@openvtc/trust-tasks 0.23.8 → 0.23.9

package/dist/external/accounts/keys/rotate/0.1/payload.d.ts

@@ -0,0 +1,3216 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/external/accounts/keys/rotate/0.1/payload.schema.json
+ */
+import type { AccountBinding, AccountContextId, AccountId, AccountProbeReport, AccountProbeStep, AccountPublicMaterial, AccountSecretInfo, AccountSettings, AccountSetupArtifacts, AccountState, AuthModel, AwsArn, AwsRegion, CredentialScopeCeiling, DigestMultibase, Ext, ExternalAccount, ProviderBucketName, ProviderHttpsUrl, ProviderObjectAction, ProviderObjectPrefix, SecretFingerprint, SuiMoveCall } from "../../../../../_shared/components.js";
+/**
+ * Rotate an external account's key: stage, confirm or abandon. The outer document members are owned by the framework — SPEC §6.3.
+ */
+export interface ExternalAccountsKeysRotatePayload {
+    context: AccountContextId;
+    id: AccountId;
+    phase: "stage" | "confirm" | "abandon";
+    ext?: Ext;
+}
+export interface ExternalAccountsKeysRotateResponsePayload {
+    account: ExternalAccount;
+    /**
+     * On `stage` only.
+     */
+    setup?: AccountSetupArtifacts;
+    ext?: Ext;
+}
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { AccountBinding, AccountContextId, AccountId, AccountProbeReport, AccountProbeStep, AccountPublicMaterial, AccountSecretInfo, AccountSettings, AccountSetupArtifacts, AccountState, AuthModel, AwsArn, AwsRegion, CredentialScopeCeiling, DigestMultibase, Ext, ExternalAccount, ProviderBucketName, ProviderHttpsUrl, ProviderObjectAction, ProviderObjectPrefix, SecretFingerprint, SuiMoveCall };
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/external/accounts/keys/rotate/0.1";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = ExternalAccountsKeysRotatePayload;
+/** Trust Task response type URI (request type URI + "#response"). */
+export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/external/accounts/keys/rotate/0.1#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = ExternalAccountsKeysRotateResponsePayload;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/external/accounts/keys/rotate/0.1";
+    readonly title: "External Accounts — Keys — Rotate — payload";
+    readonly description: "Rotate an external account's key: stage, confirm or abandon. The outer document members are owned by the framework — SPEC §6.3.";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["context", "id", "phase"];
+    readonly properties: {
+        readonly context: {
+            readonly $ref: "#/$defs/AccountContextId";
+        };
+        readonly id: {
+            readonly $ref: "#/$defs/AccountId";
+        };
+        readonly phase: {
+            readonly type: "string";
+            readonly enum: readonly ["stage", "confirm", "abandon"];
+        };
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+        };
+    };
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "External Accounts — Keys — Rotate — response payload";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["account"];
+            readonly properties: {
+                readonly account: {
+                    readonly $ref: "#/$defs/ExternalAccount";
+                };
+                readonly setup: {
+                    readonly $ref: "#/$defs/AccountSetupArtifacts";
+                    readonly description: "On `stage` only.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly AccountSetupArtifacts: {
+            readonly title: "AccountSetupArtifacts";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["model", "artifacts", "steps"];
+            readonly description: "What an administrator does at the provider to make an account usable, generated by the custodian from the account's settings, public material and bindings. Public material and policy only: never a private key or secret, and the custodian never asks for the provider's administrator credentials.";
+            readonly properties: {
+                readonly model: {
+                    readonly $ref: "#/$defs/AuthModel";
+                };
+                readonly artifacts: {
+                    readonly type: "array";
+                    readonly maxItems: 16;
+                    readonly items: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["name", "mediaType", "content"];
+                        readonly properties: {
+                            readonly name: {
+                                readonly type: "string";
+                                readonly maxLength: 128;
+                                readonly pattern: "^[A-Za-z0-9._-]+$";
+                                readonly description: "File name to save it under: `trust-anchor.pem`, `jwks.json`, `permissions-policy.json`, `crl.pem`.";
+                            };
+                            readonly mediaType: {
+                                readonly type: "string";
+                                readonly maxLength: 128;
+                                readonly pattern: "^[a-z]+/[a-z0-9.+-]+$";
+                            };
+                            readonly content: {
+                                readonly type: "string";
+                                readonly maxLength: 65536;
+                            };
+                        };
+                    };
+                };
+                readonly steps: {
+                    readonly type: "array";
+                    readonly maxItems: 32;
+                    readonly items: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["description"];
+                        readonly properties: {
+                            readonly description: {
+                                readonly type: "string";
+                                readonly maxLength: 1024;
+                            };
+                            readonly command: {
+                                readonly type: "string";
+                                readonly maxLength: 8192;
+                                readonly description: "A provider CLI command (`aws rolesanywhere create-trust-anchor …`, `gcloud iam workload-identity-pools providers create-oidc … --jwk-json-path`, `az ad app credential reset --cert …`), referring to artifacts by `name`.";
+                            };
+                        };
+                    };
+                };
+            };
+        };
+        readonly AuthModel: {
+            readonly title: "AuthModel";
+            readonly type: "string";
+            readonly enum: readonly ["aws-roles-anywhere", "gcp-wif-pinned", "azure-cert", "oauth2-private-key-jwt", "s3-static-presign", "sui-signer", "static-secret"];
+            readonly description: "How the account authenticates to its provider. Every model pins the custodian's verification material in the provider's own account, uploaded once, so no model requires the custodian to be reachable from the internet. `aws-roles-anywhere`: the custodian is the certificate authority of an IAM Roles Anywhere trust anchor, and signs CreateSession with a short-lived end-entity certificate it issued to the account's own key. `gcp-wif-pinned`: a Workload Identity Federation pool provider holds an uploaded JWKS; the custodian signs an ID token and exchanges it at Google's STS. `azure-cert`: a certificate uploaded to an Entra app registration; the custodian signs an RFC 7523 client assertion. `oauth2-private-key-jwt`: the same RFC 7523 client authentication against any token endpoint that registered the custodian's public key. `s3-static-presign`: an access-key pair for an S3-compatible store that cannot federate; the custodian presigns per-object URLs and never releases the key. `sui-signer`: a Sui address derived from the custodian's key; the custodian signs only allow-listed transactions. `static-secret`: an API key or token used inside the custodian by a named driver; last resort, never released.\n\nPlain OpenID Connect discovery federation is deliberately absent. It works by the provider fetching the issuer's JWKS from a public URL, which either makes the custodian reachable from the internet or makes whoever hosts a copy of the JWKS able to mint credentials for every federated role.";
+        };
+        readonly ExternalAccount: {
+            readonly title: "ExternalAccount";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["id", "label", "context", "settings", "state", "bindings", "egressHosts", "providerSetupRequired", "createdAt", "updatedAt"];
+            readonly description: "An account as every read returns it. Contains no private key, no secret and no issued credential, to any reader.";
+            readonly properties: {
+                readonly id: {
+                    readonly $ref: "#/$defs/AccountId";
+                };
+                readonly label: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 128;
+                    readonly description: "Display name. Untrusted text: render it, never interpret it.";
+                };
+                readonly context: {
+                    readonly $ref: "#/$defs/AccountContextId";
+                };
+                readonly settings: {
+                    readonly $ref: "#/$defs/AccountSettings";
+                };
+                readonly state: {
+                    readonly $ref: "#/$defs/AccountState";
+                };
+                readonly publicMaterial: {
+                    readonly $ref: "#/$defs/AccountPublicMaterial";
+                    readonly description: "Absent for the static models, which hold a secret rather than a key.";
+                };
+                readonly secret: {
+                    readonly $ref: "#/$defs/AccountSecretInfo";
+                    readonly description: "Static models only; absent until the secret is set.";
+                };
+                readonly bindings: {
+                    readonly type: "array";
+                    readonly maxItems: 256;
+                    readonly items: {
+                        readonly $ref: "#/$defs/AccountBinding";
+                    };
+                };
+                readonly egressHosts: {
+                    readonly type: "array";
+                    readonly maxItems: 8;
+                    readonly items: {
+                        readonly type: "string";
+                        readonly maxLength: 253;
+                        readonly pattern: "^[a-z0-9.-]+$";
+                    };
+                    readonly description: "The provider hosts the custodian connects to on this account's behalf, derived by the custodian from its settings: the token or session endpoints issuance uses, and the destinations external/accounts/probe dials (the object store's host, for a storage model). The custodian MUST NOT connect anywhere else on the account's behalf, so an egress proxy can allow exactly this set. Empty only for a model that neither exchanges nor probes over the network.";
+                };
+                readonly providerSetupRequired: {
+                    readonly type: "boolean";
