k9o 1.2.0-aarch64-linux → 1.5.2-aarch64-linux

data/lib/k9o/_ffi/kibo_kms_rest_ffi.rb

@@ -126,6 +126,97 @@ end
     end
   end
 
+  # The Record type AppOpenInput.
+
+  def self.check_lower_TypeAppOpenInput(v)
+    RustBuffer.check_lower_TypeFfiCredential(v.kms_cred)
+    RustBuffer.check_lower_TypeFfiProviderConfig(v.provider_config)
+    
+    
+    RustBuffer.check_lower_Optionalstring(v.context)
+    
+    RustBuffer.check_lower_Sequencestring(v.expected_key_refs)
+  end
+
+  def self.alloc_from_TypeAppOpenInput(v)
+    RustBuffer.allocWithBuilder do |builder|
+      builder.write_TypeAppOpenInput(v)
+      return builder.finalize
+    end
+  end
+
+  def consumeIntoTypeAppOpenInput
+    consumeWithStream do |stream|
+      return stream.readTypeAppOpenInput
+    end
+  end
+
+  # The Record type AppOpenOutput.
+
+  def self.check_lower_TypeAppOpenOutput(v)
+    
+  end
+
+  def self.alloc_from_TypeAppOpenOutput(v)
+    RustBuffer.allocWithBuilder do |builder|
+      builder.write_TypeAppOpenOutput(v)
+      return builder.finalize
+    end
+  end
+
+  def consumeIntoTypeAppOpenOutput
+    consumeWithStream do |stream|
+      return stream.readTypeAppOpenOutput
+    end
+  end
+
+  # The Record type AppSealInput.
+
+  def self.check_lower_TypeAppSealInput(v)
+    RustBuffer.check_lower_TypeKmsProvider(v.provider)
+    RustBuffer.check_lower_TypeFfiPosture(v.posture)
+    RustBuffer.check_lower_TypeFfiCredential(v.kms_cred)
+    RustBuffer.check_lower_TypeFfiKeyRef(v.key_ref)
+    RustBuffer.check_lower_TypeFfiProviderConfig(v.provider_config)
+    
+    
+    RustBuffer.check_lower_Optionalstring(v.context)
+    
+    RustBuffer.check_lower_Sequencestring(v.expected_key_refs)
+  end
+
+  def self.alloc_from_TypeAppSealInput(v)
+    RustBuffer.allocWithBuilder do |builder|
+      builder.write_TypeAppSealInput(v)
+      return builder.finalize
+    end
+  end
+
+  def consumeIntoTypeAppSealInput
+    consumeWithStream do |stream|
+      return stream.readTypeAppSealInput
+    end
+  end
+
+  # The Record type AppSealOutput.
+
+  def self.check_lower_TypeAppSealOutput(v)
+    
+  end
+
+  def self.alloc_from_TypeAppSealOutput(v)
+    RustBuffer.allocWithBuilder do |builder|
+      builder.write_TypeAppSealOutput(v)
+      return builder.finalize
+    end
+  end
+
+  def consumeIntoTypeAppSealOutput
+    consumeWithStream do |stream|
+      return stream.readTypeAppSealOutput
+    end
+  end
+
   # The Record type DecryptInput.
 
   def self.check_lower_TypeDecryptInput(v)
@@ -135,6 +226,7 @@ end
     RustBuffer.check_lower_TypeFfiStrategy(v.strategy)
     RustBuffer.check_lower_TypeFfiAttestationTier(v.attestation_tier)
     RustBuffer.check_lower_SequenceTypeFfiKvPair(v.encryption_context)
+    RustBuffer.check_lower_Sequencestring(v.expected_key_refs)
   end
 
   def self.alloc_from_TypeDecryptInput(v)
@@ -183,6 +275,7 @@ end
     RustBuffer.check_lower_SequenceTypeFfiKvPair(v.encryption_context)
     
     RustBuffer.check_lower_OptionalTypeFfiPosturePolicy(v.posture_policy)
+    RustBuffer.check_lower_Sequencestring(v.expected_key_refs)
   end
 
   def self.alloc_from_TypeEncryptInput(v)
@@ -257,6 +350,27 @@ end
     end
   end
 
+  # The Record type FfiFederationInput.
+
+  def self.check_lower_TypeFfiFederationInput(v)
+    RustBuffer.check_lower_TypeFfiFederationSpec(v.spec)
+    
+    
+  end
+
+  def self.alloc_from_TypeFfiFederationInput(v)
+    RustBuffer.allocWithBuilder do |builder|
+      builder.write_TypeFfiFederationInput(v)
+      return builder.finalize
+    end
+  end
+
+  def consumeIntoTypeFfiFederationInput
+    consumeWithStream do |stream|
+      return stream.readTypeFfiFederationInput
+    end
+  end
+
   # The Record type FfiKeyRef.
 
