of `prefixes`, every one of its `actions` is in `actions`, and every one of its `scopes` is in `scopes`. Absent members confer nothing: a ceiling with no `prefixes` permits no storage issuance.
///
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct CredentialScopeCeiling {
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub actions: ::std::option::Option<Vec<ProviderObjectAction>>,
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub prefixes: ::std::option::Option<Vec<ProviderObjectPrefix>>,
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub scopes: ::std::option::Option<Vec<CredentialScopeCeilingScopesItem>>,
}
impl ::std::default::Default for CredentialScopeCeiling {
fn default() -> Self {
Self {
actions: Default::default(),
prefixes: Default::default(),
scopes: Default::default(),
}
}
}
impl CredentialScopeCeiling {
pub fn builder() -> builder::CredentialScopeCeiling {
Default::default()
}
}
///`CredentialScopeCeilingScopesItem`
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct CredentialScopeCeilingScopesItem(::std::string::String);
impl ::std::ops::Deref for CredentialScopeCeilingScopesItem {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<CredentialScopeCeilingScopesItem> for ::std::string::String {
fn from(value: CredentialScopeCeilingScopesItem) -> Self {
value.0
}
}
impl ::std::str::FromStr for CredentialScopeCeilingScopesItem {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 256usize {
return Err("longer than 256 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[!#-\\[\\]-~]+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[!#-\\[\\]-~]+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for CredentialScopeCeilingScopesItem {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for CredentialScopeCeilingScopesItem {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for CredentialScopeCeilingScopesItem {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for CredentialScopeCeilingScopesItem {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
/**
A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.
Multihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.
This definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.
Restricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that "interoperability is not guaranteed between implementations using such values", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.*/
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct DigestMultibase(::std::string::String);
impl ::std::ops::Deref for DigestMultibase {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<DigestMultibase> for ::std::string::String {
fn from(value: DigestMultibase) -> Self {
value.0
}
}
impl ::std::str::FromStr for DigestMultibase {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() < 16usize {
return Err("shorter than 16 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| {
::regress::Regex::new("^(z[1-9A-HJ-NP-Za-km-z]+|u[A-Za-z0-9_-]+)$").unwrap()
});
if PATTERN.find(value).is_none() {
return Err(
"doesn't match pattern \"^(z[1-9A-HJ-NP-Za-km-z]+|u[A-Za-z0-9_-]+)$\"".into(),
);
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for DigestMultibase {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for DigestMultibase {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for DigestMultibase {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for DigestMultibase {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
///
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(transparent)]
pub struct Ext(pub ::std::collections::HashMap<ExtKey, ::serde_json::Value>);
impl ::std::ops::Deref for Ext {
type Target = ::std::collections::HashMap<ExtKey, ::serde_json::Value>;
fn deref(&self) -> &::std::collections::HashMap<ExtKey, ::serde_json::Value> {
&self.0
}
}
impl ::std::convert::From<Ext> for ::std::collections::HashMap<ExtKey, ::serde_json::Value> {
fn from(value: Ext) -> Self {
value.0
}
}
impl ::std::convert::From<::std::collections::HashMap<ExtKey, ::serde_json::Value>> for Ext {
fn from(value: ::std::collections::HashMap<ExtKey, ::serde_json::Value>) -> Self {
Self(value)
}
}
///`ExtKey`
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct ExtKey(::std::string::String);
impl ::std::ops::Deref for ExtKey {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<ExtKey> for ::std::string::String {
fn from(value: ExtKey) -> Self {
value.0
}
}
impl ::std::str::FromStr for ExtKey {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| {
::regress::Regex::new("^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$").unwrap()
});
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for ExtKey {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for ExtKey {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for ExtKey {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for ExtKey {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///An account as every read returns it. Contains no private key, no secret and no issued credential, to any reader.
///
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct ExternalAccount {
pub bindings: ::std::vec::Vec<AccountBinding>,
pub context: AccountContextId,
#[serde(rename = "createdAt")]
pub created_at: ::chrono::DateTime<::chrono::offset::Utc>,
///The provider hosts the custodian connects to on this account's behalf, derived by the custodian from its settings: the token or session endpoints issuance uses, and the destinations external/accounts/probe dials (the object store's host, for a storage model). The custodian MUST NOT connect anywhere else on the account's behalf, so an egress proxy can allow exactly this set. Empty only for a model that neither exchanges nor probes over the network.
#[serde(rename = "egressHosts")]
pub egress_hosts: ::std::vec::Vec<ExternalAccountEgressHostsItem>,
pub id: AccountId,
///Display name. Untrusted text: render it, never interpret it.
pub label: ExternalAccountLabel,
#[serde(
rename = "lastProbe",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
pub last_probe: ::std::option::Option<AccountProbeReport>,
///True when the account cannot be used until its provider-side setup is redone: after a restore that could not carry its key or secret (a wrapped RSA key, a static secret), or after a rotation awaiting confirmation.
#[serde(rename = "providerSetupRequired")]
pub provider_setup_required: bool,
///Absent for the static models, which hold a secret rather than a key.
#[serde(
rename = "publicMaterial",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
pub public_material: ::std::option::Option<AccountPublicMaterial>,
///Static models only; absent until the secret is set.
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub secret: ::std::option::Option<AccountSecretInfo>,
pub settings: AccountSettings,
pub state: AccountState,
#[serde(rename = "updatedAt")]
pub updated_at: ::chrono::DateTime<::chrono::offset::Utc>,
}
impl ExternalAccount {
pub fn builder() -> builder::ExternalAccount {
Default::default()
}
}
///`ExternalAccountEgressHostsItem`
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct ExternalAccountEgressHostsItem(::std::string::String);
impl ::std::ops::Deref for ExternalAccountEgressHostsItem {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<ExternalAccountEgressHostsItem> for ::std::string::String {
fn from(value: ExternalAccountEgressHostsItem) -> Self {
value.0
}
}
impl ::std::str::FromStr for ExternalAccountEgressHostsItem {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 253usize {
return Err("longer than 253 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[a-z0-9.-]+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[a-z0-9.-]+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for ExternalAccountEgressHostsItem {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for ExternalAccountEgressHostsItem {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for ExternalAccountEgressHostsItem {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for ExternalAccountEgressHostsItem {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///Display name. Untrusted text: render it, never interpret it.
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct ExternalAccountLabel(::std::string::String);
impl ::std::ops::Deref for ExternalAccountLabel {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<ExternalAccountLabel> for ::std::string::String {
fn from(value: ExternalAccountLabel) -> Self {
value.0
}
}
impl ::std::str::FromStr for ExternalAccountLabel {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 128usize {
return Err("longer than 128 characters".into());
}
if value.chars().count() < 1usize {
return Err("shorter than 1 characters".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for ExternalAccountLabel {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for ExternalAccountLabel {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for ExternalAccountLabel {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for ExternalAccountLabel {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///A manager restores an archived external account to `suspended`, from which resuming it is a separate, consented step. The outer document members are owned by the framework — SPEC §6.3.
///
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct Payload {
pub context: AccountContextId,
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub ext: ::std::option::Option<Ext>,
pub id: AccountId,
///Why, in the requester's words. Recorded in the audit row. Untrusted text: displayed, never interpreted.
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub reason: ::std::option::Option<PayloadReason>,
}
impl Payload {
pub fn builder() -> builder::Payload {
Default::default()
}
}
///Why, in the requester's words. Recorded in the audit row. Untrusted text: displayed, never interpreted.
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct PayloadReason(::std::string::String);
impl ::std::ops::Deref for PayloadReason {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<PayloadReason> for ::std::string::String {
fn from(value: PayloadReason) -> Self {
value.0
}
}
impl ::std::str::FromStr for PayloadReason {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 500usize {
return Err("longer than 500 characters".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for PayloadReason {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for PayloadReason {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for PayloadReason {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for PayloadReason {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///A bucket name as S3 and GCS accept it. Validated rather than free so that it can be placed in a provider policy without escaping.
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct ProviderBucketName(::std::string::String);
impl ::std::ops::Deref for ProviderBucketName {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<ProviderBucketName> for ::std::string::String {
fn from(value: ProviderBucketName) -> Self {
value.0
}
}
impl ::std::str::FromStr for ProviderBucketName {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 63usize {
return Err("longer than 63 characters".into());
}
if value.chars().count() < 3usize {
return Err("shorter than 3 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| {
::regress::Regex::new("^[a-z0-9][a-z0-9.-]*[a-z0-9]$").unwrap()
});
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[a-z0-9][a-z0-9.-]*[a-z0-9]$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for ProviderBucketName {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for ProviderBucketName {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for ProviderBucketName {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for ProviderBucketName {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`ProviderHttpsUrl`
///
#[derive(
::serde::Deserialize, ::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd,
)]
#[serde(transparent)]
pub struct ProviderHttpsUrl(pub ::std::string::String);
impl ::std::ops::Deref for ProviderHttpsUrl {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<ProviderHttpsUrl> for ::std::string::String {
fn from(value: ProviderHttpsUrl) -> Self {
value.0
}
}
impl ::std::convert::From<::std::string::String> for ProviderHttpsUrl {
fn from(value: ::std::string::String) -> Self {
Self(value)
}
}
impl ::std::str::FromStr for ProviderHttpsUrl {
type Err = ::std::convert::Infallible;
fn from_str(value: &str) -> ::std::result::Result<Self, Self::Err> {
Ok(Self(value.to_string()))
}
}
impl ::std::fmt::Display for ProviderHttpsUrl {
fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> ::std::fmt::Result {
self.0.fmt(f)
}
}
///`put`: write an object. `get`: read one. `delete`: remove one. No list, ACL, policy or bucket-level action exists here, so none can be granted.
///
#[derive(
::serde::Deserialize,
::serde::Serialize,
Clone,
Copy,
Debug,
Eq,
Hash,
Ord,
PartialEq,
PartialOrd,
)]
#[non_exhaustive]
pub enum ProviderObjectAction {
#[serde(rename = "put")]
Put,
#[serde(rename = "get")]
Get,
#[serde(rename = "delete")]
Delete,
}
impl ::std::fmt::Display for ProviderObjectAction {
fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> ::std::fmt::Result {
match *self {
Self::Put => f.write_str("put"),
Self::Get => f.write_str("get"),
Self::Delete => f.write_str("delete"),
}
}
}
impl ::std::str::FromStr for ProviderObjectAction {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
match value {
"put" => Ok(Self::Put),
"get" => Ok(Self::Get),
"delete" => Ok(Self::Delete),
_ => Err("invalid value".into()),
}
}
}
impl ::std::convert::TryFrom<&str> for ProviderObjectAction {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for ProviderObjectAction {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for ProviderObjectAction {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
///An object-key prefix within the account's bucket: one or more segments of lowercase letters, digits, `.`, `_` and `-`, each beginning with a letter or digit and ending with `/`. No quote, backslash, wildcard, whitespace, `..` segment or empty segment can appear. That is deliberate: the custodian places this value inside a provider policy — an IAM session policy (JSON), a GCS Credential Access Boundary condition (CEL) — and a value able to carry a metacharacter can break out of the string it is placed in and widen the policy. That is a known class of defect (CVE-2026-42811, a CEL injection in downscoped GCS credentials). Even with this pattern, a custodian MUST build provider policies with the provider language's own encoder, never by string interpolation.
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct ProviderObjectPrefix(::std::string::String);
impl ::std::ops::Deref for ProviderObjectPrefix {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<ProviderObjectPrefix> for ::std::string::String {
fn from(value: ProviderObjectPrefix) -> Self {
value.0
}
}
impl ::std::str::FromStr for ProviderObjectPrefix {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 512usize {
return Err("longer than 512 characters".into());
}
if value.chars().count() < 2usize {
return Err("shorter than 2 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| {
::regress::Regex::new("^([a-z0-9][a-z0-9._-]{0,127}/){1,16}$").unwrap()
});
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^([a-z0-9][a-z0-9._-]{0,127}/){1,16}$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for ProviderObjectPrefix {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for ProviderObjectPrefix {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for ProviderObjectPrefix {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for ProviderObjectPrefix {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`Response`
///
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct Response {
pub account: ExternalAccount,
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub ext: ::std::option::Option<Ext>,
}
impl Response {
pub fn builder() -> builder::Response {
Default::default()
}
}
///Which secret is set, without being a way to test guesses at it. `hmacsha256:` followed by the base64url encoding, without padding, of the first 16 bytes of HMAC-SHA256 over the secret's bytes under a fingerprint key the custodian holds and never discloses. Comparable only between fingerprints made by the same custodian: a re-entered value can be confirmed, while the same secret at two custodians gives unrelated fingerprints. Never a bare hash of the secret, which would let anyone who reads it run a dictionary against it offline; and deliberately not a DigestMultibase, since multihash has no code for a keyed digest.
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct SecretFingerprint(::std::string::String);
impl ::std::ops::Deref for SecretFingerprint {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<SecretFingerprint> for ::std::string::String {
fn from(value: SecretFingerprint) -> Self {
value.0
}
}
impl ::std::str::FromStr for SecretFingerprint {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 33usize {
return Err("longer than 33 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| {
::regress::Regex::new("^hmacsha256:[A-Za-z0-9_-]{22}$").unwrap()
});
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^hmacsha256:[A-Za-z0-9_-]{22}$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for SecretFingerprint {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for SecretFingerprint {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for SecretFingerprint {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for SecretFingerprint {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///One Move function an account's transactions may call.