+                    readonly description: "True when the account cannot be used until its provider-side setup is redone: after a restore that could not carry its key or secret (a wrapped RSA key, a static secret), or after a rotation awaiting confirmation.";
+                };
+                readonly lastProbe: {
+                    readonly $ref: "#/$defs/AccountProbeReport";
+                };
+                readonly createdAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly updatedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+            };
+        };
+        readonly AccountProbeReport: {
+            readonly title: "AccountProbeReport";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["at", "ok", "complete", "steps"];
+            readonly properties: {
+                readonly at: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly ok: {
+                    readonly type: "boolean";
+                    readonly description: "True when every step that ran succeeded.";
+                };
+                readonly complete: {
+                    readonly type: "boolean";
+                    readonly description: "True only when the canary steps (`put`, `get`, `delete`, or the model's equivalent) ran, so the account was exercised end to end. A probe that stopped after `exchange` because nothing named a canary prefix is `complete: false` even when `ok` is true, and does not clear `providerSetupRequired`.";
+                };
+                readonly steps: {
+                    readonly type: "array";
+                    readonly maxItems: 8;
+                    readonly items: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["step", "ok"];
+                        readonly properties: {
+                            readonly step: {
+                                readonly $ref: "#/$defs/AccountProbeStep";
+                            };
+                            readonly ok: {
+                                readonly type: "boolean";
+                            };
+                            readonly durationMs: {
+                                readonly type: "integer";
+                                readonly minimum: 0;
+                            };
+                            readonly providerError: {
+                                readonly type: "string";
+                                readonly maxLength: 2048;
+                                readonly description: "The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.";
+                            };
+                            readonly providerRequestId: {
+                                readonly type: "string";
+                                readonly maxLength: 256;
+                                readonly pattern: "^[!-~]+$";
+                            };
+                        };
+                    };
+                    readonly description: "In order; the first failing step ends the probe.";
+                };
+            };
+        };
+        readonly AccountProbeStep: {
+            readonly title: "AccountProbeStep";
+            readonly type: "string";
+            readonly enum: readonly ["sign", "exchange", "put", "get", "delete", "decode"];
+            readonly description: "`sign`: the custodian signed its assertion, session request or test transaction. `exchange`: the provider issued a credential for it. `put`, `get`, `delete`: one canary object at the narrowest scope of the account's bindings. `decode`: for `sui-signer`, a built test transaction passed the allow-list (it is never submitted).";
+        };
+        readonly AccountBinding: {
+            readonly title: "AccountBinding";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["consumer", "maxTtlSeconds", "ratePerMinute"];
+            readonly description: "Who may use an account, and how far. One binding per consumer per account. A binding is checked before anything is signed: the caller must be `consumer`, proven by the request's own proof; the request must sit inside `scopeCeiling`; its TTL must not exceed `maxTtlSeconds`; and the binding's rate must not be exhausted.";
+            readonly properties: {
+                readonly consumer: {
+                    readonly type: "string";
+                    readonly minLength: 7;
+                    readonly maxLength: 2048;
+                    readonly pattern: "^did:[a-z0-9]+:\\S+$";
+                    readonly description: "The DID of the integration allowed to use the account.";
+                };
+                readonly scopeCeiling: {
+                    readonly $ref: "#/$defs/CredentialScopeCeiling";
+                    readonly description: "Required for storage and OAuth models; absent for `sui-signer`, whose ceiling is the account's own allow-list and caps.";
+                };
+                readonly maxTtlSeconds: {
+                    readonly type: "integer";
+                    readonly minimum: 60;
+                    readonly maximum: 3600;
+                    readonly description: "The longest credential lifetime the consumer may request. 900 (15 minutes) is RECOMMENDED; the ceiling is one hour.";
+                };
+                readonly ratePerMinute: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                    readonly maximum: 600;
+                    readonly description: "Issuances or signatures per minute for this binding.";
+                };
+                readonly sourceCidrs: {
+                    readonly type: "array";
+                    readonly maxItems: 16;
+                    readonly items: {
+                        readonly type: "string";
+                        readonly maxLength: 49;
+                        readonly pattern: "^[0-9a-fA-F:.]+/[0-9]{1,3}$";
+                    };
+                    readonly description: "Where the provider supports it (`aws:SourceIp`), issued credentials are pinned to these networks, so a credential lifted from the consumer is useless elsewhere.";
+                };
+                readonly grantedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+            };
+        };
+        readonly CredentialScopeCeiling: {
+            readonly title: "CredentialScopeCeiling";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly description: "The widest scope a binding's consumer may request. An issuance is inside the ceiling when its `prefix` begins with one of `prefixes`, every one of its `actions` is in `actions`, and every one of its `scopes` is in `scopes`. Absent members confer nothing: a ceiling with no `prefixes` permits no storage issuance.";
+            readonly properties: {
+                readonly prefixes: {
+                    readonly type: "array";
+                    readonly minItems: 1;
+                    readonly maxItems: 64;
+                    readonly uniqueItems: true;
+                    readonly items: {
+                        readonly $ref: "#/$defs/ProviderObjectPrefix";
+                    };
+                };
+                readonly actions: {
+                    readonly type: "array";
+                    readonly minItems: 1;
+                    readonly maxItems: 3;
+                    readonly uniqueItems: true;
+                    readonly items: {
+                        readonly $ref: "#/$defs/ProviderObjectAction";
+                    };
+                };
+                readonly scopes: {
+                    readonly type: "array";
+                    readonly maxItems: 64;
+                    readonly uniqueItems: true;
+                    readonly items: {
+                        readonly type: "string";
+                        readonly maxLength: 256;
+                        readonly pattern: "^[!#-\\[\\]-~]+$";
+                    };
+                };
+            };
+        };
+        readonly ProviderObjectAction: {
+            readonly title: "ProviderObjectAction";
+            readonly type: "string";
+            readonly enum: readonly ["put", "get", "delete"];
+            readonly description: "`put`: write an object. `get`: read one. `delete`: remove one. No list, ACL, policy or bucket-level action exists here, so none can be granted.";
+        };
+        readonly ProviderObjectPrefix: {
+            readonly title: "ProviderObjectPrefix";
+            readonly type: "string";
+            readonly minLength: 2;
+            readonly maxLength: 512;
+            readonly pattern: "^([a-z0-9][a-z0-9._-]{0,127}/){1,16}$";
+            readonly description: "An object-key prefix within the account's bucket: one or more segments of lowercase letters, digits, `.`, `_` and `-`, each beginning with a letter or digit and ending with `/`. No quote, backslash, wildcard, whitespace, `..` segment or empty segment can appear. That is deliberate: the custodian places this value inside a provider policy — an IAM session policy (JSON), a GCS Credential Access Boundary condition (CEL) — and a value able to carry a metacharacter can break out of the string it is placed in and widen the policy. That is a known class of defect (CVE-2026-42811, a CEL injection in downscoped GCS credentials). Even with this pattern, a custodian MUST build provider policies with the provider language's own encoder, never by string interpolation.";
+        };
+        readonly AccountSecretInfo: {
+            readonly title: "AccountSecretInfo";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["fingerprint", "setAt"];
+            readonly description: "That a static model's secret is set, and which one. Never its value.";
+            readonly properties: {
+                readonly fingerprint: {
+                    readonly $ref: "#/$defs/SecretFingerprint";
+                };
+                readonly setAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+            };
+        };
+        readonly SecretFingerprint: {
+            readonly title: "SecretFingerprint";
+            readonly type: "string";
+            readonly pattern: "^hmacsha256:[A-Za-z0-9_-]{22}$";
+            readonly maxLength: 33;
+            readonly description: "Which secret is set, without being a way to test guesses at it. `hmacsha256:` followed by the base64url encoding, without padding, of the first 16 bytes of HMAC-SHA256 over the secret's bytes under a fingerprint key the custodian holds and never discloses. Comparable only between fingerprints made by the same custodian: a re-entered value can be confirmed, while the same secret at two custodians gives unrelated fingerprints. Never a bare hash of the secret, which would let anyone who reads it run a dictionary against it offline; and deliberately not a DigestMultibase, since multihash has no code for a keyed digest.";
+        };
+        readonly AccountPublicMaterial: {
+            readonly title: "AccountPublicMaterial";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["algorithm", "keyFingerprint"];
+            readonly description: "The public half of the account's key, as the provider needs it. Never a private key.";
+            readonly properties: {