   def self.check_lower_TypeFfiKeyRef(v)
@@ -356,6 +470,49 @@ end
   end
   
 
+  # The Enum type FfiFederationSpec.
+
+  def self.check_lower_TypeFfiFederationSpec(v)
+    if v.aws?
+        
+        
+        
+        
+        
+      return
+    end
+    if v.gcp?
+        
+      return
+    end
+    if v.azure?
+        
+        
+        
+      return
+    end
+    if v.vault?
+        
+        
+        
+      return
+    end
+  end
+
+  def self.alloc_from_TypeFfiFederationSpec(v)
+    RustBuffer.allocWithBuilder do |builder|
+      builder.write_TypeFfiFederationSpec(v)
+      return builder.finalize
+    end
+  end
+
+  def consumeIntoTypeFfiFederationSpec
+    consumeWithStream do |stream|
+      return stream.readTypeFfiFederationSpec
+    end
+  end
+  
+
   # The Enum type FfiMinPosture.
 
   def self.check_lower_TypeFfiMinPosture(v)
@@ -579,6 +736,27 @@ end
     end
   end
 
+  # The Sequence<T> type for string.
+
+  def self.check_lower_Sequencestring(v)
+    v.each do |item|
+      
+    end
+  end
+
+  def self.alloc_from_Sequencestring(v)
+    RustBuffer.allocWithBuilder do |builder|
+      builder.write_Sequencestring(v)
+      return builder.finalize()
+    end
+  end
+
+  def consumeIntoSequencestring
+    consumeWithStream do |stream|
+      return stream.readSequencestring
+    end
+  end
+
   # The Sequence<T> type for TypeFfiKvPair.
 
   def self.check_lower_SequenceTypeFfiKvPair(v)
@@ -646,6 +824,10 @@ class RustBufferStream
     data
   end
 
+  def readU32
+    unpack_from 4, 'L>'
+  end
+
   def readU64
     unpack_from 8, 'Q>'
   end
@@ -675,6 +857,53 @@ class RustBufferStream
     read(size).force_encoding(Encoding::BINARY)
   end
 
+  # The Record type AppOpenInput.
+
+  def readTypeAppOpenInput
+    AppOpenInput.new(
+      kms_cred: readTypeFfiCredential,
+      provider_config: readTypeFfiProviderConfig,
+      project_id: readString,
+      crypt: readString,
+      context: readOptionalstring,
+      container: readBytes,
+      expected_key_refs: readSequencestring
+    )
+  end
+
+  # The Record type AppOpenOutput.
+
+  def readTypeAppOpenOutput
+    AppOpenOutput.new(
+      plaintext: readBytes
+    )
+  end
+
+  # The Record type AppSealInput.
+
+  def readTypeAppSealInput
+    AppSealInput.new(
+      provider: readTypeKmsProvider,
+      posture: readTypeFfiPosture,
+      kms_cred: readTypeFfiCredential,
+      key_ref: readTypeFfiKeyRef,
+      provider_config: readTypeFfiProviderConfig,
+      project_id: readString,
+      crypt: readString,
+      context: readOptionalstring,
+      plaintext: readBytes,
+      expected_key_refs: readSequencestring
+    )
+  end
+
+  # The Record type AppSealOutput.
+
+  def readTypeAppSealOutput
+    AppSealOutput.new(
+      container: readBytes
+    )
+  end
+
   # The Record type DecryptInput.
 
   def readTypeDecryptInput
@@ -684,7 +913,8 @@ class RustBufferStream
       envelope: readBytes,
       strategy: readTypeFfiStrategy,
       attestation_tier: readTypeFfiAttestationTier,
-      encryption_context: readSequenceTypeFfiKvPair
+      encryption_context: readSequenceTypeFfiKvPair,
+      expected_key_refs: readSequencestring
     )
   end
 
@@ -710,7 +940,8 @@ class RustBufferStream
       attestation_tier: readTypeFfiAttestationTier,
       encryption_context: readSequenceTypeFfiKvPair,
       plaintext: readBytes,
-      posture_policy: readOptionalTypeFfiPosturePolicy
+      posture_policy: readOptionalTypeFfiPosturePolicy,
+      expected_key_refs: readSequencestring
     )
   end
 