///
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct SuiMoveCall {
pub function: SuiMoveCallFunction,
pub module: SuiMoveCallModule,
pub package: SuiMoveCallPackage,
}
impl SuiMoveCall {
pub fn builder() -> builder::SuiMoveCall {
Default::default()
}
}
///`SuiMoveCallFunction`
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct SuiMoveCallFunction(::std::string::String);
impl ::std::ops::Deref for SuiMoveCallFunction {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<SuiMoveCallFunction> for ::std::string::String {
fn from(value: SuiMoveCallFunction) -> Self {
value.0
}
}
impl ::std::str::FromStr for SuiMoveCallFunction {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| {
::regress::Regex::new("^[A-Za-z][A-Za-z0-9_]{0,127}$").unwrap()
});
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[A-Za-z][A-Za-z0-9_]{0,127}$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for SuiMoveCallFunction {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for SuiMoveCallFunction {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for SuiMoveCallFunction {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for SuiMoveCallFunction {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`SuiMoveCallModule`
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct SuiMoveCallModule(::std::string::String);
impl ::std::ops::Deref for SuiMoveCallModule {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<SuiMoveCallModule> for ::std::string::String {
fn from(value: SuiMoveCallModule) -> Self {
value.0
}
}
impl ::std::str::FromStr for SuiMoveCallModule {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| {
::regress::Regex::new("^[A-Za-z][A-Za-z0-9_]{0,127}$").unwrap()
});
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[A-Za-z][A-Za-z0-9_]{0,127}$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for SuiMoveCallModule {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for SuiMoveCallModule {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for SuiMoveCallModule {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for SuiMoveCallModule {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`SuiMoveCallPackage`
///
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct SuiMoveCallPackage(::std::string::String);
impl ::std::ops::Deref for SuiMoveCallPackage {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<SuiMoveCallPackage> for ::std::string::String {
fn from(value: SuiMoveCallPackage) -> Self {
value.0
}
}
impl ::std::str::FromStr for SuiMoveCallPackage {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^0x[0-9a-f]{64}$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^0x[0-9a-f]{64}$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for SuiMoveCallPackage {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for SuiMoveCallPackage {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for SuiMoveCallPackage {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for SuiMoveCallPackage {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
/// Types for composing complex structures.
pub mod builder {
#[derive(Clone, Debug)]
pub struct AccountBinding {
consumer: ::std::result::Result<super::AccountBindingConsumer, ::std::string::String>,
granted_at: ::std::result::Result<
::std::option::Option<::chrono::DateTime<::chrono::offset::Utc>>,
::std::string::String,
>,
max_ttl_seconds: ::std::result::Result<i64, ::std::string::String>,
rate_per_minute: ::std::result::Result<::std::num::NonZeroU64, ::std::string::String>,
scope_ceiling: ::std::result::Result<
::std::option::Option<super::CredentialScopeCeiling>,
::std::string::String,
>,
source_cidrs: ::std::result::Result<
::std::vec::Vec<super::AccountBindingSourceCidrsItem>,
::std::string::String,
>,
}
impl ::std::default::Default for AccountBinding {
fn default() -> Self {
Self {
consumer: Err("no value supplied for consumer".to_string()),
granted_at: Ok(Default::default()),
max_ttl_seconds: Err("no value supplied for max_ttl_seconds".to_string()),
rate_per_minute: Err("no value supplied for rate_per_minute".to_string()),
scope_ceiling: Ok(Default::default()),
source_cidrs: Ok(Default::default()),
}
}
}
impl AccountBinding {
pub fn consumer<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::AccountBindingConsumer>,
T::Error: ::std::fmt::Display,
{
self.consumer = value
.try_into()
.map_err(|e| format!("error converting supplied value for consumer: {e}"));
self
}
pub fn granted_at<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<
::std::option::Option<::chrono::DateTime<::chrono::offset::Utc>>,
>,
T::Error: ::std::fmt::Display,
{
self.granted_at = value
.try_into()
.map_err(|e| format!("error converting supplied value for granted_at: {e}"));
self
}
pub fn max_ttl_seconds<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<i64>,
T::Error: ::std::fmt::Display,
{
self.max_ttl_seconds = value
.try_into()
.map_err(|e| format!("error converting supplied value for max_ttl_seconds: {e}"));
self
}
pub fn rate_per_minute<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::num::NonZeroU64>,
T::Error: ::std::fmt::Display,
{
self.rate_per_minute = value
.try_into()
.map_err(|e| format!("error converting supplied value for rate_per_minute: {e}"));
self
}
pub fn scope_ceiling<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<super::CredentialScopeCeiling>>,
T::Error: ::std::fmt::Display,
{
self.scope_ceiling = value
.try_into()
.map_err(|e| format!("error converting supplied value for scope_ceiling: {e}"));
self
}
pub fn source_cidrs<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::vec::Vec<super::AccountBindingSourceCidrsItem>>,
T::Error: ::std::fmt::Display,
{
self.source_cidrs = value
.try_into()
.map_err(|e| format!("error converting supplied value for source_cidrs: {e}"));
self
}
}
impl ::std::convert::TryFrom<AccountBinding> for super::AccountBinding {
type Error = super::error::ConversionError;
fn try_from(
value: AccountBinding,
) -> ::std::result::Result<Self, super::error::ConversionError> {
Ok(Self {
consumer: value.consumer?,
granted_at: value.granted_at?,
max_ttl_seconds: value.max_ttl_seconds?,
rate_per_minute: value.rate_per_minute?,
scope_ceiling: value.scope_ceiling?,
source_cidrs: value.source_cidrs?,
})
}
}
impl ::std::convert::From<super::AccountBinding> for AccountBinding {
fn from(value: super::AccountBinding) -> Self {
Self {
consumer: Ok(value.consumer),
granted_at: Ok(value.granted_at),
max_ttl_seconds: Ok(value.max_ttl_seconds),
rate_per_minute: Ok(value.rate_per_minute),
scope_ceiling: Ok(value.scope_ceiling),
source_cidrs: Ok(value.source_cidrs),
}
}
}
#[derive(Clone, Debug)]
pub struct AccountProbeReport {
complete: ::std::result::Result<bool, ::std::string::String>,
ok: ::std::result::Result<bool, ::std::string::String>,
probed_at:
::std::result::Result<::chrono::DateTime<::chrono::offset::Utc>, ::std::string::String>,
steps: ::std::result::Result<
::std::vec::Vec<super::AccountProbeReportStepsItem>,
::std::string::String,
>,
}
impl ::std::default::Default for AccountProbeReport {
fn default() -> Self {
Self {
complete: Err("no value supplied for complete".to_string()),
ok: Err("no value supplied for ok".to_string()),
probed_at: Err("no value supplied for probed_at".to_string()),
steps: Err("no value supplied for steps".to_string()),
}
}
}
impl AccountProbeReport {
pub fn complete<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<bool>,
T::Error: ::std::fmt::Display,
{
self.complete = value
.try_into()
.map_err(|e| format!("error converting supplied value for complete: {e}"));
self
}
pub fn ok<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<bool>,
T::Error: ::std::fmt::Display,
{
self.ok = value
.try_into()
.map_err(|e| format!("error converting supplied value for ok: {e}"));
self
}
pub fn probed_at<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::chrono::DateTime<::chrono::offset::Utc>>,
T::Error: ::std::fmt::Display,
{
self.probed_at = value
.try_into()
.map_err(|e| format!("error converting supplied value for probed_at: {e}"));
self
}
pub fn steps<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::vec::Vec<super::AccountProbeReportStepsItem>>,
T::Error: ::std::fmt::Display,
{
self.steps = value
.try_into()
.map_err(|e| format!("error converting supplied value for steps: {e}"));
self
}
}
impl ::std::convert::TryFrom<AccountProbeReport> for super::AccountProbeReport {
type Error = super::error::ConversionError;
fn try_from(
value: AccountProbeReport,
) -> ::std::result::Result<Self, super::error::ConversionError> {
Ok(Self {
complete: value.complete?,
ok: value.ok?,
probed_at: value.probed_at?,
steps: value.steps?,
})
}
}
impl ::std::convert::From<super::AccountProbeReport> for AccountProbeReport {
fn from(value: super::AccountProbeReport) -> Self {
Self {
complete: Ok(value.complete),
ok: Ok(value.ok),
probed_at: Ok(value.probed_at),
steps: Ok(value.steps),
}
}
}
#[derive(Clone, Debug)]
pub struct AccountProbeReportStepsItem {
duration_ms: ::std::result::Result<::std::option::Option<u64>, ::std::string::String>,
ok: ::std::result::Result<bool, ::std::string::String>,
provider_error: ::std::result::Result<
::std::option::Option<super::AccountProbeReportStepsItemProviderError>,
::std::string::String,
>,
provider_request_id: ::std::result::Result<
::std::option::Option<super::AccountProbeReportStepsItemProviderRequestId>,
::std::string::String,
>,
step: ::std::result::Result<super::AccountProbeStep, ::std::string::String>,
}
impl ::std::default::Default for AccountProbeReportStepsItem {
fn default() -> Self {
Self {
duration_ms: Ok(Default::default()),
ok: Err("no value supplied for ok".to_string()),
provider_error: Ok(Default::default()),
provider_request_id: Ok(Default::default()),
step: Err("no value supplied for step".to_string()),
}
}
}
impl AccountProbeReportStepsItem {
pub fn duration_ms<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<u64>>,
T::Error: ::std::fmt::Display,
{
self.duration_ms = value
.try_into()
.map_err(|e| format!("error converting supplied value for duration_ms: {e}"));
self
}
pub fn ok<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<bool>,
T::Error: ::std::fmt::Display,
{
self.ok = value
.try_into()
.map_err(|e| format!("error converting supplied value for ok: {e}"));
self
}
pub fn provider_error<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<
::std::option::Option<super::AccountProbeReportStepsItemProviderError>,
>,
T::Error: ::std::fmt::Display,
{
self.provider_error = value
.try_into()
.map_err(|e| format!("error converting supplied value for provider_error: {e}"));
self
}
pub fn provider_request_id<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<
::std::option::Option<super::AccountProbeReportStepsItemProviderRequestId>,
>,
T::Error: ::std::fmt::Display,
{
self.provider_request_id = value.try_into().map_err(|e| {
format!("error converting supplied value for provider_request_id: {e}")
});
self
}
pub fn step<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::AccountProbeStep>,
T::Error: ::std::fmt::Display,
{
self.step = value
.try_into()
.map_err(|e| format!("error converting supplied value for step: {e}"));
self
}
}
impl ::std::convert::TryFrom<AccountProbeReportStepsItem> for super::AccountProbeReportStepsItem {
type Error = super::error::ConversionError;
fn try_from(
value: AccountProbeReportStepsItem,
) -> ::std::result::Result<Self, super::error::ConversionError> {
Ok(Self {
duration_ms: value.duration_ms?,
ok: value.ok?,
provider_error: value.provider_error?,
provider_request_id: value.provider_request_id?,
step: value.step?,
})
}
}
impl ::std::convert::From<super::AccountProbeReportStepsItem> for AccountProbeReportStepsItem {
fn from(value: super::AccountProbeReportStepsItem) -> Self {
Self {
duration_ms: Ok(value.duration_ms),
ok: Ok(value.ok),
provider_error: Ok(value.provider_error),
provider_request_id: Ok(value.provider_request_id),
step: Ok(value.step),
}
}
}
#[derive(Clone, Debug)]
pub struct AccountPublicMaterial {
address: ::std::result::Result<
::std::option::Option<super::AccountPublicMaterialAddress>,
::std::string::String,
>,
algorithm:
::std::result::Result<super::AccountPublicMaterialAlgorithm, ::std::string::String>,
certificate_pem: ::std::result::Result<
::std::option::Option<super::AccountPublicMaterialCertificatePem>,
::std::string::String,
>,
key_fingerprint: ::std::result::Result<super::DigestMultibase, ::std::string::String>,
pending_key_fingerprint: ::std::result::Result<
::std::option::Option<super::DigestMultibase>,
::std::string::String,
>,
public_key_jwk: ::std::result::Result<
::std::option::Option<super::AccountPublicMaterialPublicKeyJwk>,