+                readonly algorithm: {
+                    readonly type: "string";
+                    readonly enum: readonly ["ES256", "RS256", "Secp256r1"];
+                };
+                readonly keyFingerprint: {
+                    readonly $ref: "#/$defs/DigestMultibase";
+                    readonly description: "Digest of the public key's SubjectPublicKeyInfo DER.";
+                };
+                readonly publicKeyJwk: {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kty", "kid"];
+                    readonly description: "The public key as a JWK, with `kid`. Public members only: the schema admits no private member (`d`, `p`, `q`, `dp`, `dq`, `qi`), so a document carrying one fails validation.";
+                    readonly properties: {
+                        readonly kty: {
+                            readonly type: "string";
+                            readonly enum: readonly ["EC", "RSA"];
+                        };
+                        readonly crv: {
+                            readonly type: "string";
+                            readonly enum: readonly ["P-256"];
+                        };
+                        readonly x: {
+                            readonly type: "string";
+                            readonly maxLength: 1024;
+                            readonly pattern: "^[A-Za-z0-9_-]+$";
+                        };
+                        readonly y: {
+                            readonly type: "string";
+                            readonly maxLength: 1024;
+                            readonly pattern: "^[A-Za-z0-9_-]+$";
+                        };
+                        readonly n: {
+                            readonly type: "string";
+                            readonly maxLength: 1024;
+                            readonly pattern: "^[A-Za-z0-9_-]+$";
+                        };
+                        readonly e: {
+                            readonly type: "string";
+                            readonly maxLength: 16;
+                            readonly pattern: "^[A-Za-z0-9_-]+$";
+                        };
+                        readonly kid: {
+                            readonly type: "string";
+                            readonly maxLength: 128;
+                            readonly pattern: "^[!-~]+$";
+                        };
+                        readonly alg: {
+                            readonly type: "string";
+                            readonly enum: readonly ["ES256", "RS256"];
+                        };
+                        readonly use: {
+                            readonly type: "string";
+                            readonly const: "sig";
+                        };
+                    };
+                };
+                readonly certificatePem: {
+                    readonly type: "string";
+                    readonly maxLength: 16384;
+                    readonly pattern: "^-----BEGIN CERTIFICATE-----[A-Za-z0-9+/=\\r\\n]+-----END CERTIFICATE-----\\s*$";
+                    readonly description: "`aws-roles-anywhere`: the trust anchor's CA certificate. `azure-cert`: the certificate uploaded to the app registration.";
+                };
+                readonly address: {
+                    readonly type: "string";
+                    readonly pattern: "^0x[0-9a-f]{64}$";
+                    readonly description: "`sui-signer`: the Sui address the key controls.";
+                };
+                readonly pendingKeyFingerprint: {
+                    readonly $ref: "#/$defs/DigestMultibase";
+                    readonly description: "During a rotation (external/accounts/keys/rotate), the staged successor key, until it is confirmed and the current key retires.";
+                };
+            };
+        };
+        readonly DigestMultibase: {
+            readonly title: "DigestMultibase";
+            readonly description: "A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.\n\nMultihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.\n\nThis definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.\n\nRestricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that \"interoperability is not guaranteed between implementations using such values\", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.";
+            readonly type: "string";
+            readonly minLength: 16;
+            readonly pattern: "^(z[1-9A-HJ-NP-Za-km-z]+|u[A-Za-z0-9_-]+)$";
+            readonly examples: readonly ["zQmbWqxBEKC3P8tqsKc98xmWNzrzDtRLMiMPL8wBuTGsMnR"];
+        };
+        readonly AccountState: {
+            readonly title: "AccountState";
+            readonly type: "string";
+            readonly enum: readonly ["active", "suspended", "archived"];
+            readonly description: "`active`: usable by its bindings. `suspended`: every issuance and signature is refused at once; management reads continue; resumable. `archived`: hidden from default listings, refused for use, restorable. Deletion removes the record.";
+        };
+        readonly AccountSettings: {
+            readonly title: "AccountSettings";
+            readonly description: "Per-model account settings, discriminated by `model`: every branch is an object whose `model` member is a `const`, which is what lets each generated binding emit a tagged union, so an unusable setting is answered as `external:invalidSettings` naming the member rather than as an unparseable payload. Never a secret: every value here is returned to anyone who may read the account. Branches are referred to by their `model` (\"the `sui-signer` settings\"). They carry no `title`, so that every binding renders each as a plain variant of this union.";
+            readonly oneOf: readonly [{
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["model", "region", "profileArn", "roleArn", "trustAnchorArn"];
+                readonly description: "Egress: `rolesanywhere.<region>.amazonaws.com`, plus `sts.<region>.amazonaws.com` when `chainedRoleArn` is set.";
+                readonly properties: {
+                    readonly model: {
+                        readonly type: "string";
+                        readonly const: "aws-roles-anywhere";
+                    };
+                    readonly region: {
+                        readonly $ref: "#/$defs/AwsRegion";
+                    };
+                    readonly trustAnchorArn: {
+                        readonly $ref: "#/$defs/AwsArn";
+                        readonly description: "The trust anchor holding the custodian's CA certificate. Recorded after the administrator creates it from external/accounts/setup.";
+                    };
+                    readonly profileArn: {
+                        readonly $ref: "#/$defs/AwsArn";
+                    };
+                    readonly roleArn: {
+                        readonly $ref: "#/$defs/AwsArn";
+                    };
+                    readonly chainedRoleArn: {
+                        readonly $ref: "#/$defs/AwsArn";
+                        readonly description: "When set, every issuance chains an AssumeRole into this role carrying the downscoping session policy, for deployments whose Roles Anywhere profile cannot carry one per request. Caps a credential at one hour.";
+                    };
+                    readonly bucket: {
+                        readonly $ref: "#/$defs/ProviderBucketName";
+                        readonly description: "The S3 bucket issuances are scoped within. Required for an account whose bindings issue storage scopes.";
+                    };
+                    readonly probePrefix: {
+                        readonly $ref: "#/$defs/ProviderObjectPrefix";
+                        readonly description: "Where external/accounts/probe writes its canary when no binding names a narrower prefix. Lets a new account be probed before anything is bound to it. Absent, a probe of an account with no bindings stops after `exchange` and reports `complete: false`.";
+                    };
+                };
+            }, {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["model", "projectNumber", "poolId", "providerId"];
+                readonly description: "Egress: `sts.googleapis.com`, plus `iamcredentials.googleapis.com` when `serviceAccount` is set.";
+                readonly properties: {
+                    readonly model: {
+                        readonly type: "string";
+                        readonly const: "gcp-wif-pinned";
+                    };
+                    readonly projectNumber: {
+                        readonly type: "string";
+                        readonly pattern: "^[0-9]{1,20}$";
+                    };
+                    readonly poolId: {
+                        readonly type: "string";
+                        readonly pattern: "^[a-z0-9-]{4,32}$";
+                    };
+                    readonly providerId: {
+                        readonly type: "string";
+                        readonly pattern: "^[a-z0-9-]{4,32}$";
+                    };
+                    readonly serviceAccount: {
+                        readonly type: "string";
+                        readonly maxLength: 254;
+                        readonly pattern: "^[a-z0-9-]+@[a-z0-9-]+\\.iam\\.gserviceaccount\\.com$";
+                        readonly description: "When set, the federated token is exchanged for this service account's access token.";
+                    };
+                    readonly signingAlgorithm: {
+                        readonly type: "string";
+                        readonly enum: readonly ["ES256", "RS256"];
+                        readonly description: "The ID-token algorithm. ES256 unless the provider refuses it. Absent means ES256.";
+                    };
+                    readonly bucket: {
+                        readonly $ref: "#/$defs/ProviderBucketName";
+                        readonly description: "The GCS bucket issuances are scoped within, by a Credential Access Boundary.";
+                    };
+                    readonly probePrefix: {
+                        readonly $ref: "#/$defs/ProviderObjectPrefix";
+                        readonly description: "Where external/accounts/probe writes its canary when no binding names a narrower prefix. Lets a new account be probed before anything is bound to it. Absent, a probe of an account with no bindings stops after `exchange` and reports `complete: false`.";
+                    };
+                };
+            }, {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["model", "tenantId", "clientId", "tokenScope"];
+                readonly description: "Egress: `login.microsoftonline.com`, or the sovereign-cloud authority named in `authorityHost`.";
+                readonly properties: {
+                    readonly model: {
+                        readonly type: "string";
+                        readonly const: "azure-cert";
+                    };
+                    readonly tenantId: {
+                        readonly type: "string";