@@ -740,6 +971,16 @@ class RustBufferStream
     )
   end
 
+  # The Record type FfiFederationInput.
+
+  def readTypeFfiFederationInput
+    FfiFederationInput.new(
+      spec: readTypeFfiFederationSpec,
+      identity_token: readString,
+      now_unix_secs: readU64
+    )
+  end
+
   # The Record type FfiKeyRef.
 
   def readTypeFfiKeyRef
@@ -800,6 +1041,46 @@ class RustBufferStream
 
   
   
+  # The Enum type FfiFederationSpec.
+
+  def readTypeFfiFederationSpec
+    variant = unpack_from 4, 'l>'
+    
+    if variant == 1
+        return FfiFederationSpec::AWS.new(
+            self.readString(),
+            self.readString(),
+            self.readString(),
+            self.readString(),
+            self.readU32()
+        )
+    end
+    if variant == 2
+        return FfiFederationSpec::GCP.new(
+            self.readString()
+        )
+    end
+    if variant == 3
+        return FfiFederationSpec::AZURE.new(
+            self.readString(),
+            self.readString(),
+            self.readString()
+        )
+    end
+    if variant == 4
+        return FfiFederationSpec::VAULT.new(
+            self.readString(),
+            self.readString(),
+            self.readString()
+        )
+    end
+    raise InternalError, 'Unexpected variant tag for TypeFfiFederationSpec'
+  end
+
+  
+
+  
+  
   # The Enum type FfiMinPosture.
 
   def readTypeFfiMinPosture
@@ -1020,6 +1301,22 @@ class RustBufferStream
     end
   end
 
+  # The Sequence<T> type for string.
+
+  def readSequencestring
+    count = unpack_from 4, 'l>'
+
+    raise InternalError, 'Unexpected negative sequence length' if count.negative?
+
+    items = []
+
+    count.times do
+      items.append readString
+    end
+
+    items
+  end
+
   # The Sequence<T> type for TypeFfiKvPair.
 
   def readSequenceTypeFfiKvPair
@@ -1082,6 +1379,11 @@ class RustBufferBuilder
     end
   end
 
+  def write_U32(v)
+    v = KiboKmsRestFfi::uniffi_in_range(v, "u32", 0, 2**32)
+    pack_into(4, 'L>', v)
+  end
+
   def write_U64(v)
     v = KiboKmsRestFfi::uniffi_in_range(v, "u64", 0, 2**64)
     pack_into(8, 'Q>', v)
@@ -1103,6 +1405,45 @@ class RustBufferBuilder
     write v
   end
 
+  # The Record type AppOpenInput.
+
+  def write_TypeAppOpenInput(v)
+    self.write_TypeFfiCredential(v.kms_cred)
+    self.write_TypeFfiProviderConfig(v.provider_config)
+    self.write_String(v.project_id)
+    self.write_String(v.crypt)
+    self.write_Optionalstring(v.context)
+    self.write_Bytes(v.container)
+    self.write_Sequencestring(v.expected_key_refs)
+  end
+
+  # The Record type AppOpenOutput.
+
+  def write_TypeAppOpenOutput(v)
+    self.write_Bytes(v.plaintext)
+  end
+
+  # The Record type AppSealInput.
+
+  def write_TypeAppSealInput(v)
+    self.write_TypeKmsProvider(v.provider)
+    self.write_TypeFfiPosture(v.posture)
+    self.write_TypeFfiCredential(v.kms_cred)
+    self.write_TypeFfiKeyRef(v.key_ref)
+    self.write_TypeFfiProviderConfig(v.provider_config)
+    self.write_String(v.project_id)
+    self.write_String(v.crypt)
+    self.write_Optionalstring(v.context)
+    self.write_Bytes(v.plaintext)
+    self.write_Sequencestring(v.expected_key_refs)
+  end
+
+  # The Record type AppSealOutput.
+
+  def write_TypeAppSealOutput(v)
+    self.write_Bytes(v.container)
+  end
+
   # The Record type DecryptInput.
 
   def write_TypeDecryptInput(v)
@@ -1112,6 +1453,7 @@ class RustBufferBuilder
     self.write_TypeFfiStrategy(v.strategy)
     self.write_TypeFfiAttestationTier(v.attestation_tier)
     self.write_SequenceTypeFfiKvPair(v.encryption_context)
+    self.write_Sequencestring(v.expected_key_refs)
   end
 