::std::string::String,
>,
}
impl ::std::default::Default for AccountPublicMaterial {
fn default() -> Self {
Self {
address: Ok(Default::default()),
algorithm: Err("no value supplied for algorithm".to_string()),
certificate_pem: Ok(Default::default()),
key_fingerprint: Err("no value supplied for key_fingerprint".to_string()),
pending_key_fingerprint: Ok(Default::default()),
public_key_jwk: Ok(Default::default()),
}
}
}
impl AccountPublicMaterial {
pub fn address<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<super::AccountPublicMaterialAddress>>,
T::Error: ::std::fmt::Display,
{
self.address = value
.try_into()
.map_err(|e| format!("error converting supplied value for address: {e}"));
self
}
pub fn algorithm<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::AccountPublicMaterialAlgorithm>,
T::Error: ::std::fmt::Display,
{
self.algorithm = value
.try_into()
.map_err(|e| format!("error converting supplied value for algorithm: {e}"));
self
}
pub fn certificate_pem<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<
::std::option::Option<super::AccountPublicMaterialCertificatePem>,
>,
T::Error: ::std::fmt::Display,
{
self.certificate_pem = value
.try_into()
.map_err(|e| format!("error converting supplied value for certificate_pem: {e}"));
self
}
pub fn key_fingerprint<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::DigestMultibase>,
T::Error: ::std::fmt::Display,
{
self.key_fingerprint = value
.try_into()
.map_err(|e| format!("error converting supplied value for key_fingerprint: {e}"));
self
}
pub fn pending_key_fingerprint<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<super::DigestMultibase>>,
T::Error: ::std::fmt::Display,
{
self.pending_key_fingerprint = value.try_into().map_err(|e| {
format!("error converting supplied value for pending_key_fingerprint: {e}")
});
self
}
pub fn public_key_jwk<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<
::std::option::Option<super::AccountPublicMaterialPublicKeyJwk>,
>,
T::Error: ::std::fmt::Display,
{
self.public_key_jwk = value
.try_into()
.map_err(|e| format!("error converting supplied value for public_key_jwk: {e}"));
self
}
}
impl ::std::convert::TryFrom<AccountPublicMaterial> for super::AccountPublicMaterial {
type Error = super::error::ConversionError;
fn try_from(
value: AccountPublicMaterial,
) -> ::std::result::Result<Self, super::error::ConversionError> {
Ok(Self {
address: value.address?,
algorithm: value.algorithm?,
certificate_pem: value.certificate_pem?,
key_fingerprint: value.key_fingerprint?,
pending_key_fingerprint: value.pending_key_fingerprint?,
public_key_jwk: value.public_key_jwk?,
})
}
}
impl ::std::convert::From<super::AccountPublicMaterial> for AccountPublicMaterial {
fn from(value: super::AccountPublicMaterial) -> Self {
Self {
address: Ok(value.address),
algorithm: Ok(value.algorithm),
certificate_pem: Ok(value.certificate_pem),
key_fingerprint: Ok(value.key_fingerprint),
pending_key_fingerprint: Ok(value.pending_key_fingerprint),
public_key_jwk: Ok(value.public_key_jwk),
}
}
}
#[derive(Clone, Debug)]
pub struct AccountPublicMaterialPublicKeyJwk {
alg: ::std::result::Result<
::std::option::Option<super::AccountPublicMaterialPublicKeyJwkAlg>,
::std::string::String,
>,
crv: ::std::result::Result<
::std::option::Option<super::AccountPublicMaterialPublicKeyJwkCrv>,
::std::string::String,
>,
e: ::std::result::Result<
::std::option::Option<super::AccountPublicMaterialPublicKeyJwkE>,
::std::string::String,
>,
kid: ::std::result::Result<
super::AccountPublicMaterialPublicKeyJwkKid,
::std::string::String,
>,
kty: ::std::result::Result<
super::AccountPublicMaterialPublicKeyJwkKty,
::std::string::String,
>,
n: ::std::result::Result<
::std::option::Option<super::AccountPublicMaterialPublicKeyJwkN>,
::std::string::String,
>,
use_: ::std::result::Result<
::std::option::Option<::std::string::String>,
::std::string::String,
>,
x: ::std::result::Result<
::std::option::Option<super::AccountPublicMaterialPublicKeyJwkX>,
::std::string::String,
>,
y: ::std::result::Result<
::std::option::Option<super::AccountPublicMaterialPublicKeyJwkY>,
::std::string::String,
>,
}
impl ::std::default::Default for AccountPublicMaterialPublicKeyJwk {
fn default() -> Self {
Self {
alg: Ok(Default::default()),
crv: Ok(Default::default()),
e: Ok(Default::default()),
kid: Err("no value supplied for kid".to_string()),
kty: Err("no value supplied for kty".to_string()),
n: Ok(Default::default()),
use_: Ok(Default::default()),
x: Ok(Default::default()),
y: Ok(Default::default()),
}
}
}
impl AccountPublicMaterialPublicKeyJwk {
pub fn alg<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<
::std::option::Option<super::AccountPublicMaterialPublicKeyJwkAlg>,
>,
T::Error: ::std::fmt::Display,
{
self.alg = value
.try_into()
.map_err(|e| format!("error converting supplied value for alg: {e}"));
self
}
pub fn crv<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<
::std::option::Option<super::AccountPublicMaterialPublicKeyJwkCrv>,
>,
T::Error: ::std::fmt::Display,
{
self.crv = value
.try_into()
.map_err(|e| format!("error converting supplied value for crv: {e}"));
self
}
pub fn e<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<
::std::option::Option<super::AccountPublicMaterialPublicKeyJwkE>,
>,
T::Error: ::std::fmt::Display,
{
self.e = value
.try_into()
.map_err(|e| format!("error converting supplied value for e: {e}"));
self
}
pub fn kid<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::AccountPublicMaterialPublicKeyJwkKid>,
T::Error: ::std::fmt::Display,
{
self.kid = value
.try_into()
.map_err(|e| format!("error converting supplied value for kid: {e}"));
self
}
pub fn kty<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::AccountPublicMaterialPublicKeyJwkKty>,
T::Error: ::std::fmt::Display,
{
self.kty = value
.try_into()
.map_err(|e| format!("error converting supplied value for kty: {e}"));
self
}
pub fn n<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<
::std::option::Option<super::AccountPublicMaterialPublicKeyJwkN>,
>,
T::Error: ::std::fmt::Display,
{
self.n = value
.try_into()
.map_err(|e| format!("error converting supplied value for n: {e}"));
self
}
pub fn use_<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<::std::string::String>>,
T::Error: ::std::fmt::Display,
{
self.use_ = value
.try_into()
.map_err(|e| format!("error converting supplied value for use_: {e}"));
self
}
pub fn x<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<
::std::option::Option<super::AccountPublicMaterialPublicKeyJwkX>,
>,
T::Error: ::std::fmt::Display,
{
self.x = value
.try_into()
.map_err(|e| format!("error converting supplied value for x: {e}"));
self
}
pub fn y<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<
::std::option::Option<super::AccountPublicMaterialPublicKeyJwkY>,
>,
T::Error: ::std::fmt::Display,
{
self.y = value
.try_into()
.map_err(|e| format!("error converting supplied value for y: {e}"));
self
}
}
impl ::std::convert::TryFrom<AccountPublicMaterialPublicKeyJwk>
for super::AccountPublicMaterialPublicKeyJwk
{
type Error = super::error::ConversionError;
fn try_from(
value: AccountPublicMaterialPublicKeyJwk,
) -> ::std::result::Result<Self, super::error::ConversionError> {
Ok(Self {
alg: value.alg?,
crv: value.crv?,
e: value.e?,
kid: value.kid?,
kty: value.kty?,
n: value.n?,
use_: value.use_?,
x: value.x?,
y: value.y?,
})
}
}
impl ::std::convert::From<super::AccountPublicMaterialPublicKeyJwk>
for AccountPublicMaterialPublicKeyJwk
{
fn from(value: super::AccountPublicMaterialPublicKeyJwk) -> Self {
Self {
alg: Ok(value.alg),
crv: Ok(value.crv),
e: Ok(value.e),
kid: Ok(value.kid),
kty: Ok(value.kty),
n: Ok(value.n),
use_: Ok(value.use_),
x: Ok(value.x),
y: Ok(value.y),
}
}
}
#[derive(Clone, Debug)]
pub struct AccountSecretInfo {
fingerprint: ::std::result::Result<super::SecretFingerprint, ::std::string::String>,
set_at:
::std::result::Result<::chrono::DateTime<::chrono::offset::Utc>, ::std::string::String>,
}
impl ::std::default::Default for AccountSecretInfo {
fn default() -> Self {
Self {
fingerprint: Err("no value supplied for fingerprint".to_string()),
set_at: Err("no value supplied for set_at".to_string()),
}
}
}
impl AccountSecretInfo {
pub fn fingerprint<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::SecretFingerprint>,
T::Error: ::std::fmt::Display,
{
self.fingerprint = value
.try_into()
.map_err(|e| format!("error converting supplied value for fingerprint: {e}"));
self
}
pub fn set_at<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::chrono::DateTime<::chrono::offset::Utc>>,
T::Error: ::std::fmt::Display,
{
self.set_at = value
.try_into()
.map_err(|e| format!("error converting supplied value for set_at: {e}"));
self
}
}
impl ::std::convert::TryFrom<AccountSecretInfo> for super::AccountSecretInfo {
type Error = super::error::ConversionError;
fn try_from(
value: AccountSecretInfo,
) -> ::std::result::Result<Self, super::error::ConversionError> {
Ok(Self {
fingerprint: value.fingerprint?,
set_at: value.set_at?,
})
}
}
impl ::std::convert::From<super::AccountSecretInfo> for AccountSecretInfo {
fn from(value: super::AccountSecretInfo) -> Self {
Self {
fingerprint: Ok(value.fingerprint),
set_at: Ok(value.set_at),
}
}
}
#[derive(Clone, Debug)]
pub struct AccountSettingsMaxCoinOutPerTxItem {
amount: ::std::result::Result<u64, ::std::string::String>,
coin_type: ::std::result::Result<
super::AccountSettingsMaxCoinOutPerTxItemCoinType,
::std::string::String,
>,
}
impl ::std::default::Default for AccountSettingsMaxCoinOutPerTxItem {
fn default() -> Self {
Self {
amount: Err("no value supplied for amount".to_string()),
coin_type: Err("no value supplied for coin_type".to_string()),
}
}
}
impl AccountSettingsMaxCoinOutPerTxItem {
pub fn amount<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<u64>,
T::Error: ::std::fmt::Display,
{
self.amount = value
.try_into()
.map_err(|e| format!("error converting supplied value for amount: {e}"));
self
}
pub fn coin_type<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::AccountSettingsMaxCoinOutPerTxItemCoinType>,
T::Error: ::std::fmt::Display,
{
self.coin_type = value
.try_into()
.map_err(|e| format!("error converting supplied value for coin_type: {e}"));
self
}
}
impl ::std::convert::TryFrom<AccountSettingsMaxCoinOutPerTxItem>
for super::AccountSettingsMaxCoinOutPerTxItem
{
type Error = super::error::ConversionError;
fn try_from(
value: AccountSettingsMaxCoinOutPerTxItem,
) -> ::std::result::Result<Self, super::error::ConversionError> {
Ok(Self {
amount: value.amount?,
coin_type: value.coin_type?,
})
}
}
impl ::std::convert::From<super::AccountSettingsMaxCoinOutPerTxItem>
for AccountSettingsMaxCoinOutPerTxItem
{
fn from(value: super::AccountSettingsMaxCoinOutPerTxItem) -> Self {
Self {
amount: Ok(value.amount),
coin_type: Ok(value.coin_type),
}
}
}
#[derive(Clone, Debug)]
pub struct CredentialScopeCeiling {
actions: ::std::result::Result<
::std::option::Option<Vec<super::ProviderObjectAction>>,
::std::string::String,
>,
prefixes: ::std::result::Result<
::std::option::Option<Vec<super::ProviderObjectPrefix>>,
::std::string::String,
>,
scopes: ::std::result::Result<
::std::option::Option<Vec<super::CredentialScopeCeilingScopesItem>>,
::std::string::String,
>,
}
impl ::std::default::Default for CredentialScopeCeiling {
fn default() -> Self {
Self {
actions: Ok(Default::default()),
prefixes: Ok(Default::default()),
scopes: Ok(Default::default()),
}
}
}
impl CredentialScopeCeiling {
pub fn actions<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<Vec<super::ProviderObjectAction>>>,
T::Error: ::std::fmt::Display,
{
self.actions = value
.try_into()
.map_err(|e| format!("error converting supplied value for actions: {e}"));
self
}
pub fn prefixes<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<Vec<super::ProviderObjectPrefix>>>,
T::Error: ::std::fmt::Display,
{
self.prefixes = value
.try_into()
.map_err(|e| format!("error converting supplied value for prefixes: {e}"));
self
}
pub fn scopes<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<
::std::option::Option<Vec<super::CredentialScopeCeilingScopesItem>>,
>,
T::Error: ::std::fmt::Display,
{
self.scopes = value
.try_into()
.map_err(|e| format!("error converting supplied value for scopes: {e}"));
self
}
}
impl ::std::convert::TryFrom<CredentialScopeCeiling> for super::CredentialScopeCeiling {
type Error = super::error::ConversionError;
fn try_from(
value: CredentialScopeCeiling,
) -> ::std::result::Result<Self, super::error::ConversionError> {
Ok(Self {
actions: value.actions?,
prefixes: value.prefixes?,
scopes: value.scopes?,
})
}
}