+                        readonly pattern: "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$";
+                    };
+                    readonly clientId: {
+                        readonly type: "string";
+                        readonly pattern: "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$";
+                    };
+                    readonly tokenScope: {
+                        readonly type: "string";
+                        readonly maxLength: 512;
+                        readonly pattern: "^[A-Za-z0-9:/._-]+$";
+                        readonly description: "The `scope` requested at the token endpoint, such as `https://storage.azure.com/.default`.";
+                    };
+                    readonly authorityHost: {
+                        readonly type: "string";
+                        readonly maxLength: 253;
+                        readonly pattern: "^[a-z0-9.-]+$";
+                        readonly description: "Absent means `login.microsoftonline.com`.";
+                    };
+                };
+            }, {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["model", "tokenEndpoint", "clientId"];
+                readonly description: "Egress: the host of `tokenEndpoint`, and nothing else.";
+                readonly properties: {
+                    readonly model: {
+                        readonly type: "string";
+                        readonly const: "oauth2-private-key-jwt";
+                    };
+                    readonly tokenEndpoint: {
+                        readonly $ref: "#/$defs/ProviderHttpsUrl";
+                    };
+                    readonly clientId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 512;
+                        readonly pattern: "^[!-~]+$";
+                    };
+                    readonly audience: {
+                        readonly type: "string";
+                        readonly maxLength: 2048;
+                        readonly pattern: "^[!-~]+$";
+                        readonly description: "The assertion's `aud`. Absent means `tokenEndpoint`.";
+                    };
+                    readonly scopes: {
+                        readonly type: "array";
+                        readonly maxItems: 64;
+                        readonly uniqueItems: true;
+                        readonly items: {
+                            readonly type: "string";
+                            readonly maxLength: 256;
+                            readonly pattern: "^[!#-\\[\\]-~]+$";
+                        };
+                        readonly description: "The scopes a binding may request, the ceiling for every issuance.";
+                    };
+                    readonly signingAlgorithm: {
+                        readonly type: "string";
+                        readonly enum: readonly ["ES256", "RS256"];
+                    };
+                };
+            }, {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["model", "endpoint", "region", "bucket", "accessKeyId"];
+                readonly description: "Issuance needs no egress: presigning is a computation inside the custodian, and the consumer uses the URL itself. The probe connects to the host of `endpoint`, which `egressHosts` therefore lists.";
+                readonly properties: {
+                    readonly model: {
+                        readonly type: "string";
+                        readonly const: "s3-static-presign";
+                    };
+                    readonly endpoint: {
+                        readonly $ref: "#/$defs/ProviderHttpsUrl";
+                    };
+                    readonly region: {
+                        readonly type: "string";
+                        readonly maxLength: 64;
+                        readonly pattern: "^[a-z0-9-]+$";
+                        readonly description: "The SigV4 signing region; `auto` for Cloudflare R2.";
+                    };
+                    readonly bucket: {
+                        readonly $ref: "#/$defs/ProviderBucketName";
+                    };
+                    readonly pathStyle: {
+                        readonly type: "boolean";
+                        readonly description: "Address the bucket in the path rather than the host name, as MinIO usually needs.";
+                    };
+                    readonly accessKeyId: {
+                        readonly type: "string";
+                        readonly maxLength: 128;
+                        readonly pattern: "^[A-Za-z0-9]+$";
+                        readonly description: "The access key's identifier. Not a secret: it appears in every presigned URL. The secret half is set with external/accounts/secret/set and never returned.";
+                    };
+                    readonly probePrefix: {
+                        readonly $ref: "#/$defs/ProviderObjectPrefix";
+                        readonly description: "Where external/accounts/probe writes its canary when no binding names a narrower prefix. Lets a new account be probed before anything is bound to it. Absent, a probe of an account with no bindings stops after `exchange` and reports `complete: false`.";
+                    };
+                };
+            }, {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["model", "network", "allowedCalls", "maxGasBudgetMist", "maxGasPerDayMist"];
+                readonly description: "No egress: the custodian signs and the consumer submits the transaction. The allow-list, the gas caps and the coin caps are the account's whole authority; a transaction outside them is refused before anything is signed.";
+                readonly properties: {
+                    readonly model: {
+                        readonly type: "string";
+                        readonly const: "sui-signer";
+                    };
+                    readonly network: {
+                        readonly type: "string";
+                        readonly enum: readonly ["mainnet", "testnet", "devnet"];
+                    };
+                    readonly allowedCalls: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly maxItems: 32;
+                        readonly items: {
+                            readonly $ref: "#/$defs/SuiMoveCall";
+                        };
+                        readonly description: "Every MoveCall command in a signed transaction must name one of these. For Walrus storage: the system package's `register_blob`, `certify_blob`, `extend_blob` and `delete_blob`, and the coin calls needed to pay for them.";
+                    };
+                    readonly allowedObjects: {
+                        readonly type: "array";
+                        readonly maxItems: 32;
+                        readonly items: {
+                            readonly type: "string";
+                            readonly pattern: "^0x[0-9a-f]{64}$";
+                        };
+                        readonly description: "Shared objects a transaction may take as input, such as the Walrus system and staking objects. Absent means any object the allowed calls accept.";
+                    };
+                    readonly maxGasBudgetMist: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                        readonly description: "The largest gas budget one transaction may declare.";
+                    };
+                    readonly maxGasPerDayMist: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                        readonly description: "The total gas budget signed per rolling 24 hours.";
+                    };
+                    readonly maxCoinOutPerTx: {
+                        readonly type: "array";
+                        readonly maxItems: 8;
+                        readonly items: {
+                            readonly type: "object";
+                            readonly additionalProperties: false;
+                            readonly required: readonly ["coinType", "amount"];
+                            readonly properties: {
+                                readonly coinType: {
+                                    readonly type: "string";
+                                    readonly maxLength: 512;
+                                    readonly pattern: "^0x[0-9a-f]{1,64}::[A-Za-z0-9_]+::[A-Za-z0-9_]+$";
+                                };
+                                readonly amount: {
+                                    readonly type: "integer";
+                                    readonly minimum: 0;
+                                };
+                            };
+                        };
+                        readonly description: "Per coin type, the most a single transaction may spend or transfer out of the account's address, in the coin's smallest unit. A coin type not listed may not leave the address at all.";
+                    };
+                };
+            }, {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["model", "driver", "baseUrl"];
+                readonly description: "Egress: the host of `baseUrl`. The secret is set with external/accounts/secret/set and used only inside the custodian by `driver`; a provider reachable only by handing the consumer the raw key is not supported.";
+                readonly properties: {
+                    readonly model: {
+                        readonly type: "string";
+                        readonly const: "static-secret";
+                    };
+                    readonly driver: {
+                        readonly type: "string";
+                        readonly maxLength: 64;
+                        readonly pattern: "^[a-z0-9][a-z0-9-]*$";
+                        readonly description: "The custodian's driver that uses the secret: performs a login or token exchange and returns a short-lived result. A custodian refuses a driver it does not implement.";
+                    };
+                    readonly baseUrl: {
+                        readonly $ref: "#/$defs/ProviderHttpsUrl";
+                    };
+                };
+            }];
+        };
+        readonly ProviderHttpsUrl: {
+            readonly title: "ProviderHttpsUrl";
+            readonly type: "string";
+            readonly format: "uri";
+            readonly maxLength: 2048;
+            readonly pattern: "^https://[^\\s\"'\\\\]+$";
+        };
+        readonly SuiMoveCall: {
+            readonly title: "SuiMoveCall";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["package", "module", "function"];
+            readonly description: "One Move function an account's transactions may call.";
+            readonly properties: {
+                readonly package: {
+                    readonly type: "string";
+                    readonly pattern: "^0x[0-9a-f]{64}$";
+                };
+                readonly module: {
+                    readonly type: "string";
+                    readonly pattern: "^[A-Za-z][A-Za-z0-9_]{0,127}$";
+                };
+                readonly function: {
+                    readonly type: "string";