   # The Record type DecryptOutput.
@@ -1134,6 +1476,7 @@ class RustBufferBuilder
     self.write_SequenceTypeFfiKvPair(v.encryption_context)
     self.write_Bytes(v.plaintext)
     self.write_OptionalTypeFfiPosturePolicy(v.posture_policy)
+    self.write_Sequencestring(v.expected_key_refs)
   end
 
   # The Record type EncryptOutput.
@@ -1156,6 +1499,14 @@ class RustBufferBuilder
     self.write_U64(v.expires_at_unix_secs)
   end
 
+  # The Record type FfiFederationInput.
+
+  def write_TypeFfiFederationInput(v)
+    self.write_TypeFfiFederationSpec(v.spec)
+    self.write_String(v.identity_token)
+    self.write_U64(v.now_unix_secs)
+  end
+
   # The Record type FfiKeyRef.
 
   def write_TypeFfiKeyRef(v)
@@ -1191,6 +1542,36 @@ class RustBufferBuilder
  end
    
 
+  # The Enum type FfiFederationSpec.
+
+  def write_TypeFfiFederationSpec(v)
+    if v.aws?
+      pack_into(4, 'l>', 1)
+      self.write_String(v.role_arn)
+      self.write_String(v.session_name)
+      self.write_String(v.region)
+      self.write_String(v.key_arn)
+      self.write_U32(v.duration_secs)
+    end
+    if v.gcp?
+      pack_into(4, 'l>', 2)
+      self.write_String(v.audience)
+    end
+    if v.azure?
+      pack_into(4, 'l>', 3)
+      self.write_String(v.tenant_id)
+      self.write_String(v.client_id)
+      self.write_String(v.scope)
+    end
+    if v.vault?
+      pack_into(4, 'l>', 4)
+      self.write_String(v.vault_addr)
+      self.write_String(v.mount)
+      self.write_String(v.role)
+    end
+ end
+   
+
   # The Enum type FfiMinPosture.
 
   def write_TypeFfiMinPosture(v)
@@ -1294,6 +1675,16 @@ class RustBufferBuilder
     end
   end
 
+  # The Sequence<T> type for string.
+
+  def write_Sequencestring(items)
+    pack_into(4, 'l>', items.size)
+
+    items.each do |item|
+      self.write_String(item)
+    end
+  end
+
   # The Sequence<T> type for TypeFfiKvPair.
 
   def write_SequenceTypeFfiKvPair(items)
@@ -1357,49 +1748,50 @@ CALL_PANIC = 2
 
 
 
+
 module ZkFfiUniffiError
   class Platform < StandardError
-    def initialize(code, message)
+    def initialize(code, detail)
         @code = code
-        @message = message
+        @detail = detail
         super()
       end
 
-    attr_reader :code, :message
+    attr_reader :code, :detail
     
 
     def to_s
-     "#{self.class.name}(code=#{@code.inspect}, message=#{@message.inspect})"
+     "#{self.class.name}(code=#{@code.inspect}, detail=#{@detail.inspect})"
     end
   end
   class UpstreamKms < StandardError
-    def initialize(message)
-        @message = message
+    def initialize(detail)
+        @detail = detail
         super()
       end
 
-    attr_reader :message
+    attr_reader :detail
     
 
     def to_s
-     "#{self.class.name}(message=#{@message.inspect})"
+     "#{self.class.name}(detail=#{@detail.inspect})"
     end
   end
   class PostureViolation < StandardError
-    def initialize(code, message, dimension, requested, declared)
+    def initialize(code, detail, dimension, requested, declared)
         @code = code
-        @message = message
+        @detail = detail
         @dimension = dimension
         @requested = requested
         @declared = declared
         super()
       end
 
-    attr_reader :code, :message, :dimension, :requested, :declared
+    attr_reader :code, :detail, :dimension, :requested, :declared
     
 
     def to_s
-     "#{self.class.name}(code=#{@code.inspect}, message=#{@message.inspect}, dimension=#{@dimension.inspect}, requested=#{@requested.inspect}, declared=#{@declared.inspect})"
+     "#{self.class.name}(code=#{@code.inspect}, detail=#{@detail.inspect}, dimension=#{@dimension.inspect}, requested=#{@requested.inspect}, declared=#{@declared.inspect})"
     end
   end
 
@@ -1415,6 +1807,7 @@ ERROR_MODULE_TO_READER_METHOD = {
 
 
 
+
   ZkFfiUniffiError => :readTypeZkFfiUniffiError,
 
 }
@@ -1486,6 +1879,27 @@ module UniFFILib
   ffi_lib File.expand_path(FFI::Platform::LIBPREFIX + 'kibo_kms_rest_ffi.' + FFI::Platform::LIBSUFFIX, __dir__)
   