impl ::std::convert::From<super::CredentialScopeCeiling> for CredentialScopeCeiling {
fn from(value: super::CredentialScopeCeiling) -> Self {
Self {
actions: Ok(value.actions),
prefixes: Ok(value.prefixes),
scopes: Ok(value.scopes),
}
}
}
#[derive(Clone, Debug)]
pub struct ExternalAccount {
bindings:
::std::result::Result<::std::vec::Vec<super::AccountBinding>, ::std::string::String>,
context: ::std::result::Result<super::AccountContextId, ::std::string::String>,
created_at:
::std::result::Result<::chrono::DateTime<::chrono::offset::Utc>, ::std::string::String>,
egress_hosts: ::std::result::Result<
::std::vec::Vec<super::ExternalAccountEgressHostsItem>,
::std::string::String,
>,
id: ::std::result::Result<super::AccountId, ::std::string::String>,
label: ::std::result::Result<super::ExternalAccountLabel, ::std::string::String>,
last_probe: ::std::result::Result<
::std::option::Option<super::AccountProbeReport>,
::std::string::String,
>,
provider_setup_required: ::std::result::Result<bool, ::std::string::String>,
public_material: ::std::result::Result<
::std::option::Option<super::AccountPublicMaterial>,
::std::string::String,
>,
secret: ::std::result::Result<
::std::option::Option<super::AccountSecretInfo>,
::std::string::String,
>,
settings: ::std::result::Result<super::AccountSettings, ::std::string::String>,
state: ::std::result::Result<super::AccountState, ::std::string::String>,
updated_at:
::std::result::Result<::chrono::DateTime<::chrono::offset::Utc>, ::std::string::String>,
}
impl ::std::default::Default for ExternalAccount {
fn default() -> Self {
Self {
bindings: Err("no value supplied for bindings".to_string()),
context: Err("no value supplied for context".to_string()),
created_at: Err("no value supplied for created_at".to_string()),
egress_hosts: Err("no value supplied for egress_hosts".to_string()),
id: Err("no value supplied for id".to_string()),
label: Err("no value supplied for label".to_string()),
last_probe: Ok(Default::default()),
provider_setup_required: Err(
"no value supplied for provider_setup_required".to_string()
),
public_material: Ok(Default::default()),
secret: Ok(Default::default()),
settings: Err("no value supplied for settings".to_string()),
state: Err("no value supplied for state".to_string()),
updated_at: Err("no value supplied for updated_at".to_string()),
}
}
}
impl ExternalAccount {
pub fn bindings<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::vec::Vec<super::AccountBinding>>,
T::Error: ::std::fmt::Display,
{
self.bindings = value
.try_into()
.map_err(|e| format!("error converting supplied value for bindings: {e}"));
self
}
pub fn context<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::AccountContextId>,
T::Error: ::std::fmt::Display,
{
self.context = value
.try_into()
.map_err(|e| format!("error converting supplied value for context: {e}"));
self
}
pub fn created_at<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::chrono::DateTime<::chrono::offset::Utc>>,
T::Error: ::std::fmt::Display,
{
self.created_at = value
.try_into()
.map_err(|e| format!("error converting supplied value for created_at: {e}"));
self
}
pub fn egress_hosts<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::vec::Vec<super::ExternalAccountEgressHostsItem>>,
T::Error: ::std::fmt::Display,
{
self.egress_hosts = value
.try_into()
.map_err(|e| format!("error converting supplied value for egress_hosts: {e}"));
self
}
pub fn id<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::AccountId>,
T::Error: ::std::fmt::Display,
{
self.id = value
.try_into()
.map_err(|e| format!("error converting supplied value for id: {e}"));
self
}
pub fn label<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::ExternalAccountLabel>,
T::Error: ::std::fmt::Display,
{
self.label = value
.try_into()
.map_err(|e| format!("error converting supplied value for label: {e}"));
self
}
pub fn last_probe<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<super::AccountProbeReport>>,
T::Error: ::std::fmt::Display,
{
self.last_probe = value
.try_into()
.map_err(|e| format!("error converting supplied value for last_probe: {e}"));
self
}
pub fn provider_setup_required<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<bool>,
T::Error: ::std::fmt::Display,
{
self.provider_setup_required = value.try_into().map_err(|e| {
format!("error converting supplied value for provider_setup_required: {e}")
});
self
}
pub fn public_material<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<super::AccountPublicMaterial>>,
T::Error: ::std::fmt::Display,
{
self.public_material = value
.try_into()
.map_err(|e| format!("error converting supplied value for public_material: {e}"));
self
}
pub fn secret<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<super::AccountSecretInfo>>,
T::Error: ::std::fmt::Display,
{
self.secret = value
.try_into()
.map_err(|e| format!("error converting supplied value for secret: {e}"));
self
}
pub fn settings<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::AccountSettings>,
T::Error: ::std::fmt::Display,
{
self.settings = value
.try_into()
.map_err(|e| format!("error converting supplied value for settings: {e}"));
self
}
pub fn state<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::AccountState>,
T::Error: ::std::fmt::Display,
{
self.state = value
.try_into()
.map_err(|e| format!("error converting supplied value for state: {e}"));
self
}
pub fn updated_at<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::chrono::DateTime<::chrono::offset::Utc>>,
T::Error: ::std::fmt::Display,
{
self.updated_at = value
.try_into()
.map_err(|e| format!("error converting supplied value for updated_at: {e}"));
self
}
}
impl ::std::convert::TryFrom<ExternalAccount> for super::ExternalAccount {
type Error = super::error::ConversionError;
fn try_from(
value: ExternalAccount,
) -> ::std::result::Result<Self, super::error::ConversionError> {
Ok(Self {
bindings: value.bindings?,
context: value.context?,
created_at: value.created_at?,
egress_hosts: value.egress_hosts?,
id: value.id?,
label: value.label?,
last_probe: value.last_probe?,
provider_setup_required: value.provider_setup_required?,
public_material: value.public_material?,
secret: value.secret?,
settings: value.settings?,
state: value.state?,
updated_at: value.updated_at?,
})
}
}
impl ::std::convert::From<super::ExternalAccount> for ExternalAccount {
fn from(value: super::ExternalAccount) -> Self {
Self {
bindings: Ok(value.bindings),
context: Ok(value.context),
created_at: Ok(value.created_at),
egress_hosts: Ok(value.egress_hosts),
id: Ok(value.id),
label: Ok(value.label),
last_probe: Ok(value.last_probe),
provider_setup_required: Ok(value.provider_setup_required),
public_material: Ok(value.public_material),
secret: Ok(value.secret),
settings: Ok(value.settings),
state: Ok(value.state),
updated_at: Ok(value.updated_at),
}
}
}
#[derive(Clone, Debug)]
pub struct Payload {
context: ::std::result::Result<super::AccountContextId, ::std::string::String>,
ext: ::std::result::Result<::std::option::Option<super::Ext>, ::std::string::String>,
id: ::std::result::Result<super::AccountId, ::std::string::String>,
reason: ::std::result::Result<
::std::option::Option<super::PayloadReason>,
::std::string::String,
>,
}
impl ::std::default::Default for Payload {
fn default() -> Self {
Self {
context: Err("no value supplied for context".to_string()),
ext: Ok(Default::default()),
id: Err("no value supplied for id".to_string()),
reason: Ok(Default::default()),
}
}
}
impl Payload {
pub fn context<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::AccountContextId>,
T::Error: ::std::fmt::Display,
{
self.context = value
.try_into()
.map_err(|e| format!("error converting supplied value for context: {e}"));
self
}
pub fn ext<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<super::Ext>>,
T::Error: ::std::fmt::Display,
{
self.ext = value
.try_into()
.map_err(|e| format!("error converting supplied value for ext: {e}"));
self
}
pub fn id<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::AccountId>,
T::Error: ::std::fmt::Display,
{
self.id = value
.try_into()
.map_err(|e| format!("error converting supplied value for id: {e}"));
self
}
pub fn reason<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<super::PayloadReason>>,
T::Error: ::std::fmt::Display,
{
self.reason = value
.try_into()
.map_err(|e| format!("error converting supplied value for reason: {e}"));
self
}
}
impl ::std::convert::TryFrom<Payload> for super::Payload {
type Error = super::error::ConversionError;
fn try_from(value: Payload) -> ::std::result::Result<Self, super::error::ConversionError> {
Ok(Self {
context: value.context?,
ext: value.ext?,
id: value.id?,
reason: value.reason?,
})
}
}
impl ::std::convert::From<super::Payload> for Payload {
fn from(value: super::Payload) -> Self {
Self {
context: Ok(value.context),
ext: Ok(value.ext),
id: Ok(value.id),
reason: Ok(value.reason),
}
}
}
#[derive(Clone, Debug)]
pub struct Response {
account: ::std::result::Result<super::ExternalAccount, ::std::string::String>,
ext: ::std::result::Result<::std::option::Option<super::Ext>, ::std::string::String>,
}
impl ::std::default::Default for Response {
fn default() -> Self {
Self {
account: Err("no value supplied for account".to_string()),
ext: Ok(Default::default()),
}
}
}
impl Response {
pub fn account<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::ExternalAccount>,
T::Error: ::std::fmt::Display,
{
self.account = value
.try_into()
.map_err(|e| format!("error converting supplied value for account: {e}"));
self
}
pub fn ext<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<super::Ext>>,
T::Error: ::std::fmt::Display,
{
self.ext = value
.try_into()
.map_err(|e| format!("error converting supplied value for ext: {e}"));
self
}
}
impl ::std::convert::TryFrom<Response> for super::Response {
type Error = super::error::ConversionError;
fn try_from(value: Response) -> ::std::result::Result<Self, super::error::ConversionError> {
Ok(Self {
account: value.account?,
ext: value.ext?,
})
}
}
impl ::std::convert::From<super::Response> for Response {
fn from(value: super::Response) -> Self {
Self {
account: Ok(value.account),
ext: Ok(value.ext),
}
}
}
#[derive(Clone, Debug)]
pub struct SuiMoveCall {
function: ::std::result::Result<super::SuiMoveCallFunction, ::std::string::String>,
module: ::std::result::Result<super::SuiMoveCallModule, ::std::string::String>,
package: ::std::result::Result<super::SuiMoveCallPackage, ::std::string::String>,
}
impl ::std::default::Default for SuiMoveCall {
fn default() -> Self {
Self {
function: Err("no value supplied for function".to_string()),
module: Err("no value supplied for module".to_string()),
package: Err("no value supplied for package".to_string()),
}
}
}
impl SuiMoveCall {
pub fn function<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::SuiMoveCallFunction>,
T::Error: ::std::fmt::Display,
{
self.function = value
.try_into()
.map_err(|e| format!("error converting supplied value for function: {e}"));
self
}
pub fn module<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::SuiMoveCallModule>,
T::Error: ::std::fmt::Display,
{
self.module = value
.try_into()
.map_err(|e| format!("error converting supplied value for module: {e}"));
self
}
pub fn package<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::SuiMoveCallPackage>,
T::Error: ::std::fmt::Display,
{
self.package = value
.try_into()
.map_err(|e| format!("error converting supplied value for package: {e}"));
self
}
}
impl ::std::convert::TryFrom<SuiMoveCall> for super::SuiMoveCall {
type Error = super::error::ConversionError;
fn try_from(
value: SuiMoveCall,
) -> ::std::result::Result<Self, super::error::ConversionError> {
Ok(Self {
function: value.function?,
module: value.module?,
package: value.package?,
})
}
}
impl ::std::convert::From<super::SuiMoveCall> for SuiMoveCall {
fn from(value: super::SuiMoveCall) -> Self {
Self {
function: Ok(value.function),
module: Ok(value.module),
package: Ok(value.package),
}
}
}
}
impl crate::Payload for Payload {
const TYPE_URI: &'static str = "https://trusttasks.org/spec/external/accounts/restore/0.2";
const IS_PROOF_REQUIRED: bool = true;
const IS_ISSUED_AT_REQUIRED: bool = true;
const IS_RECIPIENT_REQUIRED: bool = true;
const PAYLOAD_SCHEMA: Option<&'static str> = Some(