+                    readonly pattern: "^[A-Za-z][A-Za-z0-9_]{0,127}$";
+                };
+            };
+        };
+        readonly ProviderBucketName: {
+            readonly title: "ProviderBucketName";
+            readonly type: "string";
+            readonly minLength: 3;
+            readonly maxLength: 63;
+            readonly pattern: "^[a-z0-9][a-z0-9.-]*[a-z0-9]$";
+            readonly description: "A bucket name as S3 and GCS accept it. Validated rather than free so that it can be placed in a provider policy without escaping.";
+        };
+        readonly AwsArn: {
+            readonly title: "AwsArn";
+            readonly type: "string";
+            readonly maxLength: 2048;
+            readonly pattern: "^arn:aws[a-z-]*:[a-z0-9-]+:[a-z0-9-]*:[0-9]{0,12}:[A-Za-z0-9+=,.@_/:-]+$";
+        };
+        readonly AwsRegion: {
+            readonly title: "AwsRegion";
+            readonly type: "string";
+            readonly pattern: "^[a-z]{2}(-gov)?-[a-z]+-[0-9]$";
+            readonly maxLength: 32;
+        };
+        readonly AccountContextId: {
+            readonly title: "AccountContextId";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 256;
+            readonly description: "The custodian context that owns the account. Act scope in this context decides who may manage the account and who may consume it; the account's keys are derived in this context's key space.";
+        };
+        readonly AccountId: {
+            readonly title: "AccountId";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 64;
+            readonly pattern: "^[a-z0-9][a-z0-9-]*$";
+            readonly description: "The account's identifier within its context, chosen by whoever creates it. Lowercase letters, digits and hyphens, so that it can be embedded in a certificate subject, a token subject or a provider-side condition without escaping. Unique per context; never reused after deletion while anything that names it (a provider-side trust policy, an audit row) may still exist.";
+        };
+    };
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export declare const RESPONSE_PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $ref: "#/$defs/Response";
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "External Accounts — Keys — Rotate — response payload";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["account"];
+            readonly properties: {
+                readonly account: {
+                    readonly $ref: "#/$defs/ExternalAccount";
+                };
+                readonly setup: {
+                    readonly $ref: "#/$defs/AccountSetupArtifacts";
+                    readonly description: "On `stage` only.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly AccountSetupArtifacts: {
+            readonly title: "AccountSetupArtifacts";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["model", "artifacts", "steps"];
+            readonly description: "What an administrator does at the provider to make an account usable, generated by the custodian from the account's settings, public material and bindings. Public material and policy only: never a private key or secret, and the custodian never asks for the provider's administrator credentials.";
+            readonly properties: {
+                readonly model: {
+                    readonly $ref: "#/$defs/AuthModel";
+                };
+                readonly artifacts: {
+                    readonly type: "array";
+                    readonly maxItems: 16;
+                    readonly items: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["name", "mediaType", "content"];
+                        readonly properties: {
+                            readonly name: {
+                                readonly type: "string";
+                                readonly maxLength: 128;
+                                readonly pattern: "^[A-Za-z0-9._-]+$";
+                                readonly description: "File name to save it under: `trust-anchor.pem`, `jwks.json`, `permissions-policy.json`, `crl.pem`.";
+                            };
+                            readonly mediaType: {
+                                readonly type: "string";
+                                readonly maxLength: 128;
+                                readonly pattern: "^[a-z]+/[a-z0-9.+-]+$";
+                            };
+                            readonly content: {
+                                readonly type: "string";
+                                readonly maxLength: 65536;
+                            };
+                        };
+                    };
+                };
+                readonly steps: {
+                    readonly type: "array";
+                    readonly maxItems: 32;
+                    readonly items: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["description"];
+                        readonly properties: {
+                            readonly description: {
+                                readonly type: "string";
+                                readonly maxLength: 1024;
+                            };
+                            readonly command: {
+                                readonly type: "string";
+                                readonly maxLength: 8192;
+                                readonly description: "A provider CLI command (`aws rolesanywhere create-trust-anchor …`, `gcloud iam workload-identity-pools providers create-oidc … --jwk-json-path`, `az ad app credential reset --cert …`), referring to artifacts by `name`.";
+                            };
+                        };
+                    };
+                };
+            };
+        };
+        readonly AuthModel: {
+            readonly title: "AuthModel";
+            readonly type: "string";
+            readonly enum: readonly ["aws-roles-anywhere", "gcp-wif-pinned", "azure-cert", "oauth2-private-key-jwt", "s3-static-presign", "sui-signer", "static-secret"];
+            readonly description: "How the account authenticates to its provider. Every model pins the custodian's verification material in the provider's own account, uploaded once, so no model requires the custodian to be reachable from the internet. `aws-roles-anywhere`: the custodian is the certificate authority of an IAM Roles Anywhere trust anchor, and signs CreateSession with a short-lived end-entity certificate it issued to the account's own key. `gcp-wif-pinned`: a Workload Identity Federation pool provider holds an uploaded JWKS; the custodian signs an ID token and exchanges it at Google's STS. `azure-cert`: a certificate uploaded to an Entra app registration; the custodian signs an RFC 7523 client assertion. `oauth2-private-key-jwt`: the same RFC 7523 client authentication against any token endpoint that registered the custodian's public key. `s3-static-presign`: an access-key pair for an S3-compatible store that cannot federate; the custodian presigns per-object URLs and never releases the key. `sui-signer`: a Sui address derived from the custodian's key; the custodian signs only allow-listed transactions. `static-secret`: an API key or token used inside the custodian by a named driver; last resort, never released.\n\nPlain OpenID Connect discovery federation is deliberately absent. It works by the provider fetching the issuer's JWKS from a public URL, which either makes the custodian reachable from the internet or makes whoever hosts a copy of the JWKS able to mint credentials for every federated role.";
+        };
+        readonly ExternalAccount: {
+            readonly title: "ExternalAccount";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["id", "label", "context", "settings", "state", "bindings", "egressHosts", "providerSetupRequired", "createdAt", "updatedAt"];
+            readonly description: "An account as every read returns it. Contains no private key, no secret and no issued credential, to any reader.";
+            readonly properties: {
+                readonly id: {
+                    readonly $ref: "#/$defs/AccountId";
+                };
+                readonly label: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 128;
+                    readonly description: "Display name. Untrusted text: render it, never interpret it.";
+                };
+                readonly context: {
+                    readonly $ref: "#/$defs/AccountContextId";
+                };
+                readonly settings: {
+                    readonly $ref: "#/$defs/AccountSettings";
+                };
+                readonly state: {
+                    readonly $ref: "#/$defs/AccountState";
+                };
+                readonly publicMaterial: {
+                    readonly $ref: "#/$defs/AccountPublicMaterial";
+                    readonly description: "Absent for the static models, which hold a secret rather than a key.";
+                };
+                readonly secret: {
+                    readonly $ref: "#/$defs/AccountSecretInfo";
+                    readonly description: "Static models only; absent until the secret is set.";
+                };
+                readonly bindings: {
+                    readonly type: "array";
+                    readonly maxItems: 256;
+                    readonly items: {
+                        readonly $ref: "#/$defs/AccountBinding";
+                    };
+                };
+                readonly egressHosts: {
+                    readonly type: "array";
+                    readonly maxItems: 8;
+                    readonly items: {
+                        readonly type: "string";
+                        readonly maxLength: 253;
+                        readonly pattern: "^[a-z0-9.-]+$";
+                    };
+                    readonly description: "The provider hosts the custodian connects to on this account's behalf, derived by the custodian from its settings: the token or session endpoints issuance uses, and the destinations external/accounts/probe dials (the object store's host, for a storage model). The custodian MUST NOT connect anywhere else on the account's behalf, so an egress proxy can allow exactly this set. Empty only for a model that neither exchanges nor probes over the network.";
+                };
+                readonly providerSetupRequired: {
+                    readonly type: "boolean";
+                    readonly description: "True when the account cannot be used until its provider-side setup is redone: after a restore that could not carry its key or secret (a wrapped RSA key, a static secret), or after a rotation awaiting confirmation.";
+                };
+                readonly lastProbe: {
+                    readonly $ref: "#/$defs/AccountProbeReport";
+                };
+                readonly createdAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly updatedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+            };
+        };
+        readonly AccountProbeReport: {
+            readonly title: "AccountProbeReport";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["at", "ok", "complete", "steps"];