 
+  attach_function :uniffi_kibo_kms_rest_ffi_fn_func_acquire_kms_credential,
+    [RustBuffer.by_value, RustCallStatus.by_ref],
+    :uint64
+  attach_function :uniffi_kibo_kms_rest_ffi_fn_func_acquire_kms_credential_blocking,
+    [RustBuffer.by_value, RustCallStatus.by_ref],
+    RustBuffer.by_value
+  attach_function :uniffi_kibo_kms_rest_ffi_fn_func_app_crypto_open,
+    [RustBuffer.by_value, RustCallStatus.by_ref],
+    :uint64
+  attach_function :uniffi_kibo_kms_rest_ffi_fn_func_app_crypto_open_blocking,
+    [RustBuffer.by_value, RustCallStatus.by_ref],
+    RustBuffer.by_value
+  attach_function :uniffi_kibo_kms_rest_ffi_fn_func_app_crypto_seal,
+    [RustBuffer.by_value, RustCallStatus.by_ref],
+    :uint64
+  attach_function :uniffi_kibo_kms_rest_ffi_fn_func_app_crypto_seal_blocking,
+    [RustBuffer.by_value, RustCallStatus.by_ref],
+    RustBuffer.by_value
+  attach_function :uniffi_kibo_kms_rest_ffi_fn_func_core_capabilities,
+    [RustCallStatus.by_ref],
+    RustBuffer.by_value
   attach_function :uniffi_kibo_kms_rest_ffi_fn_func_zk_decrypt,
     [RustBuffer.by_value, RustCallStatus.by_ref],
     :uint64
@@ -1510,6 +1924,27 @@ module UniFFILib
   attach_function :ffi_kibo_kms_rest_ffi_rustbuffer_reserve,
     [RustBuffer.by_value, :uint64, RustCallStatus.by_ref],
     RustBuffer.by_value
+  attach_function :uniffi_kibo_kms_rest_ffi_checksum_func_acquire_kms_credential,
+    [RustCallStatus.by_ref],
+    :uint16
+  attach_function :uniffi_kibo_kms_rest_ffi_checksum_func_acquire_kms_credential_blocking,
+    [RustCallStatus.by_ref],
+    :uint16
+  attach_function :uniffi_kibo_kms_rest_ffi_checksum_func_app_crypto_open,
+    [RustCallStatus.by_ref],
+    :uint16
+  attach_function :uniffi_kibo_kms_rest_ffi_checksum_func_app_crypto_open_blocking,
+    [RustCallStatus.by_ref],
+    :uint16
+  attach_function :uniffi_kibo_kms_rest_ffi_checksum_func_app_crypto_seal,
+    [RustCallStatus.by_ref],
+    :uint16
+  attach_function :uniffi_kibo_kms_rest_ffi_checksum_func_app_crypto_seal_blocking,
+    [RustCallStatus.by_ref],
+    :uint16
+  attach_function :uniffi_kibo_kms_rest_ffi_checksum_func_core_capabilities,
+    [RustCallStatus.by_ref],
+    :uint16
   attach_function :uniffi_kibo_kms_rest_ffi_checksum_func_zk_decrypt,
     [RustCallStatus.by_ref],
     :uint16
@@ -1546,15 +1981,241 @@ end
   
   
 
-class FfiMinPosture
-  PLATFORM_MANAGED = 1
-  BYOK = 2
-  HYOK = 3
-  
-end
+class FfiFederationSpec
+  def initialize
+    raise RuntimeError, 'FfiFederationSpec cannot be instantiated directly'
+  end
 
+  # Each enum variant is a nested class of the enum itself.
+  class AWS
+    
+    attr_reader :role_arn, :session_name, :region, :key_arn, :duration_secs
+    
+    def initialize(role_arn, session_name, region, key_arn, duration_secs)
+      
+      @role_arn = role_arn
+      @session_name = session_name
+      @region = region
+      @key_arn = key_arn
+      @duration_secs = duration_secs
+      
+    end
 