"{\"$defs\":{\"AccountBinding\":{\"additionalProperties\":false,\"description\":\"Who may use an account, and how far. One binding per consumer per account. A binding is checked before anything is signed: the caller must be `consumer`, proven by the request's own proof; the request must sit inside `scopeCeiling`; its TTL must not exceed `maxTtlSeconds`; and the binding's rate must not be exhausted.\",\"properties\":{\"consumer\":{\"description\":\"The DID of the integration allowed to use the account.\",\"maxLength\":2048,\"minLength\":7,\"pattern\":\"^did:[a-z0-9]+:\\\\S+$\",\"type\":\"string\"},\"grantedAt\":{\"format\":\"date-time\",\"type\":\"string\"},\"maxTtlSeconds\":{\"description\":\"The longest credential lifetime the consumer may request. 900 (15 minutes) is RECOMMENDED; the ceiling is one hour.\",\"maximum\":3600,\"minimum\":60,\"type\":\"integer\"},\"ratePerMinute\":{\"description\":\"Issuances or signatures per minute for this binding.\",\"maximum\":600,\"minimum\":1,\"type\":\"integer\"},\"scopeCeiling\":{\"$ref\":\"#/$defs/CredentialScopeCeiling\",\"description\":\"Required for storage and OAuth models; absent for `sui-signer`, whose ceiling is the account's own allow-list and caps.\"},\"sourceCidrs\":{\"description\":\"Where the provider supports it (`aws:SourceIp`), issued credentials are pinned to these networks, so a credential lifted from the consumer is useless elsewhere.\",\"items\":{\"maxLength\":49,\"pattern\":\"^[0-9a-fA-F:.]+/[0-9]{1,3}$\",\"type\":\"string\"},\"maxItems\":16,\"type\":\"array\"}},\"required\":[\"consumer\",\"maxTtlSeconds\",\"ratePerMinute\"],\"title\":\"AccountBinding\",\"type\":\"object\"},\"AccountContextId\":{\"description\":\"The custodian context that owns the account. Act scope in this context decides who may manage the account and who may consume it; the account's keys are derived in this context's key space.\",\"maxLength\":256,\"minLength\":1,\"title\":\"AccountContextId\",\"type\":\"string\"},\"AccountId\":{\"description\":\"The account's identifier within its context, chosen by whoever creates it. Lowercase letters, digits and hyphens, so that it can be embedded in a certificate subject, a token subject or a provider-side condition without escaping. Unique per context; never reused after deletion while anything that names it (a provider-side trust policy, an audit row) may still exist.\",\"maxLength\":64,\"minLength\":1,\"pattern\":\"^[a-z0-9][a-z0-9-]*$\",\"title\":\"AccountId\",\"type\":\"string\"},\"AccountProbeReport\":{\"additionalProperties\":false,\"properties\":{\"complete\":{\"description\":\"True only when the canary steps (`put`, `get`, `delete`, or the model's equivalent) ran, so the account was exercised end to end. A probe that stopped after `exchange` because nothing named a canary prefix is `complete: false` even when `ok` is true, and does not clear `providerSetupRequired`.\",\"type\":\"boolean\"},\"ok\":{\"description\":\"True when every step that ran succeeded.\",\"type\":\"boolean\"},\"probedAt\":{\"format\":\"date-time\",\"type\":\"string\"},\"steps\":{\"description\":\"In order; the first failing step ends the probe.\",\"items\":{\"additionalProperties\":false,\"properties\":{\"durationMs\":{\"minimum\":0,\"type\":\"integer\"},\"ok\":{\"type\":\"boolean\"},\"providerError\":{\"description\":\"The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.\",\"maxLength\":2048,\"type\":\"string\"},\"providerRequestId\":{\"maxLength\":256,\"pattern\":\"^[!-~]+$\",\"type\":\"string\"},\"step\":{\"$ref\":\"#/$defs/AccountProbeStep\"}},\"required\":[\"step\",\"ok\"],\"type\":\"object\"},\"maxItems\":8,\"type\":\"array\"}},\"required\":[\"probedAt\",\"ok\",\"complete\",\"steps\"],\"title\":\"AccountProbeReport\",\"type\":\"object\"},\"AccountProbeStep\":{\"description\":\"`sign`: the custodian signed its assertion, session request or test transaction. `exchange`: the provider issued a credential for it. `put`, `get`, `delete`: one canary object at the narrowest scope of the account's bindings. `decode`: for `sui-signer`, a built test transaction passed the allow-list (it is never submitted).\",\"enum\":[\"sign\",\"exchange\",\"put\",\"get\",\"delete\",\"decode\"],\"title\":\"AccountProbeStep\",\"type\":\"string\"},\"AccountPublicMaterial\":{\"additionalProperties\":false,\"description\":\"The public half of the account's key, as the provider needs it. Never a private key.\",\"properties\":{\"address\":{\"description\":\"`sui-signer`: the Sui address the key controls.\",\"pattern\":\"^0x[0-9a-f]{64}$\",\"type\":\"string\"},\"algorithm\":{\"enum\":[\"ES256\",\"RS256\",\"Secp256r1\"],\"type\":\"string\"},\"certificatePem\":{\"description\":\"`aws-roles-anywhere`: the trust anchor's CA certificate. `azure-cert`: the certificate uploaded to the app registration.\",\"maxLength\":16384,\"pattern\":\"^-----BEGIN CERTIFICATE-----[A-Za-z0-9+/=\\\\r\\\\n]+-----END CERTIFICATE-----\\\\s*$\",\"type\":\"string\"},\"keyFingerprint\":{\"$ref\":\"#/$defs/DigestMultibase\",\"description\":\"Digest of the public key's SubjectPublicKeyInfo DER.\"},\"pendingKeyFingerprint\":{\"$ref\":\"#/$defs/DigestMultibase\",\"description\":\"During a rotation (external/accounts/keys/rotate), the staged successor key, until it is confirmed and the current key retires.\"},\"publicKeyJwk\":{\"additionalProperties\":false,\"description\":\"The public key as a JWK, with `kid`. Public members only: the schema admits no private member (`d`, `p`, `q`, `dp`, `dq`, `qi`), so a document carrying one fails validation.\",\"properties\":{\"alg\":{\"enum\":[\"ES256\",\"RS256\"],\"type\":\"string\"},\"crv\":{\"enum\":[\"P-256\"],\"type\":\"string\"},\"e\":{\"maxLength\":16,\"pattern\":\"^[A-Za-z0-9_-]+$\",\"type\":\"string\"},\"kid\":{\"maxLength\":128,\"pattern\":\"^[!-~]+$\",\"type\":\"string\"},\"kty\":{\"enum\":[\"EC\",\"RSA\"],\"type\":\"string\"},\"n\":{\"maxLength\":1024,\"pattern\":\"^[A-Za-z0-9_-]+$\",\"type\":\"string\"},\"use\":{\"const\":\"sig\",\"type\":\"string\"},\"x\":{\"maxLength\":1024,\"pattern\":\"^[A-Za-z0-9_-]+$\",\"type\":\"string\"},\"y\":{\"maxLength\":1024,\"pattern\":\"^[A-Za-z0-9_-]+$\",\"type\":\"string\"}},\"required\":[\"kty\",\"kid\"],\"type\":\"object\"}},\"required\":[\"algorithm\",\"keyFingerprint\"],\"title\":\"AccountPublicMaterial\",\"type\":\"object\"},\"AccountSecretInfo\":{\"additionalProperties\":false,\"description\":\"That a static model's secret is set, and which one. Never its value.\",\"properties\":{\"fingerprint\":{\"$ref\":\"#/$defs/SecretFingerprint\"},\"setAt\":{\"format\":\"date-time\",\"type\":\"string\"}},\"required\":[\"fingerprint\",\"setAt\"],\"title\":\"AccountSecretInfo\",\"type\":\"object\"},\"AccountSettings\":{\"description\":\"Per-model account settings, discriminated by `model`: every branch is an object whose `model` member is a `const`, which is what lets each generated binding emit a tagged union, so an unusable setting is answered as `external:invalidSettings` naming the member rather than as an unparseable payload. Never a secret: every value here is returned to anyone who may read the account. Branches are referred to by their `model` (\\\"the `sui-signer` settings\\\"). They carry no `title`, so that every binding renders each as a plain variant of this union.\",\"oneOf\":[{\"additionalProperties\":false,\"description\":\"Egress: `rolesanywhere.<region>.amazonaws.com`, plus `sts.<region>.amazonaws.com` when `chainedRoleArn` is set.\",\"properties\":{\"bucket\":{\"$ref\":\"#/$defs/ProviderBucketName\",\"description\":\"The S3 bucket issuances are scoped within. Required for an account whose bindings issue storage scopes.\"},\"chainedRoleArn\":{\"$ref\":\"#/$defs/AwsArn\",\"description\":\"When set, every issuance chains an AssumeRole into this role carrying the downscoping session policy, for deployments whose Roles Anywhere profile cannot carry one per request. Caps a credential at one hour.\"},\"model\":{\"const\":\"aws-roles-anywhere\",\"type\":\"string\"},\"probePrefix\":{\"$ref\":\"#/$defs/ProviderObjectPrefix\",\"description\":\"Where external/accounts/probe writes its canary when no binding names a narrower prefix. Lets a new account be probed before anything is bound to it. Absent, a probe of an account with no bindings stops after `exchange` and reports `complete: false`.\"},\"profileArn\":{\"$ref\":\"#/$defs/AwsArn\"},\"region\":{\"$ref\":\"#/$defs/AwsRegion\"},\"roleArn\":{\"$ref\":\"#/$defs/AwsArn\"},\"trustAnchorArn\":{\"$ref\":\"#/$defs/AwsArn\",\"description\":\"The trust anchor holding the custodian's CA certificate. Recorded after the administrator creates it from external/accounts/setup.\"}},\"required\":[\"model\",\"region\",\"profileArn\",\"roleArn\",\"trustAnchorArn\"],\"type\":\"object\"},{\"additionalProperties\":false,\"description\":\"Egress: `sts.googleapis.com`, plus `iamcredentials.googleapis.com` when `serviceAccount` is set.\",\"properties\":{\"bucket\":{\"$ref\":\"#/$defs/ProviderBucketName\",\"description\":\"The GCS bucket issuances are scoped within, by a Credential Access Boundary.\"},\"model\":{\"const\":\"gcp-wif-pinned\",\"type\":\"string\"},\"poolId\":{\"pattern\":\"^[a-z0-9-]{4,32}$\",\"type\":\"string\"},\"probePrefix\":{\"$ref\":\"#/$defs/ProviderObjectPrefix\",\"description\":\"Where external/accounts/probe writes its canary when no binding names a narrower prefix. Lets a new account be probed before anything is bound to it. Absent, a probe of an account with no bindings stops after `exchange` and reports `complete: false`.\"},\"projectNumber\":{\"pattern\":\"^[0-9]{1,20}$\",\"type\":\"string\"},\"providerId\":{\"pattern\":\"^[a-z0-9-]{4,32}$\",\"type\":\"string\"},\"serviceAccount\":{\"description\":\"When set, the federated token is exchanged for this service account's access token.\",\"maxLength\":254,\"pattern\":\"^[a-z0-9-]+@[a-z0-9-]+\\\\.iam\\\\.gserviceaccount\\\\.com$\",\"type\":\"string\"},\"signingAlgorithm\":{\"description\":\"The ID-token algorithm. ES256 unless the provider refuses it. Absent means ES256.\",\"enum\":[\"ES256\",\"RS256\"],\"type\":\"string\"}},\"required\":[\"model\",\"projectNumber\",\"poolId\",\"providerId\"],\"type\":\"object\"},{\"additionalProperties\":false,\"description\":\"Egress: `login.microsoftonline.com`, or the sovereign-cloud authority named in `authorityHost`.\",\"properties\":{\"authorityHost\":{\"description\":\"Absent means `login.microsoftonline.com`.\",\"maxLength\":253,\"pattern\":\"^[a-z0-9.-]+$\",\"type\":\"string\"},\"clientId\":{\"pattern\":\"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$\",\"type\":\"string\"},\"model\":{\"const\":\"azure-cert\",\"type\":\"string\"},\"tenantId\":{\"pattern\":\"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$\",\"type\":\"string\"},\"tokenScope\":{\"description\":\"The `scope` requested at the token endpoint, such as `https://storage.azure.com/.default`.\",\"maxLength\":512,\"pattern\":\"^[A-Za-z0-9:/._-]+$\",\"type\":\"string\"}},\"required\":[\"model\",\"tenantId\",\"clientId\",\"tokenScope\"],\"type\":\"object\"},{\"additionalProperties\":false,\"description\":\"Egress: the host of `tokenEndpoint`, and nothing else.\",\"properties\":{\"audience\":{\"description\":\"The assertion's `aud`. Absent means `tokenEndpoint`.\",\"maxLength\":2048,\"pattern\":\"^[!-~]+$\",\"type\":\"string\"},\"clientId\":{\"maxLength\":512,\"minLength\":1,\"pattern\":\"^[!-~]+$\",\"type\":\"string\"},\"model\":{\"const\":\"oauth2-private-key-jwt\",\"type\":\"string\"},\"scopes\":{\"description\":\"The scopes a binding may request, the ceiling for every issuance.\",\"items\":{\"maxLength\":256,\"pattern\":\"^[!#-\\\\[\\\\]-~]+$\",\"type\":\"string\"},\"maxItems\":64,\"type\":\"array\",\"uniqueItems\":true},\"signingAlgorithm\":{\"enum\":[\"ES256\",\"RS256\"],\"type\":\"string\"},\"tokenEndpoint\":{\"$ref\":\"#/$defs/ProviderHttpsUrl\"}},\"required\":[\"model\",\"tokenEndpoint\",\"clientId\"],\"type\":\"object\"},{\"additionalProperties\":false,\"description\":\"Issuance needs no egress: presigning is a computation inside the custodian, and the consumer uses the URL itself. The probe connects to the host of `endpoint`, which `egressHosts` therefore lists.\",\"properties\":{\"accessKeyId\":{\"description\":\"The access key's identifier. Not a secret: it appears in every presigned URL. The secret half is set with external/accounts/secret/set and never returned.\",\"maxLength\":128,\"pattern\":\"^[A-Za-z0-9]+$\",\"type\":\"string\"},\"bucket\":{\"$ref\":\"#/$defs/ProviderBucketName\"},\"endpoint\":{\"$ref\":\"#/$defs/ProviderHttpsUrl\"},\"model\":{\"const\":\"s3-static-presign\",\"type\":\"string\"},\"pathStyle\":{\"description\":\"Address the bucket in the path rather than the host name, as MinIO usually needs.\",\"type\":\"boolean\"},\"probePrefix\":{\"$ref\":\"#/$defs/ProviderObjectPrefix\",\"description\":\"Where external/accounts/probe writes its canary when no binding names a narrower prefix. Lets a new account be probed before anything is bound to it. Absent, a probe of an account with no bindings stops after `exchange` and reports `complete: false`.