+            readonly properties: {
+                readonly at: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly ok: {
+                    readonly type: "boolean";
+                    readonly description: "True when every step that ran succeeded.";
+                };
+                readonly complete: {
+                    readonly type: "boolean";
+                    readonly description: "True only when the canary steps (`put`, `get`, `delete`, or the model's equivalent) ran, so the account was exercised end to end. A probe that stopped after `exchange` because nothing named a canary prefix is `complete: false` even when `ok` is true, and does not clear `providerSetupRequired`.";
+                };
+                readonly steps: {
+                    readonly type: "array";
+                    readonly maxItems: 8;
+                    readonly items: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["step", "ok"];
+                        readonly properties: {
+                            readonly step: {
+                                readonly $ref: "#/$defs/AccountProbeStep";
+                            };
+                            readonly ok: {
+                                readonly type: "boolean";
+                            };
+                            readonly durationMs: {
+                                readonly type: "integer";
+                                readonly minimum: 0;
+                            };
+                            readonly providerError: {
+                                readonly type: "string";
+                                readonly maxLength: 2048;
+                                readonly description: "The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.";
+                            };
+                            readonly providerRequestId: {
+                                readonly type: "string";
+                                readonly maxLength: 256;
+                                readonly pattern: "^[!-~]+$";
+                            };
+                        };
+                    };
+                    readonly description: "In order; the first failing step ends the probe.";
+                };
+            };
+        };
+        readonly AccountProbeStep: {
+            readonly title: "AccountProbeStep";
+            readonly type: "string";
+            readonly enum: readonly ["sign", "exchange", "put", "get", "delete", "decode"];
+            readonly description: "`sign`: the custodian signed its assertion, session request or test transaction. `exchange`: the provider issued a credential for it. `put`, `get`, `delete`: one canary object at the narrowest scope of the account's bindings. `decode`: for `sui-signer`, a built test transaction passed the allow-list (it is never submitted).";
+        };
+        readonly AccountBinding: {
+            readonly title: "AccountBinding";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["consumer", "maxTtlSeconds", "ratePerMinute"];
+            readonly description: "Who may use an account, and how far. One binding per consumer per account. A binding is checked before anything is signed: the caller must be `consumer`, proven by the request's own proof; the request must sit inside `scopeCeiling`; its TTL must not exceed `maxTtlSeconds`; and the binding's rate must not be exhausted.";
+            readonly properties: {
+                readonly consumer: {
+                    readonly type: "string";
+                    readonly minLength: 7;
+                    readonly maxLength: 2048;
+                    readonly pattern: "^did:[a-z0-9]+:\\S+$";
+                    readonly description: "The DID of the integration allowed to use the account.";
+                };
+                readonly scopeCeiling: {
+                    readonly $ref: "#/$defs/CredentialScopeCeiling";
+                    readonly description: "Required for storage and OAuth models; absent for `sui-signer`, whose ceiling is the account's own allow-list and caps.";
+                };
+                readonly maxTtlSeconds: {
+                    readonly type: "integer";
+                    readonly minimum: 60;
+                    readonly maximum: 3600;
+                    readonly description: "The longest credential lifetime the consumer may request. 900 (15 minutes) is RECOMMENDED; the ceiling is one hour.";
+                };
+                readonly ratePerMinute: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                    readonly maximum: 600;
+                    readonly description: "Issuances or signatures per minute for this binding.";
+                };
+                readonly sourceCidrs: {
+                    readonly type: "array";
+                    readonly maxItems: 16;
+                    readonly items: {
+                        readonly type: "string";
+                        readonly maxLength: 49;
+                        readonly pattern: "^[0-9a-fA-F:.]+/[0-9]{1,3}$";
+                    };
+                    readonly description: "Where the provider supports it (`aws:SourceIp`), issued credentials are pinned to these networks, so a credential lifted from the consumer is useless elsewhere.";
+                };
+                readonly grantedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+            };
+        };
+        readonly CredentialScopeCeiling: {
+            readonly title: "CredentialScopeCeiling";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly description: "The widest scope a binding's consumer may request. An issuance is inside the ceiling when its `prefix` begins with one of `prefixes`, every one of its `actions` is in `actions`, and every one of its `scopes` is in `scopes`. Absent members confer nothing: a ceiling with no `prefixes` permits no storage issuance.";
+            readonly properties: {
+                readonly prefixes: {
+                    readonly type: "array";
+                    readonly minItems: 1;
+                    readonly maxItems: 64;
+                    readonly uniqueItems: true;
+                    readonly items: {
+                        readonly $ref: "#/$defs/ProviderObjectPrefix";
+                    };
+                };
+                readonly actions: {
+                    readonly type: "array";
+                    readonly minItems: 1;
+                    readonly maxItems: 3;
+                    readonly uniqueItems: true;
+                    readonly items: {
+                        readonly $ref: "#/$defs/ProviderObjectAction";
+                    };
+                };
+                readonly scopes: {
+                    readonly type: "array";
+                    readonly maxItems: 64;
+                    readonly uniqueItems: true;
+                    readonly items: {
+                        readonly type: "string";
+                        readonly maxLength: 256;
+                        readonly pattern: "^[!#-\\[\\]-~]+$";
+                    };
+                };
+            };
+        };
+        readonly ProviderObjectAction: {
+            readonly title: "ProviderObjectAction";
+            readonly type: "string";
+            readonly enum: readonly ["put", "get", "delete"];
+            readonly description: "`put`: write an object. `get`: read one. `delete`: remove one. No list, ACL, policy or bucket-level action exists here, so none can be granted.";
+        };
+        readonly ProviderObjectPrefix: {
+            readonly title: "ProviderObjectPrefix";
+            readonly type: "string";
+            readonly minLength: 2;
+            readonly maxLength: 512;
+            readonly pattern: "^([a-z0-9][a-z0-9._-]{0,127}/){1,16}$";
+            readonly description: "An object-key prefix within the account's bucket: one or more segments of lowercase letters, digits, `.`, `_` and `-`, each beginning with a letter or digit and ending with `/`. No quote, backslash, wildcard, whitespace, `..` segment or empty segment can appear. That is deliberate: the custodian places this value inside a provider policy — an IAM session policy (JSON), a GCS Credential Access Boundary condition (CEL) — and a value able to carry a metacharacter can break out of the string it is placed in and widen the policy. That is a known class of defect (CVE-2026-42811, a CEL injection in downscoped GCS credentials). Even with this pattern, a custodian MUST build provider policies with the provider language's own encoder, never by string interpolation.";
+        };
+        readonly AccountSecretInfo: {
+            readonly title: "AccountSecretInfo";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["fingerprint", "setAt"];
+            readonly description: "That a static model's secret is set, and which one. Never its value.";
+            readonly properties: {
+                readonly fingerprint: {
+                    readonly $ref: "#/$defs/SecretFingerprint";
+                };
+                readonly setAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+            };
+        };
+        readonly SecretFingerprint: {
+            readonly title: "SecretFingerprint";
+            readonly type: "string";
+            readonly pattern: "^hmacsha256:[A-Za-z0-9_-]{22}$";
+            readonly maxLength: 33;
+            readonly description: "Which secret is set, without being a way to test guesses at it. `hmacsha256:` followed by the base64url encoding, without padding, of the first 16 bytes of HMAC-SHA256 over the secret's bytes under a fingerprint key the custodian holds and never discloses. Comparable only between fingerprints made by the same custodian: a re-entered value can be confirmed, while the same secret at two custodians gives unrelated fingerprints. Never a bare hash of the secret, which would let anyone who reads it run a dictionary against it offline; and deliberately not a DigestMultibase, since multihash has no code for a keyed digest.";
+        };
+        readonly AccountPublicMaterial: {
+            readonly title: "AccountPublicMaterial";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["algorithm", "keyFingerprint"];
+            readonly description: "The public half of the account's key, as the provider needs it. Never a private key.";
+            readonly properties: {
+                readonly algorithm: {
+                    readonly type: "string";
+                    readonly enum: readonly ["ES256", "RS256", "Secp256r1"];
+                };
+                readonly keyFingerprint: {
+                    readonly $ref: "#/$defs/DigestMultibase";
+                    readonly description: "Digest of the public key's SubjectPublicKeyInfo DER.";
+                };
+                readonly publicKeyJwk: {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["kty", "kid"];
+                    readonly description: "The public key as a JWK, with `kid`. Public members only: the schema admits no private member (`d`, `p`, `q`, `dp`, `dq`, `qi`), so a document carrying one fails validation.";