-  
+    def to_s
+      "FfiFederationSpec::AWS(role_arn=#{@role_arn}, session_name=#{@session_name}, region=#{@region}, key_arn=#{@key_arn}, duration_secs=#{@duration_secs})"
+    end
+
+    def ==(other)
+      if !other.aws?
+        return false
+      end
+      if @role_arn != other.role_arn
+        return false
+      end
+      if @session_name != other.session_name
+        return false
+      end
+      if @region != other.region
+        return false
+      end
+      if @key_arn != other.key_arn
+        return false
+      end
+      if @duration_secs != other.duration_secs
+        return false
+      end
+
+      true
+    end
+
+    # For each variant, we have an `NAME?` method for easily checking
+    # whether an instance is that variant.
+    
+    def aws?
+      instance_of? FfiFederationSpec::AWS
+    end
+    
+    def gcp?
+      instance_of? FfiFederationSpec::GCP
+    end
+    
+    def azure?
+      instance_of? FfiFederationSpec::AZURE
+    end
+    
+    def vault?
+      instance_of? FfiFederationSpec::VAULT
+    end
+    
+  end
+  class GCP
+    
+    attr_reader :audience
+    
+    def initialize(audience)
+      
+      @audience = audience
+      
+    end
+
+    def to_s
+      "FfiFederationSpec::GCP(audience=#{@audience})"
+    end
+
+    def ==(other)
+      if !other.gcp?
+        return false
+      end
+      if @audience != other.audience
+        return false
+      end
+
+      true
+    end
+
+    # For each variant, we have an `NAME?` method for easily checking
+    # whether an instance is that variant.
+    
+    def aws?
+      instance_of? FfiFederationSpec::AWS
+    end
+    
+    def gcp?
+      instance_of? FfiFederationSpec::GCP
+    end
+    
+    def azure?
+      instance_of? FfiFederationSpec::AZURE
+    end
+    
+    def vault?
+      instance_of? FfiFederationSpec::VAULT
+    end
+    
+  end
+  class AZURE
+    
+    attr_reader :tenant_id, :client_id, :scope
+    
+    def initialize(tenant_id, client_id, scope)
+      
+      @tenant_id = tenant_id
+      @client_id = client_id
+      @scope = scope
+      
+    end
+
+    def to_s
+      "FfiFederationSpec::AZURE(tenant_id=#{@tenant_id}, client_id=#{@client_id}, scope=#{@scope})"
+    end
+
+    def ==(other)
+      if !other.azure?
+        return false
+      end
+      if @tenant_id != other.tenant_id
+        return false
+      end
+      if @client_id != other.client_id
+        return false
+      end
+      if @scope != other.scope
+        return false
+      end
+
+      true
+    end
+
+    # For each variant, we have an `NAME?` method for easily checking
+    # whether an instance is that variant.
+    
+    def aws?
+      instance_of? FfiFederationSpec::AWS
+    end
+    
+    def gcp?
+      instance_of? FfiFederationSpec::GCP
+    end
+    
+    def azure?
+      instance_of? FfiFederationSpec::AZURE
+    end
+    
+    def vault?
+      instance_of? FfiFederationSpec::VAULT
+    end
+    
+  end
+  class VAULT
+    
+    attr_reader :vault_addr, :mount, :role
+    
+    def initialize(vault_addr, mount, role)
+      
+      @vault_addr = vault_addr
+      @mount = mount
+      @role = role
+      
+    end
+
+    def to_s
+      "FfiFederationSpec::VAULT(vault_addr=#{@vault_addr}, mount=#{@mount}, role=#{@role})"
+    end
+
+    def ==(other)
+      if !other.vault?
+        return false
+      end
+      if @vault_addr != other.vault_addr
+        return false
+      end
+      if @mount != other.mount
+        return false
+      end
+      if @role != other.role
+        return false
+      end
+
+      true
+    end
+
+    # For each variant, we have an `NAME?` method for easily checking
+    # whether an instance is that variant.
+    
+    def aws?
+      instance_of? FfiFederationSpec::AWS
+    end
+    
+    def gcp?
+      instance_of? FfiFederationSpec::GCP
+    end
+    
+    def azure?
+      instance_of? FfiFederationSpec::AZURE
+    end
+    
+    def vault?
+      instance_of? FfiFederationSpec::VAULT
+    end
+    
+  end
+  
+end
+
+
+  
+  
+  
+
+class FfiMinPosture
+  PLATFORM_MANAGED = 1
+  BYOK = 2
+  HYOK = 3
+  
+end
+
+
+  
   
   
 
@@ -1602,17 +2263,146 @@ end
 
   
   