\"},\"region\":{\"description\":\"The SigV4 signing region; `auto` for Cloudflare R2.\",\"maxLength\":64,\"pattern\":\"^[a-z0-9-]+$\",\"type\":\"string\"}},\"required\":[\"model\",\"endpoint\",\"region\",\"bucket\",\"accessKeyId\"],\"type\":\"object\"},{\"additionalProperties\":false,\"description\":\"No egress: the custodian signs and the consumer submits the transaction. The allow-list, the gas caps and the coin caps are the account's whole authority; a transaction outside them is refused before anything is signed.\",\"properties\":{\"allowedCalls\":{\"description\":\"Every MoveCall command in a signed transaction must name one of these. For Walrus storage: the system package's `register_blob`, `certify_blob`, `extend_blob` and `delete_blob`, and the coin calls needed to pay for them.\",\"items\":{\"$ref\":\"#/$defs/SuiMoveCall\"},\"maxItems\":32,\"minItems\":1,\"type\":\"array\"},\"allowedObjects\":{\"description\":\"Shared objects a transaction may take as input, such as the Walrus system and staking objects. Absent means any object the allowed calls accept.\",\"items\":{\"pattern\":\"^0x[0-9a-f]{64}$\",\"type\":\"string\"},\"maxItems\":32,\"type\":\"array\"},\"maxCoinOutPerTx\":{\"description\":\"Per coin type, the most a single transaction may spend or transfer out of the account's address, in the coin's smallest unit. A coin type not listed may not leave the address at all.\",\"items\":{\"additionalProperties\":false,\"properties\":{\"amount\":{\"minimum\":0,\"type\":\"integer\"},\"coinType\":{\"maxLength\":512,\"pattern\":\"^0x[0-9a-f]{1,64}::[A-Za-z0-9_]+::[A-Za-z0-9_]+$\",\"type\":\"string\"}},\"required\":[\"coinType\",\"amount\"],\"type\":\"object\"},\"maxItems\":8,\"type\":\"array\"},\"maxGasBudgetMist\":{\"description\":\"The largest gas budget one transaction may declare.\",\"minimum\":1,\"type\":\"integer\"},\"maxGasPerDayMist\":{\"description\":\"The total gas budget signed per rolling 24 hours.\",\"minimum\":1,\"type\":\"integer\"},\"model\":{\"const\":\"sui-signer\",\"type\":\"string\"},\"network\":{\"enum\":[\"mainnet\",\"testnet\",\"devnet\"],\"type\":\"string\"}},\"required\":[\"model\",\"network\",\"allowedCalls\",\"maxGasBudgetMist\",\"maxGasPerDayMist\"],\"type\":\"object\"},{\"additionalProperties\":false,\"description\":\"Egress: the host of `baseUrl`. The secret is set with external/accounts/secret/set and used only inside the custodian by `driver`; a provider reachable only by handing the consumer the raw key is not supported.\",\"properties\":{\"baseUrl\":{\"$ref\":\"#/$defs/ProviderHttpsUrl\"},\"driver\":{\"description\":\"The custodian's driver that uses the secret: performs a login or token exchange and returns a short-lived result. A custodian refuses a driver it does not implement.\",\"maxLength\":64,\"pattern\":\"^[a-z0-9][a-z0-9-]*$\",\"type\":\"string\"},\"model\":{\"const\":\"static-secret\",\"type\":\"string\"}},\"required\":[\"model\",\"driver\",\"baseUrl\"],\"type\":\"object\"}],\"title\":\"AccountSettings\"},\"AccountState\":{\"description\":\"`active`: usable by its bindings. `suspended`: every issuance and signature is refused at once; management reads continue; resumable. `archived`: hidden from default listings, refused for use, restorable. Deletion removes the record.\",\"enum\":[\"active\",\"suspended\",\"archived\"],\"title\":\"AccountState\",\"type\":\"string\"},\"AwsArn\":{\"maxLength\":2048,\"pattern\":\"^arn:aws[a-z-]*:[a-z0-9-]+:[a-z0-9-]*:[0-9]{0,12}:[A-Za-z0-9+=,.@_/:-]+$\",\"title\":\"AwsArn\",\"type\":\"string\"},\"AwsRegion\":{\"maxLength\":32,\"pattern\":\"^[a-z]{2}(-gov)?-[a-z]+-[0-9]$\",\"title\":\"AwsRegion\",\"type\":\"string\"},\"CredentialScopeCeiling\":{\"additionalProperties\":false,\"description\":\"The widest scope a binding's consumer may request. An issuance is inside the ceiling when its `prefix` begins with one of `prefixes`, every one of its `actions` is in `actions`, and every one of its `scopes` is in `scopes`. Absent members confer nothing: a ceiling with no `prefixes` permits no storage issuance.\",\"properties\":{\"actions\":{\"items\":{\"$ref\":\"#/$defs/ProviderObjectAction\"},\"maxItems\":3,\"minItems\":1,\"type\":\"array\",\"uniqueItems\":true},\"prefixes\":{\"items\":{\"$ref\":\"#/$defs/ProviderObjectPrefix\"},\"maxItems\":64,\"minItems\":1,\"type\":\"array\",\"uniqueItems\":true},\"scopes\":{\"items\":{\"maxLength\":256,\"pattern\":\"^[!#-\\\\[\\\\]-~]+$\",\"type\":\"string\"},\"maxItems\":64,\"type\":\"array\",\"uniqueItems\":true}},\"title\":\"CredentialScopeCeiling\",\"type\":\"object\"},\"DigestMultibase\":{\"description\":\"A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.\\n\\nMultihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.\\n\\nThis definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.\\n\\nRestricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that \\\"interoperability is not guaranteed between implementations using such values\\\", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.\",\"examples\":[\"zQmbWqxBEKC3P8tqsKc98xmWNzrzDtRLMiMPL8wBuTGsMnR\"],\"minLength\":16,\"pattern\":\"^(z[1-9A-HJ-NP-Za-km-z]+|u[A-Za-z0-9_-]+)$\",\"title\":\"DigestMultibase\",\"type\":\"string\"},\"Ext\":{\"additionalProperties\":true,\"description\":\"Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.\",\"minProperties\":1,\"propertyNames\":{\"pattern\":\"^[a-z][a-z0-9-]*(\\\\.[a-z0-9-]+)+$\"},\"title\":\"Ext\",\"type\":\"object\"},\"ExternalAccount\":{\"additionalProperties\":false,\"description\":\"An account as every read returns it. Contains no private key, no secret and no issued credential, to any reader.\",\"properties\":{\"bindings\":{\"items\":{\"$ref\":\"#/$defs/AccountBinding\"},\"maxItems\":256,\"type\":\"array\"},\"context\":{\"$ref\":\"#/$defs/AccountContextId\"},\"createdAt\":{\"format\":\"date-time\",\"type\":\"string\"},\"egressHosts\":{\"description\":\"The provider hosts the custodian connects to on this account's behalf, derived by the custodian from its settings: the token or session endpoints issuance uses, and the destinations external/accounts/probe dials (the object store's host, for a storage model). The custodian MUST NOT connect anywhere else on the account's behalf, so an egress proxy can allow exactly this set. Empty only for a model that neither exchanges nor probes over the network.\",\"items\":{\"maxLength\":253,\"pattern\":\"^[a-z0-9.-]+$\",\"type\":\"string\"},\"maxItems\":8,\"type\":\"array\"},\"id\":{\"$ref\":\"#/$defs/AccountId\"},\"label\":{\"description\":\"Display name. Untrusted text: render it, never interpret it.\",\"maxLength\":128,\"minLength\":1,\"type\":\"string\"},\"lastProbe\":{\"$ref\":\"#/$defs/AccountProbeReport\"},\"providerSetupRequired\":{\"description\":\"True when the account cannot be used until its provider-side setup is redone: after a restore that could not carry its key or secret (a wrapped RSA key, a static secret), or after a rotation awaiting confirmation.\",\"type\":\"boolean\"},\"publicMaterial\":{\"$ref\":\"#/$defs/AccountPublicMaterial\",\"description\":\"Absent for the static models, which hold a secret rather than a key.\"},\"secret\":{\"$ref\":\"#/$defs/AccountSecretInfo\",\"description\":\"Static models only; absent until the secret is set.\"},\"settings\":{\"$ref\":\"#/$defs/AccountSettings\"},\"state\":{\"$ref\":\"#/$defs/AccountState\"},\"updatedAt\":{\"format\":\"date-time\",\"type\":\"string\"}},\"required\":[\"id\",\"label\",\"context\",\"settings\",\"state\",\"bindings\",\"egressHosts\",\"providerSetupRequired\",\"createdAt\",\"updatedAt\"],\"title\":\"ExternalAccount\",\"type\":\"object\"},\"ProviderBucketName\":{\"description\":\"A bucket name as S3 and GCS accept it. Validated rather than free so that it can be placed in a provider policy without escaping.\",\"maxLength\":63,\"minLength\":3,\"pattern\":\"^[a-z0-9][a-z0-9.-]*[a-z0-9]$\",\"title\":\"ProviderBucketName\",\"type\":\"string\"},\"ProviderHttpsUrl\":{\"format\":\"uri\",\"maxLength\":2048,\"pattern\":\"^https://[^\\\\s\\\"'\\\\\\\\]+$\",\"title\":\"ProviderHttpsUrl\",\"type\":\"string\"},\"ProviderObjectAction\":{\"description\":\"`put`: write an object. `get`: read one. `delete`: remove one. No list, ACL, policy or bucket-level action exists here, so none can be granted.\",\"enum\":[\"put\",\"get\",\"delete\"],\"title\":\"ProviderObjectAction\",\"type\":\"string\"},\"ProviderObjectPrefix\":{\"description\":\"An object-key prefix within the account's bucket: one or more segments of lowercase letters, digits, `.`, `_` and `-`, each beginning with a letter or digit and ending with `/`. No quote, backslash, wildcard, whitespace, `..` segment or empty segment can appear. That is deliberate: the custodian places this value inside a provider policy — an IAM session policy (JSON), a GCS Credential Access Boundary condition (CEL) — and a value able to carry a metacharacter can break out of the string it is placed in and widen the policy. That is a known class of defect (CVE-2026-42811, a CEL injection in downscoped GCS credentials). Even with this pattern, a custodian MUST build provider policies with the provider language's own encoder, never by string interpolation.\",\"maxLength\":512,\"minLength\":2,\"pattern\":\"^([a-z0-9][a-z0-9._-]{0,127}/){1,16}$\",\"title\":\"ProviderObjectPrefix\",\"type\":\"string\"},\"Response\":{\"$anchor\":\"response\",\"additionalProperties\":false,\"properties\":{\"account\":{\"$ref\":\"#/$defs/ExternalAccount\"},\"ext\":{\"$ref\":\"#/$defs/Ext\"}},\"required\":[\"account\"],\"title\":\"External Accounts — Restore — response payload\",\"type\":\"object\"},\"SecretFingerprint\":{\"description\":\"Which secret is set, without being a way to test guesses at it. `hmacsha256:` followed by the base64url encoding, without padding, of the first 16 bytes of HMAC-SHA256 over the secret's bytes under a fingerprint key the custodian holds and never discloses. Comparable only between fingerprints made by the same custodian: a re-entered value can be confirmed, while the same secret at two custodians gives unrelated fingerprints. Never a bare hash of the secret, which would let anyone who reads it run a dictionary against it offline; and deliberately not a DigestMultibase, since multihash has no code for a keyed digest.\",\"maxLength\":33,\"pattern\":\"^hmacsha256:[A-Za-z0-9_-]{22}$\",\"title\":\"SecretFingerprint\",\"type\":\"string\"},\"SuiMoveCall\":{\"additionalProperties\":false,\"description\":\"One Move function an account's transactions may call.\",\"properties\":{\"function\":{\"pattern\":\"^[A-Za-z][A-Za-z0-9_]{0,127}$\",\"type\":\"string\"},\"module\":{\"pattern\":\"^[A-Za-z][A-Za-z0-9_]{0,127}$\",\"type\":\"string\"},\"package\":{\"pattern\":\"^0x[0-9a-f]{64}$\",\"type\":\"string\"}},\"required\":[\"package\",\"module\",\"function\"],\"title\":\"SuiMoveCall\",\"type\":\"object\"}},\"$id\":\"https://trusttasks.org/spec/external/accounts/restore/0.2\",\"$schema\":\"https://json-schema.org/draft/2020-12/schema\",\"additionalProperties\":false,\"description\":\"A manager restores an archived external account to `suspended`, from which resuming it is a separate, consented step. The outer document members are owned by the framework — SPEC §6.3.\",\"properties\":{\"context\":{\"$ref\":\"#/$defs/AccountContextId\"},\"ext\":{\"$ref\":\"#/$defs/Ext\"},\"id\":{\"$ref\":\"#/$defs/AccountId\"},\"reason\":{\"description\":\"Why, in the requester's words. Recorded in the audit row. Untrusted text: displayed, never interpreted.\",\"maxLength\":500,\"type\":\"string\"}},\"required\":[\"context\",\"id\"],\"title\":\"External Accounts — Restore — payload\",\"type\":\"object\"}\n",
);
}
impl crate::Payload for Response {
const TYPE_URI: &'static str =
"https://trusttasks.org/spec/external/accounts/restore/0.2#response";
const IS_PROOF_REQUIRED: bool = true;
const IS_ISSUED_AT_REQUIRED: bool = true;
const IS_RECIPIENT_REQUIRED: bool = true;
const PAYLOAD_SCHEMA: Option<&'static str> = Some(