+                    readonly properties: {
+                        readonly kty: {
+                            readonly type: "string";
+                            readonly enum: readonly ["EC", "RSA"];
+                        };
+                        readonly crv: {
+                            readonly type: "string";
+                            readonly enum: readonly ["P-256"];
+                        };
+                        readonly x: {
+                            readonly type: "string";
+                            readonly maxLength: 1024;
+                            readonly pattern: "^[A-Za-z0-9_-]+$";
+                        };
+                        readonly y: {
+                            readonly type: "string";
+                            readonly maxLength: 1024;
+                            readonly pattern: "^[A-Za-z0-9_-]+$";
+                        };
+                        readonly n: {
+                            readonly type: "string";
+                            readonly maxLength: 1024;
+                            readonly pattern: "^[A-Za-z0-9_-]+$";
+                        };
+                        readonly e: {
+                            readonly type: "string";
+                            readonly maxLength: 16;
+                            readonly pattern: "^[A-Za-z0-9_-]+$";
+                        };
+                        readonly kid: {
+                            readonly type: "string";
+                            readonly maxLength: 128;
+                            readonly pattern: "^[!-~]+$";
+                        };
+                        readonly alg: {
+                            readonly type: "string";
+                            readonly enum: readonly ["ES256", "RS256"];
+                        };
+                        readonly use: {
+                            readonly type: "string";
+                            readonly const: "sig";
+                        };
+                    };
+                };
+                readonly certificatePem: {
+                    readonly type: "string";
+                    readonly maxLength: 16384;
+                    readonly pattern: "^-----BEGIN CERTIFICATE-----[A-Za-z0-9+/=\\r\\n]+-----END CERTIFICATE-----\\s*$";
+                    readonly description: "`aws-roles-anywhere`: the trust anchor's CA certificate. `azure-cert`: the certificate uploaded to the app registration.";
+                };
+                readonly address: {
+                    readonly type: "string";
+                    readonly pattern: "^0x[0-9a-f]{64}$";
+                    readonly description: "`sui-signer`: the Sui address the key controls.";
+                };
+                readonly pendingKeyFingerprint: {
+                    readonly $ref: "#/$defs/DigestMultibase";
+                    readonly description: "During a rotation (external/accounts/keys/rotate), the staged successor key, until it is confirmed and the current key retires.";
+                };
+            };
+        };
+        readonly DigestMultibase: {
+            readonly title: "DigestMultibase";
+            readonly description: "A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.\n\nMultihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.\n\nThis definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.\n\nRestricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that \"interoperability is not guaranteed between implementations using such values\", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.";
+            readonly type: "string";
+            readonly minLength: 16;
+            readonly pattern: "^(z[1-9A-HJ-NP-Za-km-z]+|u[A-Za-z0-9_-]+)$";
+            readonly examples: readonly ["zQmbWqxBEKC3P8tqsKc98xmWNzrzDtRLMiMPL8wBuTGsMnR"];
+        };
+        readonly AccountState: {
+            readonly title: "AccountState";
+            readonly type: "string";
+            readonly enum: readonly ["active", "suspended", "archived"];
+            readonly description: "`active`: usable by its bindings. `suspended`: every issuance and signature is refused at once; management reads continue; resumable. `archived`: hidden from default listings, refused for use, restorable. Deletion removes the record.";
+        };
+        readonly AccountSettings: {
+            readonly title: "AccountSettings";
+            readonly description: "Per-model account settings, discriminated by `model`: every branch is an object whose `model` member is a `const`, which is what lets each generated binding emit a tagged union, so an unusable setting is answered as `external:invalidSettings` naming the member rather than as an unparseable payload. Never a secret: every value here is returned to anyone who may read the account. Branches are referred to by their `model` (\"the `sui-signer` settings\"). They carry no `title`, so that every binding renders each as a plain variant of this union.";
+            readonly oneOf: readonly [{
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["model", "region", "profileArn", "roleArn", "trustAnchorArn"];
+                readonly description: "Egress: `rolesanywhere.<region>.amazonaws.com`, plus `sts.<region>.amazonaws.com` when `chainedRoleArn` is set.";
+                readonly properties: {
+                    readonly model: {
+                        readonly type: "string";
+                        readonly const: "aws-roles-anywhere";
+                    };
+                    readonly region: {
+                        readonly $ref: "#/$defs/AwsRegion";
+                    };
+                    readonly trustAnchorArn: {
+                        readonly $ref: "#/$defs/AwsArn";
+                        readonly description: "The trust anchor holding the custodian's CA certificate. Recorded after the administrator creates it from external/accounts/setup.";
+                    };
+                    readonly profileArn: {
+                        readonly $ref: "#/$defs/AwsArn";
+                    };
+                    readonly roleArn: {
+                        readonly $ref: "#/$defs/AwsArn";
+                    };
+                    readonly chainedRoleArn: {
+                        readonly $ref: "#/$defs/AwsArn";
+                        readonly description: "When set, every issuance chains an AssumeRole into this role carrying the downscoping session policy, for deployments whose Roles Anywhere profile cannot carry one per request. Caps a credential at one hour.";
+                    };
+                    readonly bucket: {
+                        readonly $ref: "#/$defs/ProviderBucketName";
+                        readonly description: "The S3 bucket issuances are scoped within. Required for an account whose bindings issue storage scopes.";
+                    };
+                    readonly probePrefix: {
+                        readonly $ref: "#/$defs/ProviderObjectPrefix";
+                        readonly description: "Where external/accounts/probe writes its canary when no binding names a narrower prefix. Lets a new account be probed before anything is bound to it. Absent, a probe of an account with no bindings stops after `exchange` and reports `complete: false`.";
+                    };
+                };
+            }, {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["model", "projectNumber", "poolId", "providerId"];
+                readonly description: "Egress: `sts.googleapis.com`, plus `iamcredentials.googleapis.com` when `serviceAccount` is set.";
+                readonly properties: {
+                    readonly model: {
+                        readonly type: "string";
+                        readonly const: "gcp-wif-pinned";
+                    };
+                    readonly projectNumber: {
+                        readonly type: "string";
+                        readonly pattern: "^[0-9]{1,20}$";
+                    };
+                    readonly poolId: {
+                        readonly type: "string";
+                        readonly pattern: "^[a-z0-9-]{4,32}$";
+                    };
+                    readonly providerId: {
+                        readonly type: "string";
+                        readonly pattern: "^[a-z0-9-]{4,32}$";
+                    };
+                    readonly serviceAccount: {
+                        readonly type: "string";
+                        readonly maxLength: 254;
+                        readonly pattern: "^[a-z0-9-]+@[a-z0-9-]+\\.iam\\.gserviceaccount\\.com$";
+                        readonly description: "When set, the federated token is exchanged for this service account's access token.";
+                    };
+                    readonly signingAlgorithm: {
+                        readonly type: "string";
+                        readonly enum: readonly ["ES256", "RS256"];
+                        readonly description: "The ID-token algorithm. ES256 unless the provider refuses it. Absent means ES256.";
+                    };
+                    readonly bucket: {
+                        readonly $ref: "#/$defs/ProviderBucketName";
+                        readonly description: "The GCS bucket issuances are scoped within, by a Credential Access Boundary.";
+                    };
+                    readonly probePrefix: {
+                        readonly $ref: "#/$defs/ProviderObjectPrefix";
+                        readonly description: "Where external/accounts/probe writes its canary when no binding names a narrower prefix. Lets a new account be probed before anything is bound to it. Absent, a probe of an account with no bindings stops after `exchange` and reports `complete: false`.";
+                    };
+                };
+            }, {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["model", "tenantId", "clientId", "tokenScope"];
+                readonly description: "Egress: `login.microsoftonline.com`, or the sovereign-cloud authority named in `authorityHost`.";
+                readonly properties: {
+                    readonly model: {
+                        readonly type: "string";
+                        readonly const: "azure-cert";
+                    };
+                    readonly tenantId: {
+                        readonly type: "string";
+                        readonly pattern: "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$";
+                    };
+                    readonly clientId: {
+                        readonly type: "string";
+                        readonly pattern: "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$";
+                    };
+                    readonly tokenScope: {
+                        readonly type: "string";
+                        readonly maxLength: 512;
+                        readonly pattern: "^[A-Za-z0-9:/._-]+$";
+                        readonly description: "The `scope` requested at the token endpoint, such as `https://storage.azure.com/.default`.";