+  # Record type AppOpenInput
+class AppOpenInput
+  attr_reader :kms_cred, :provider_config, :project_id, :crypt, :context, :container, :expected_key_refs
+
+  def initialize(kms_cred:, provider_config:, project_id:, crypt:, context:, container:, expected_key_refs:)
+    @kms_cred = kms_cred
+    @provider_config = provider_config
+    @project_id = project_id
+    @crypt = crypt
+    @context = context
+    @container = container
+    @expected_key_refs = expected_key_refs
+  end
+
+  def ==(other)
+    if @kms_cred != other.kms_cred
+      return false
+    end
+    if @provider_config != other.provider_config
+      return false
+    end
+    if @project_id != other.project_id
+      return false
+    end
+    if @crypt != other.crypt
+      return false
+    end
+    if @context != other.context
+      return false
+    end
+    if @container != other.container
+      return false
+    end
+    if @expected_key_refs != other.expected_key_refs
+      return false
+    end
+
+    true
+  end
+end
+  
+  # Record type AppOpenOutput
+class AppOpenOutput
+  attr_reader :plaintext
+
+  def initialize(plaintext:)
+    @plaintext = plaintext
+  end
+
+  def ==(other)
+    if @plaintext != other.plaintext
+      return false
+    end
+
+    true
+  end
+end
+  
+  # Record type AppSealInput
+class AppSealInput
+  attr_reader :provider, :posture, :kms_cred, :key_ref, :provider_config, :project_id, :crypt, :context, :plaintext, :expected_key_refs
+
+  def initialize(provider:, posture:, kms_cred:, key_ref:, provider_config:, project_id:, crypt:, context:, plaintext:, expected_key_refs:)
+    @provider = provider
+    @posture = posture
+    @kms_cred = kms_cred
+    @key_ref = key_ref
+    @provider_config = provider_config
+    @project_id = project_id
+    @crypt = crypt
+    @context = context
+    @plaintext = plaintext
+    @expected_key_refs = expected_key_refs
+  end
+
+  def ==(other)
+    if @provider != other.provider
+      return false
+    end
+    if @posture != other.posture
+      return false
+    end
+    if @kms_cred != other.kms_cred
+      return false
+    end
+    if @key_ref != other.key_ref
+      return false
+    end
+    if @provider_config != other.provider_config
+      return false
+    end
+    if @project_id != other.project_id
+      return false
+    end
+    if @crypt != other.crypt
+      return false
+    end
+    if @context != other.context
+      return false
+    end
+    if @plaintext != other.plaintext
+      return false
+    end
+    if @expected_key_refs != other.expected_key_refs
+      return false
+    end
+
+    true
+  end
+end
+  
+  # Record type AppSealOutput
+class AppSealOutput
+  attr_reader :container
+
+  def initialize(container:)
+    @container = container
+  end
+
+  def ==(other)
+    if @container != other.container
+      return false
+    end
+
+    true
+  end
+end
+  
   # Record type DecryptInput
 class DecryptInput
-  attr_reader :kms_cred, :provider_config, :envelope, :strategy, :attestation_tier, :encryption_context
+  attr_reader :kms_cred, :provider_config, :envelope, :strategy, :attestation_tier, :encryption_context, :expected_key_refs
 
-  def initialize(kms_cred:, provider_config:, envelope:, strategy:, attestation_tier:, encryption_context:)
+  def initialize(kms_cred:, provider_config:, envelope:, strategy:, attestation_tier:, encryption_context:, expected_key_refs:)
     @kms_cred = kms_cred
     @provider_config = provider_config
     @envelope = envelope
     @strategy = strategy
     @attestation_tier = attestation_tier
     @encryption_context = encryption_context
+    @expected_key_refs = expected_key_refs
   end
 
   def ==(other)
@@ -1634,6 +2424,9 @@ class DecryptInput
     if @encryption_context != other.encryption_context
       return false
     end
+    if @expected_key_refs != other.expected_key_refs
+      return false
+    end
 
     true
   end
@@ -1658,9 +2451,9 @@ end
   
   # Record type EncryptInput
 class EncryptInput
-  attr_reader :provider, :posture, :strategy, :oracle_mode, :kms_cred, :key_ref, :provider_config, :attestation_tier, :encryption_context, :plaintext, :posture_policy
+  attr_reader :provider, :posture, :strategy, :oracle_mode, :kms_cred, :key_ref, :provider_config, :attestation_tier, :encryption_context, :plaintext, :posture_policy, :expected_key_refs
 