"{\"$defs\":{\"AccountBinding\":{\"additionalProperties\":false,\"description\":\"Who may use an account, and how far. One binding per consumer per account. A binding is checked before anything is signed: the caller must be `consumer`, proven by the request's own proof; the request must sit inside `scopeCeiling`; its TTL must not exceed `maxTtlSeconds`; and the binding's rate must not be exhausted.\",\"properties\":{\"consumer\":{\"description\":\"The DID of the integration allowed to use the account.\",\"maxLength\":2048,\"minLength\":7,\"pattern\":\"^did:[a-z0-9]+:\\\\S+$\",\"type\":\"string\"},\"grantedAt\":{\"format\":\"date-time\",\"type\":\"string\"},\"maxTtlSeconds\":{\"description\":\"The longest credential lifetime the consumer may request. 900 (15 minutes) is RECOMMENDED; the ceiling is one hour.\",\"maximum\":3600,\"minimum\":60,\"type\":\"integer\"},\"ratePerMinute\":{\"description\":\"Issuances or signatures per minute for this binding.\",\"maximum\":600,\"minimum\":1,\"type\":\"integer\"},\"scopeCeiling\":{\"$ref\":\"#/$defs/CredentialScopeCeiling\",\"description\":\"Required for storage and OAuth models; absent for `sui-signer`, whose ceiling is the account's own allow-list and caps.\"},\"sourceCidrs\":{\"description\":\"Where the provider supports it (`aws:SourceIp`), issued credentials are pinned to these networks, so a credential lifted from the consumer is useless elsewhere.\",\"items\":{\"maxLength\":49,\"pattern\":\"^[0-9a-fA-F:.]+/[0-9]{1,3}$\",\"type\":\"string\"},\"maxItems\":16,\"type\":\"array\"}},\"required\":[\"consumer\",\"maxTtlSeconds\",\"ratePerMinute\"],\"title\":\"AccountBinding\",\"type\":\"object\"},\"AccountContextId\":{\"description\":\"The custodian context that owns the account. Act scope in this context decides who may manage the account and who may consume it; the account's keys are derived in this context's key space.\",\"maxLength\":256,\"minLength\":1,\"title\":\"AccountContextId\",\"type\":\"string\"},\"AccountId\":{\"description\":\"The account's identifier within its context, chosen by whoever creates it. Lowercase letters, digits and hyphens, so that it can be embedded in a certificate subject, a token subject or a provider-side condition without escaping. Unique per context; never reused after deletion while anything that names it (a provider-side trust policy, an audit row) may still exist.\",\"maxLength\":64,\"minLength\":1,\"pattern\":\"^[a-z0-9][a-z0-9-]*$\",\"title\":\"AccountId\",\"type\":\"string\"},\"AccountProbeReport\":{\"additionalProperties\":false,\"properties\":{\"complete\":{\"description\":\"True only when the canary steps (`put`, `get`, `delete`, or the model's equivalent) ran, so the account was exercised end to end. A probe that stopped after `exchange` because nothing named a canary prefix is `complete: false` even when `ok` is true, and does not clear `providerSetupRequired`.\",\"type\":\"boolean\"},\"ok\":{\"description\":\"True when every step that ran succeeded.\",\"type\":\"boolean\"},\"probedAt\":{\"format\":\"date-time\",\"type\":\"string\"},\"steps\":{\"description\":\"In order; the first failing step ends the probe.\",\"items\":{\"additionalProperties\":false,\"properties\":{\"durationMs\":{\"minimum\":0,\"type\":\"integer\"},\"ok\":{\"type\":\"boolean\"},\"providerError\":{\"description\":\"The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.\",\"maxLength\":2048,\"type\":\"string\"},\"providerRequestId\":{\"maxLength\":256,\"pattern\":\"^[!-~]+$\",\"type\":\"string\"},\"step\":{\"$ref\":\"#/$defs/AccountProbeStep\"}},\"required\":[\"step\",\"ok\"],\"type\":\"object\"},\"maxItems\":8,\"type\":\"array\"}},\"required\":[\"probedAt\",\"ok\",\"complete\",\"steps\"],\"title\":\"AccountProbeReport\",\"type\":\"object\"},\"AccountProbeStep\":{\"description\":\"`sign`: the custodian signed its assertion, session request or test transaction. `exchange`: the provider issued a credential for it. `put`, `get`, `delete`: one canary object at the narrowest scope of the account's bindings. `decode`: for `sui-signer`, a built test transaction passed the allow-list (it is never submitted).\",\"enum\":[\"sign\",\"exchange\",\"put\",\"get\",\"delete\",\"decode\"],\"title\":\"AccountProbeStep\",\"type\":\"string\"},\"AccountPublicMaterial\":{\"additionalProperties\":false,\"description\":\"The public half of the account's key, as the provider needs it. Never a private key.\",\"properties\":{\"address\":{\"description\":\"`sui-signer`: the Sui address the key controls.\",\"pattern\":\"^0x[0-9a-f]{64}$\",\"type\":\"string\"},\"algorithm\":{\"enum\":[\"ES256\",\"RS256\",\"Secp256r1\"],\"type\":\"string\"},\"certificatePem\":{\"description\":\"`aws-roles-anywhere`: the trust anchor's CA certificate. `azure-cert`: the certificate uploaded to the app registration.\",\"maxLength\":16384,\"pattern\":\"^-----BEGIN CERTIFICATE-----[A-Za-z0-9+/=\\\\r\\\\n]+-----END CERTIFICATE-----\\\\s*$\",\"type\":\"string\"},\"keyFingerprint\":{\"$ref\":\"#/$defs/DigestMultibase\",\"description\":\"Digest of the public key's SubjectPublicKeyInfo DER.\"},\"pendingKeyFingerprint\":{\"$ref\":\"#/$defs/DigestMultibase\",\"description\":\"During a rotation (external/accounts/keys/rotate), the staged successor key, until it is confirmed and the current key retires.\"},\"publicKeyJwk\":{\"additionalProperties\":false,\"description\":\"The public key as a JWK, with `kid`. Public members only: the schema admits no private member (`d`, `p`, `q`, `dp`, `dq`, `qi`), so a document carrying one fails validation.\",\"properties\":{\"alg\":{\"enum\":[\"ES256\",\"RS256\"],\"type\":\"string\"},\"crv\":{\"enum\":[\"P-256\"],\"type\":\"string\"},\"e\":{\"maxLength\":16,\"pattern\":\"^[A-Za-z0-9_-]+$\",\"type\":\"string\"},\"kid\":{\"maxLength\":128,\"pattern\":\"^[!-~]+$\",\"type\":\"string\"},\"kty\":{\"enum\":[\"EC\",\"RSA\"],\"type\":\"string\"},\"n\":{\"maxLength\":1024,\"pattern\":\"^[A-Za-z0-9_-]+$\",\"type\":\"string\"},\"use\":{\"const\":\"sig\",\"type\":\"string\"},\"x\":{\"maxLength\":1024,\"pattern\":\"^[A-Za-z0-9_-]+$\",\"type\":\"string\"},\"y\":{\"maxLength\":1024,\"pattern\":\"^[A-Za-z0-9_-]+$\",\"type\":\"string\"}},\"required\":[\"kty\",\"kid\"],\"type\":\"object\"}},\"required\":[\"algorithm\",\"keyFingerprint\"],\"title\":\"AccountPublicMaterial\",\"type\":\"object\"},\"AccountSecretInfo\":{\"additionalProperties\":false,\"description\":\"That a static model's secret is set, and which one. Never its value.\",\"properties\":{\"fingerprint\":{\"$ref\":\"#/$defs/SecretFingerprint\"},\"setAt\":{\"format\":\"date-time\",\"type\":\"string\"}},\"required\":[\"fingerprint\",\"setAt\"],\"title\":\"AccountSecretInfo\",\"type\":\"object\"},\"AccountSettings\":{\"description\":\"Per-model account settings, discriminated by `model`: every branch is an object whose `model` member is a `const`, which is what lets each generated binding emit a tagged union, so an unusable setting is answered as `external:invalidSettings` naming the member rather than as an unparseable payload. Never a secret: every value here is returned to anyone who may read the account. Branches are referred to by their `model` (\\\"the `sui-signer` settings\\\"). They carry no `title`, so that every binding renders each as a plain variant of this union.\",\"oneOf\":[{\"additionalProperties\":false,\"description\":\"Egress: `rolesanywhere.<region>.amazonaws.com`, plus `sts.<region>.amazonaws.com` when `chainedRoleArn` is set.\",\"properties\":{\"bucket\":{\"$ref\":\"#/$defs/ProviderBucketName\",\"description\":\"The S3 bucket issuances are scoped within. Required for an account whose bindings issue storage scopes.\"},\"chainedRoleArn\":{\"$ref\":\"#/$defs/AwsArn\",\"description\":\"When set, every issuance chains an AssumeRole into this role carrying the downscoping session policy, for deployments whose Roles Anywhere profile cannot carry one per request. Caps a credential at one hour.\"},\"model\":{\"const\":\"aws-roles-anywhere\",\"type\":\"string\"},\"probePrefix\":{\"$ref\":\"#/$defs/ProviderObjectPrefix\",\"description\":\"Where external/accounts/probe writes its canary when no binding names a narrower prefix. Lets a new account be probed before anything is bound to it. Absent, a probe of an account with no bindings stops after `exchange` and reports `complete: false`.\"},\"profileArn\":{\"$ref\":\"#/$defs/AwsArn\"},\"region\":{\"$ref\":\"#/$defs/AwsRegion\"},\"roleArn\":{\"$ref\":\"#/$defs/AwsArn\"},\"trustAnchorArn\":{\"$ref\":\"#/$defs/AwsArn\",\"description\":\"The trust anchor holding the custodian's CA certificate. Recorded after the administrator creates it from external/accounts/setup.\"}},\"required\":[\"model\",\"region\",\"profileArn\",\"roleArn\",\"trustAnchorArn\"],\"type\":\"object\"},{\"additionalProperties\":false,\"description\":\"Egress: `sts.googleapis.com`, plus `iamcredentials.googleapis.com` when `serviceAccount` is set.\",\"properties\":{\"bucket\":{\"$ref\":\"#/$defs/ProviderBucketName\",\"description\":\"The GCS bucket issuances are scoped within, by a Credential Access Boundary.\"},\"model\":{\"const\":\"gcp-wif-pinned\",\"type\":\"string\"},\"poolId\":{\"pattern\":\"^[a-z0-9-]{4,32}$\",\"type\":\"string\"},\"probePrefix\":{\"$ref\":\"#/$defs/ProviderObjectPrefix\",\"description\":\"Where external/accounts/probe writes its canary when no binding names a narrower prefix. Lets a new account be probed before anything is bound to it. Absent, a probe of an account with no bindings stops after `exchange` and reports `complete: false`.\"},\"projectNumber\":{\"pattern\":\"^[0-9]{1,20}$\",\"type\":\"string\"},\"providerId\":{\"pattern\":\"^[a-z0-9-]{4,32}$\",\"type\":\"string\"},\"serviceAccount\":{\"description\":\"When set, the federated token is exchanged for this service account's access token.\",\"maxLength\":254,\"pattern\":\"^[a-z0-9-]+@[a-z0-9-]+\\\\.iam\\\\.gserviceaccount\\\\.com$\",\"type\":\"string\"},\"signingAlgorithm\":{\"description\":\"The ID-token algorithm. ES256 unless the provider refuses it. Absent means ES256.\",\"enum\":[\"ES256\",\"RS256\"],\"type\":\"string\"}},\"required\":[\"model\",\"projectNumber\",\"poolId\",\"providerId\"],\"type\":\"object\"},{\"additionalProperties\":false,\"description\":\"Egress: `login.microsoftonline.com`, or the sovereign-cloud authority named in `authorityHost`.\",\"properties\":{\"authorityHost\":{\"description\":\"Absent means `login.microsoftonline.com`.\",\"maxLength\":253,\"pattern\":\"^[a-z0-9.-]+$\",\"type\":\"string\"},\"clientId\":{\"pattern\":\"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$\",\"type\":\"string\"},\"model\":{\"const\":\"azure-cert\",\"type\":\"string\"},\"tenantId\":{\"pattern\":\"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$\",\"type\":\"string\"},\"tokenScope\":{\"description\":\"The `scope` requested at the token endpoint, such as `https://storage.azure.com/.default`.\",\"maxLength\":512,\"pattern\":\"^[A-Za-z0-9:/._-]+$\",\"type\":\"string\"}},\"required\":[\"model\",\"tenantId\",\"clientId\",\"tokenScope\"],\"type\":\"object\"},{\"additionalProperties\":false,\"description\":\"Egress: the host of `tokenEndpoint`, and nothing else.\",\"properties\":{\"audience\":{\"description\":\"The assertion's `aud`. Absent means `tokenEndpoint`.\",\"maxLength\":2048,\"pattern\":\"^[!-~]+$\",\"type\":\"string\"},\"clientId\":{\"maxLength\":512,\"minLength\":1,\"pattern\":\"^[!-~]+$\",\"type\":\"string\"},\"model\":{\"const\":\"oauth2-private-key-jwt\",\"type\":\"string\"},\"scopes\":{\"description\":\"The scopes a binding may request, the ceiling for every issuance.\",\"items\":{\"maxLength\":256,\"pattern\":\"^[!#-\\\\[\\\\]-~]+$\",\"type\":\"string\"},\"maxItems\":64,\"type\":\"array\",\"uniqueItems\":true},\"signingAlgorithm\":{\"enum\":[\"ES256\",\"RS256\"],\"type\":\"string\"},\"tokenEndpoint\":{\"$ref\":\"#/$defs/ProviderHttpsUrl\"}},\"required\":[\"model\",\"tokenEndpoint\",\"clientId\"],\"type\":\"object\"},{\"additionalProperties\":false,\"description\":\"Issuance needs no egress: presigning is a computation inside the custodian, and the consumer uses the URL itself. The probe connects to the host of `endpoint`, which `egressHosts` therefore lists.\",\"properties\":{\"accessKeyId\":{\"description\":\"The access key's identifier. Not a secret: it appears in every presigned URL. The secret half is set with external/accounts/secret/set and never returned.\",\"maxLength\":128,\"pattern\":\"^[A-Za-z0-9]+$\",\"type\":\"string\"},\"bucket\":{\"$ref\":\"#/$defs/ProviderBucketName\"},\"endpoint\":{\"$ref\":\"#/$defs/ProviderHttpsUrl\"},\"model\":{\"const\":\"s3-static-presign\",\"type\":\"string\"},\"pathStyle\":{\"description\":\"Address the bucket in the path rather than the host name, as MinIO usually needs.\",\"type\":\"boolean\"},\"probePrefix\":{\"$ref\":\"#/$defs/ProviderObjectPrefix\",\"description\":\"Where external/accounts/probe writes its canary when no binding names a narrower prefix. Lets a new account be probed before anything is bound to it. Absent, a probe of an account with no bindings stops after `exchange` and reports `complete: false`.\"},\"region\":{\"description\":\"The SigV4 signing region; `auto` for Cloudflare R2.\",\"maxLength\":64,\"pattern\":\"^[a-z0-9-]+$\",\"type\":\"string\"}},\"required\":[\"model\",\"endpoint\",\"region\",\"bucket\",\"accessKeyId\"],\"type\":\"object\"},{\"additionalProperties\":false,\"description\":\"No egress: the custodian signs and the consumer submits the transaction. The allow-list, the gas caps and the coin caps are the account's whole authority; a transaction outside them is refused before anything is signed.\",\"properties\":{\"allowedCalls\":{\"description\":\"Every MoveCall command in a signed transaction must name one of these. For Walrus storage: the system package's `register_blob`, `certify_blob`, `extend_blob` and `delete_blob`, and the coin calls needed to pay for them.\",\"items\":{\"$ref\":\"#/$defs/SuiMoveCall\"},\"maxItems\":32,\"minItems\":1,\"type\":\"array\"},\"allowedObjects\":{\"description\":\"Shared objects a transaction may take as input, such as the Walrus system and staking objects. Absent means any object the allowed calls accept.\",\"items\":{\"pattern\":\"^0x[0-9a-f]{64}$\",\"type\":\"string\"},\"maxItems\":32,\"type\":\"array\"},\"maxCoinOutPerTx\":{\"description\":\"Per coin type, the most a single transaction may spend or transfer out of the account's address, in the coin's smallest unit. A coin type not listed may not leave the address at all.\",\"items\":{\"additionalProperties\":false,\"properties\":{\"amount\":{\"minimum\":0,\"type\":\"integer\"},\"coinType\":{\"maxLength\":512,\"pattern\":\"^0x[0-9a-f]{1,64}::[A-Za-z0-9_]+::[A-Za-z0-9_]+$\",\"type\":\"string\"}},\"required\":[\"coinType\",\"amount\"],\"type\":\"object\"},\"maxItems\":8,\"type\":\"array\"},\"maxGasBudgetMist\":{\"description\":\"The largest gas budget one transaction may declare.\",\"minimum\":1,\"type\":\"integer\"},\"maxGasPerDayMist\":{\"description\":\"The total gas budget signed per rolling 24 hours.\",\"minimum\":1,\"type\":\"integer\"},\"model\":{\"const\":\"sui-signer\",\"type\":\"string\"},\"network\":{\"enum\":[\"mainnet\",\"testnet\",\"devnet\"],\"type\":\"string\"}},\"required\":[\"model\",\"network\",\"allowedCalls\",\"maxGasBudgetMist\",\"maxGasPerDayMist\"],\"type\":\"object\"},{\"additionalProperties\":false,\"description\":\"Egress: the host of `baseUrl`. The secret is set with external/accounts/secret/set and used only inside the custodian by `driver`; a provider reachable only by handing the consumer the raw key is not supported.\",\"properties\":{\"baseUrl\":{\"$ref\":\"#/$defs/ProviderHttpsUrl\"},\"driver\":{\"description\":\"The custodian's driver that uses the secret: performs a login or token exchange and returns a short-lived result. A custodian refuses a driver it does not implement.\",\"maxLength\":64,\"pattern\":\"^[a-z0-9][a-z0-9-]*$\",\"type\":\"string\"},\"model\":{\"const\":\"static-secret\",\"type\":\"string\"}},\"required\":[\"model\",\"driver\",\"baseUrl\"],\"type\":\"object\"}],\"title\":\"AccountSettings\"},\"AccountState\":{\"description\":\"`active`: usable by its bindings. `suspended`: every issuance and signature is refused at once; management reads continue; resumable. `archived`: hidden from default listings, refused for use, restorable. Deletion removes the record.\",\"enum\":[\"active\",\"suspended\",\"archived\"],\"title\":\"AccountState\",\"type\":\"string\"},\"AwsArn\":{\"maxLength\":2048,\"pattern\":\"^arn:aws[a-z-]*:[a-z0-9-]+:[a-z0-9-]*:[0-9]{0,12}:[A-Za-z0-9+=,.@_/:-]+$\",\"title\":\"AwsArn\",\"type\":\"string\"},\"AwsRegion\":{\"maxLength\":32,\"pattern\":\"^[a-z]{2}(-gov)?-[a-z]+-[0-9]$\",\"title\":\"AwsRegion\",\"type\":\"string\"},\"CredentialScopeCeiling\":{\"additionalProperties\":false,\"description\":\"The widest scope a binding's consumer may request. An issuance is inside the ceiling when its `prefix` begins with one of `prefixes`, every one of its `actions` is in `actions`, and every one of its `scopes` is in `scopes`. Absent members confer nothing: a ceiling with no `prefixes` permits no storage issuance.\",\"properties\":{\"actions\":{\"items\":{\"$ref\":\"#/$defs/ProviderObjectAction\"},\"maxItems\":3,\"minItems\":1,\"type\":\"array\",\"uniqueItems\":true},\"prefixes\":{\"items\":{\"$ref\":\"#/$defs/ProviderObjectPrefix\"},\"maxItems\":64,\"minItems\":1,\"type\":\"array\",\"uniqueItems\":true},\"scopes\":{\"items\":{\"maxLength\":256,\"pattern\":\"^[!#-\\\\[\\\\]-~]+$\",\"type\":\"string\"},\"maxItems\":64,\"type\":\"array\",\"uniqueItems\":true}},\"title\":\"CredentialScopeCeiling\",\"type\":\"object\"},\"DigestMultibase\":{\"description\":\"A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.\\n\\nMultihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.\\n\\nThis definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.\\n\\nRestricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that \\\"interoperability is not guaranteed between implementations using such values\\\", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.\",\"examples\":[\"zQmbWqxBEKC3P8tqsKc98xmWNzrzDtRLMiMPL8wBuTGsMnR\"],\"minLength\":16,\"pattern\":\"^(z[1-9A-HJ-NP-Za-km-z]+|u[A-Za-z0-9_-]+)$\",\"title\":\"DigestMultibase\",\"type\":\"string\"},\"Ext\":{\"additionalProperties\":true,\"description\":\"Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.\",\"minProperties\":1,\"propertyNames\":{\"pattern\":\"^[a-z][a-z0-9-]*(\\\\.[a-z0-9-]+)+$\"},\"title\":\"Ext\",\"type\":\"object\"},\"ExternalAccount\":{\"additionalProperties\":false,\"description\":\"An account as every read returns it. Contains no private key, no secret and no issued credential, to any reader.\",\"properties\":{\"bindings\":{\"items\":{\"$ref\":\"#/$defs/AccountBinding\"},\"maxItems\":256,\"type\":\"array\"},\"context\":{\"$ref\":\"#/$defs/AccountContextId\"},\"createdAt\":{\"format\":\"date-time\",\"type\":\"string\"},\"egressHosts\":{\"description\":\"The provider hosts the custodian connects to on this account's behalf, derived by the custodian from its settings: the token or session endpoints issuance uses, and the destinations external/accounts/probe dials (the object store's host, for a storage model). The custodian MUST NOT connect anywhere else on the account's behalf, so an egress proxy can allow exactly this set. Empty only for a model that neither exchanges nor probes over the network.\",\"items\":{\"maxLength\":253,\"pattern\":\"^[a-z0-9.-]+$\",\"type\":\"string\"},\"maxItems\":8,\"type\":\"array\"},\"id\":{\"$ref\":\"#/$defs/AccountId\"},\"label\":{\"description\":\"Display name. Untrusted text: render it, never interpret it.\",\"maxLength\":128,\"minLength\":1,\"type\":\"string\"},\"lastProbe\":{\"$ref\":\"#/$defs/AccountProbeReport\"},\"providerSetupRequired\":{\"description\":\"True when the account cannot be used until its provider-side setup is redone: after a restore that could not carry its key or secret (a wrapped RSA key, a static secret), or after a rotation awaiting confirmation.\",\"type\":\"boolean\"},\"publicMaterial\":{\"$ref\":\"#/$defs/AccountPublicMaterial\",\"description\":\"Absent for the static models, which hold a secret rather than a key.\"},\"secret\":{\"$ref\":\"#/$defs/AccountSecretInfo\",\"description\":\"Static models only; absent until the secret is set.\"},\"settings\":{\"$ref\":\"#/$defs/AccountSettings\"},\"state\":{\"$ref\":\"#/$defs/AccountState\"},\"updatedAt\":{\"format\":\"date-time\",\"type\":\"string\"}},\"required\":[\"id\",\"label\",\"context\",\"settings\",\"state\",\"bindings\",\"egressHosts\",\"providerSetupRequired\",\"createdAt\",\"updatedAt\"],\"title\":\"ExternalAccount\",\"type\":\"object\"},\"ProviderBucketName\":{\"description\":\"A bucket name as S3 and GCS accept it. Validated rather than free so that it can be placed in a provider policy without escaping.\",\"maxLength\":63,\"minLength\":3,\"pattern\":\"^[a-z0-9][a-z0-9.-]*[a-z0-9]$\",\"title\":\"ProviderBucketName\",\"type\":\"string\"},\"ProviderHttpsUrl\":{\"format\":\"uri\",\"maxLength\":2048,\"pattern\":\"^https://[^\\\\s\\\"'\\\\\\\\]+$\",\"title\":\"ProviderHttpsUrl\",\"type\":\"string\"},\"ProviderObjectAction\":{\"description\":\"`put`: write an object. `get`: read one. `delete`: remove one. No list, ACL, policy or bucket-level action exists here, so none can be granted.\",\"enum\":[\"put\",\"get\",\"delete\"],\"title\":\"ProviderObjectAction\",\"type\":\"string\"},\"ProviderObjectPrefix\":{\"description\":\"An object-key prefix within the account's bucket: one or more segments of lowercase letters, digits, `.`, `_` and `-`, each beginning with a letter or digit and ending with `/`. No quote, backslash, wildcard, whitespace, `..` segment or empty segment can appear. That is deliberate: the custodian places this value inside a provider policy — an IAM session policy (JSON), a GCS Credential Access Boundary condition (CEL) — and a value able to carry a metacharacter can break out of the string it is placed in and widen the policy. That is a known class of defect (CVE-2026-42811, a CEL injection in downscoped GCS credentials). Even with this pattern, a custodian MUST build provider policies with the provider language's own encoder, never by string interpolation.\",\"maxLength\":512,\"minLength\":2,\"pattern\":\"^([a-z0-9][a-z0-9._-]{0,127}/){1,16}$\",\"title\":\"ProviderObjectPrefix\",\"type\":\"string\"},\"Response\":{\"$anchor\":\"response\",\"additionalProperties\":false,\"properties\":{\"account\":{\"$ref\":\"#/$defs/ExternalAccount\"},\"ext\":{\"$ref\":\"#/$defs/Ext\"}},\"required\":[\"account\"],\"title\":\"External Accounts — Restore — response payload\",\"type\":\"object\"},\"SecretFingerprint\":{\"description\":\"Which secret is set, without being a way to test guesses at it. `hmacsha256:` followed by the base64url encoding, without padding, of the first 16 bytes of HMAC-SHA256 over the secret's bytes under a fingerprint key the custodian holds and never discloses. Comparable only between fingerprints made by the same custodian: a re-entered value can be confirmed, while the same secret at two custodians gives unrelated fingerprints. Never a bare hash of the secret, which would let anyone who reads it run a dictionary against it offline; and deliberately not a DigestMultibase, since multihash has no code for a keyed digest.\",\"maxLength\":33,\"pattern\":\"^hmacsha256:[A-Za-z0-9_-]{22}$\",\"title\":\"SecretFingerprint\",\"type\":\"string\"},\"SuiMoveCall\":{\"additionalProperties\":false,\"description\":\"One Move function an account's transactions may call.\",\"properties\":{\"function\":{\"pattern\":\"^[A-Za-z][A-Za-z0-9_]{0,127}$\",\"type\":\"string\"},\"module\":{\"pattern\":\"^[A-Za-z][A-Za-z0-9_]{0,127}$\",\"type\":\"string\"},\"package\":{\"pattern\":\"^0x[0-9a-f]{64}$\",\"type\":\"string\"}},\"required\":[\"package\",\"module\",\"function\"],\"title\":\"SuiMoveCall\",\"type\":\"object\"}},\"$ref\":\"#/$defs/Response\",\"$schema\":\"https://json-schema.org/draft/2020-12/schema\"}\n",
);
}
impl crate::RequestPayload for Payload {
type Response = Response;
}
/// The earlier `MAJOR.MINOR` of this slug that this version declares it
/// extends (front matter `extends`, SPEC §5.2 "Declared extension"), or
/// `None`. Only the direct declaration; walk a chain with
/// [`crate::extension::extends_for`].
pub const EXTENDS: Option<&str> = None;
/// The extended error codes this specification declares (SPEC §7.3 item 9,
/// §8.5), in declaration order. Empty when it declares none.
pub const ERROR_CODES: &[crate::DeclaredErrorCode] =
&[error_codes::NOT_FOUND, error_codes::INVALID_TRANSITION];
/// One constant per extended error code this specification declares
/// (SPEC §7.3 item 9), named for its local part.
///
/// Emit these rather than a string literal: the code is read from the
/// specification, so it cannot name a code the specification never
/// declared.
pub mod error_codes {
/// `external:notFound`
///
/// No account with this id exists in the named context that the caller may see. See the family conventions §2.
///
/// Declared `retryable: false`.
pub const NOT_FOUND: crate::DeclaredErrorCode = crate::DeclaredErrorCode {
code: "external:notFound",
retryable: false,
details_schema: ::core::option::Option::None,
};
/// `external/accounts/restore:invalidTransition`
///
/// The account is not in a state this task applies to (`archived`).
///
/// Declared `retryable: false`.
pub const INVALID_TRANSITION: crate::DeclaredErrorCode = crate::DeclaredErrorCode {
code: "external/accounts/restore:invalidTransition",
retryable: false,
details_schema: ::core::option::Option::None,
};
}