-  def initialize(provider:, posture:, strategy:, oracle_mode:, kms_cred:, key_ref:, provider_config:, attestation_tier:, encryption_context:, plaintext:, posture_policy:)
+  def initialize(provider:, posture:, strategy:, oracle_mode:, kms_cred:, key_ref:, provider_config:, attestation_tier:, encryption_context:, plaintext:, posture_policy:, expected_key_refs:)
     @provider = provider
     @posture = posture
     @strategy = strategy
@@ -1672,6 +2465,7 @@ class EncryptInput
     @encryption_context = encryption_context
     @plaintext = plaintext
     @posture_policy = posture_policy
+    @expected_key_refs = expected_key_refs
   end
 
   def ==(other)
@@ -1708,6 +2502,9 @@ class EncryptInput
     if @posture_policy != other.posture_policy
       return false
     end
+    if @expected_key_refs != other.expected_key_refs
+      return false
+    end
 
     true
   end
@@ -1772,6 +2569,31 @@ class FfiCredential
   end
 end
   
+  # Record type FfiFederationInput
+class FfiFederationInput
+  attr_reader :spec, :identity_token, :now_unix_secs
+
+  def initialize(spec:, identity_token:, now_unix_secs:)
+    @spec = spec
+    @identity_token = identity_token
+    @now_unix_secs = now_unix_secs
+  end
+
+  def ==(other)
+    if @spec != other.spec
+      return false
+    end
+    if @identity_token != other.identity_token
+      return false
+    end
+    if @now_unix_secs != other.now_unix_secs
+      return false
+    end
+
+    true
+  end
+end
+  
   # Record type FfiKeyRef
 class FfiKeyRef
   attr_reader :version, :external_ref
@@ -1860,6 +2682,87 @@ end
   
   
 
+def self.acquire_kms_credential(input)
+    input = input
+    RustBuffer.check_lower_TypeFfiFederationInput(input)
+    
+  result = KiboKmsRestFfi.rust_call_with_error(ZkFfiUniffiError,:uniffi_kibo_kms_rest_ffi_fn_func_acquire_kms_credential,RustBuffer.alloc_from_TypeFfiFederationInput(input))
+  return result.consumeIntoTypeFfiCredential
+end
+
+
+  
+  
+
+def self.acquire_kms_credential_blocking(input)
+    input = input
+    RustBuffer.check_lower_TypeFfiFederationInput(input)
+    
+  result = KiboKmsRestFfi.rust_call_with_error(ZkFfiUniffiError,:uniffi_kibo_kms_rest_ffi_fn_func_acquire_kms_credential_blocking,RustBuffer.alloc_from_TypeFfiFederationInput(input))
+  return result.consumeIntoTypeFfiCredential
+end
+
+
+  
+  
+
+def self.app_crypto_open(input)
+    input = input
+    RustBuffer.check_lower_TypeAppOpenInput(input)
+    
+  result = KiboKmsRestFfi.rust_call_with_error(ZkFfiUniffiError,:uniffi_kibo_kms_rest_ffi_fn_func_app_crypto_open,RustBuffer.alloc_from_TypeAppOpenInput(input))
+  return result.consumeIntoTypeAppOpenOutput
+end
+
+
+  
+  
+
+def self.app_crypto_open_blocking(input)
+    input = input
+    RustBuffer.check_lower_TypeAppOpenInput(input)
+    
+  result = KiboKmsRestFfi.rust_call_with_error(ZkFfiUniffiError,:uniffi_kibo_kms_rest_ffi_fn_func_app_crypto_open_blocking,RustBuffer.alloc_from_TypeAppOpenInput(input))
+  return result.consumeIntoTypeAppOpenOutput
+end
+
+
+  
+  
+
+def self.app_crypto_seal(input)
+    input = input
+    RustBuffer.check_lower_TypeAppSealInput(input)
+    
+  result = KiboKmsRestFfi.rust_call_with_error(ZkFfiUniffiError,:uniffi_kibo_kms_rest_ffi_fn_func_app_crypto_seal,RustBuffer.alloc_from_TypeAppSealInput(input))
+  return result.consumeIntoTypeAppSealOutput
+end
+
+
+  
+  
+
+def self.app_crypto_seal_blocking(input)
+    input = input
+    RustBuffer.check_lower_TypeAppSealInput(input)
+    
+  result = KiboKmsRestFfi.rust_call_with_error(ZkFfiUniffiError,:uniffi_kibo_kms_rest_ffi_fn_func_app_crypto_seal_blocking,RustBuffer.alloc_from_TypeAppSealInput(input))
+  return result.consumeIntoTypeAppSealOutput
+end
+
+
+  
+  
+
+def self.core_capabilities()
+  result = KiboKmsRestFfi.rust_call(:uniffi_kibo_kms_rest_ffi_fn_func_core_capabilities,)
+  return result.consumeIntoSequencestring
+end
+
+
+  
+  
+
 def self.zk_decrypt(input)
     input = input
     RustBuffer.check_lower_TypeDecryptInput(input)