+                    };
+                    readonly authorityHost: {
+                        readonly type: "string";
+                        readonly maxLength: 253;
+                        readonly pattern: "^[a-z0-9.-]+$";
+                        readonly description: "Absent means `login.microsoftonline.com`.";
+                    };
+                };
+            }, {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["model", "tokenEndpoint", "clientId"];
+                readonly description: "Egress: the host of `tokenEndpoint`, and nothing else.";
+                readonly properties: {
+                    readonly model: {
+                        readonly type: "string";
+                        readonly const: "oauth2-private-key-jwt";
+                    };
+                    readonly tokenEndpoint: {
+                        readonly $ref: "#/$defs/ProviderHttpsUrl";
+                    };
+                    readonly clientId: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 512;
+                        readonly pattern: "^[!-~]+$";
+                    };
+                    readonly audience: {
+                        readonly type: "string";
+                        readonly maxLength: 2048;
+                        readonly pattern: "^[!-~]+$";
+                        readonly description: "The assertion's `aud`. Absent means `tokenEndpoint`.";
+                    };
+                    readonly scopes: {
+                        readonly type: "array";
+                        readonly maxItems: 64;
+                        readonly uniqueItems: true;
+                        readonly items: {
+                            readonly type: "string";
+                            readonly maxLength: 256;
+                            readonly pattern: "^[!#-\\[\\]-~]+$";
+                        };
+                        readonly description: "The scopes a binding may request, the ceiling for every issuance.";
+                    };
+                    readonly signingAlgorithm: {
+                        readonly type: "string";
+                        readonly enum: readonly ["ES256", "RS256"];
+                    };
+                };
+            }, {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["model", "endpoint", "region", "bucket", "accessKeyId"];
+                readonly description: "Issuance needs no egress: presigning is a computation inside the custodian, and the consumer uses the URL itself. The probe connects to the host of `endpoint`, which `egressHosts` therefore lists.";
+                readonly properties: {
+                    readonly model: {
+                        readonly type: "string";
+                        readonly const: "s3-static-presign";
+                    };
+                    readonly endpoint: {
+                        readonly $ref: "#/$defs/ProviderHttpsUrl";
+                    };
+                    readonly region: {
+                        readonly type: "string";
+                        readonly maxLength: 64;
+                        readonly pattern: "^[a-z0-9-]+$";
+                        readonly description: "The SigV4 signing region; `auto` for Cloudflare R2.";
+                    };
+                    readonly bucket: {
+                        readonly $ref: "#/$defs/ProviderBucketName";
+                    };
+                    readonly pathStyle: {
+                        readonly type: "boolean";
+                        readonly description: "Address the bucket in the path rather than the host name, as MinIO usually needs.";
+                    };
+                    readonly accessKeyId: {
+                        readonly type: "string";
+                        readonly maxLength: 128;
+                        readonly pattern: "^[A-Za-z0-9]+$";
+                        readonly description: "The access key's identifier. Not a secret: it appears in every presigned URL. The secret half is set with external/accounts/secret/set and never returned.";
+                    };
+                    readonly probePrefix: {
+                        readonly $ref: "#/$defs/ProviderObjectPrefix";
+                        readonly description: "Where external/accounts/probe writes its canary when no binding names a narrower prefix. Lets a new account be probed before anything is bound to it. Absent, a probe of an account with no bindings stops after `exchange` and reports `complete: false`.";
+                    };
+                };
+            }, {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["model", "network", "allowedCalls", "maxGasBudgetMist", "maxGasPerDayMist"];
+                readonly description: "No egress: the custodian signs and the consumer submits the transaction. The allow-list, the gas caps and the coin caps are the account's whole authority; a transaction outside them is refused before anything is signed.";
+                readonly properties: {
+                    readonly model: {
+                        readonly type: "string";
+                        readonly const: "sui-signer";
+                    };
+                    readonly network: {
+                        readonly type: "string";
+                        readonly enum: readonly ["mainnet", "testnet", "devnet"];
+                    };
+                    readonly allowedCalls: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly maxItems: 32;
+                        readonly items: {
+                            readonly $ref: "#/$defs/SuiMoveCall";
+                        };
+                        readonly description: "Every MoveCall command in a signed transaction must name one of these. For Walrus storage: the system package's `register_blob`, `certify_blob`, `extend_blob` and `delete_blob`, and the coin calls needed to pay for them.";
+                    };
+                    readonly allowedObjects: {
+                        readonly type: "array";
+                        readonly maxItems: 32;
+                        readonly items: {
+                            readonly type: "string";
+                            readonly pattern: "^0x[0-9a-f]{64}$";
+                        };
+                        readonly description: "Shared objects a transaction may take as input, such as the Walrus system and staking objects. Absent means any object the allowed calls accept.";
+                    };
+                    readonly maxGasBudgetMist: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                        readonly description: "The largest gas budget one transaction may declare.";
+                    };
+                    readonly maxGasPerDayMist: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                        readonly description: "The total gas budget signed per rolling 24 hours.";
+                    };
+                    readonly maxCoinOutPerTx: {
+                        readonly type: "array";
+                        readonly maxItems: 8;
+                        readonly items: {
+                            readonly type: "object";
+                            readonly additionalProperties: false;
+                            readonly required: readonly ["coinType", "amount"];
+                            readonly properties: {
+                                readonly coinType: {
+                                    readonly type: "string";
+                                    readonly maxLength: 512;
+                                    readonly pattern: "^0x[0-9a-f]{1,64}::[A-Za-z0-9_]+::[A-Za-z0-9_]+$";
+                                };
+                                readonly amount: {
+                                    readonly type: "integer";
+                                    readonly minimum: 0;
+                                };
+                            };
+                        };
+                        readonly description: "Per coin type, the most a single transaction may spend or transfer out of the account's address, in the coin's smallest unit. A coin type not listed may not leave the address at all.";
+                    };
+                };
+            }, {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["model", "driver", "baseUrl"];
+                readonly description: "Egress: the host of `baseUrl`. The secret is set with external/accounts/secret/set and used only inside the custodian by `driver`; a provider reachable only by handing the consumer the raw key is not supported.";
+                readonly properties: {
+                    readonly model: {
+                        readonly type: "string";
+                        readonly const: "static-secret";
+                    };
+                    readonly driver: {
+                        readonly type: "string";
+                        readonly maxLength: 64;
+                        readonly pattern: "^[a-z0-9][a-z0-9-]*$";
+                        readonly description: "The custodian's driver that uses the secret: performs a login or token exchange and returns a short-lived result. A custodian refuses a driver it does not implement.";
+                    };
+                    readonly baseUrl: {
+                        readonly $ref: "#/$defs/ProviderHttpsUrl";
+                    };
+                };
+            }];
+        };
+        readonly ProviderHttpsUrl: {
+            readonly title: "ProviderHttpsUrl";
+            readonly type: "string";
+            readonly format: "uri";
+            readonly maxLength: 2048;
+            readonly pattern: "^https://[^\\s\"'\\\\]+$";
+        };
+        readonly SuiMoveCall: {
+            readonly title: "SuiMoveCall";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["package", "module", "function"];
+            readonly description: "One Move function an account's transactions may call.";
+            readonly properties: {
+                readonly package: {
+                    readonly type: "string";
+                    readonly pattern: "^0x[0-9a-f]{64}$";
+                };
+                readonly module: {
+                    readonly type: "string";
+                    readonly pattern: "^[A-Za-z][A-Za-z0-9_]{0,127}$";
+                };
+                readonly function: {
+                    readonly type: "string";
+                    readonly pattern: "^[A-Za-z][A-Za-z0-9_]{0,127}$";
+                };
+            };
+        };
+        readonly ProviderBucketName: {
+            readonly title: "ProviderBucketName";
+            readonly type: "string";
+            readonly minLength: 3;
+            readonly maxLength: 63;
+            readonly pattern: "^[a-z0-9][a-z0-9.-]*[a-z0-9]$";
+            readonly description: "A bucket name as S3 and GCS accept it. Validated rather than free so that it can be placed in a provider policy without escaping.";
+        };
+        readonly AwsArn: {
+            readonly title: "AwsArn";
+            readonly type: "string";
+            readonly maxLength: 2048;
+            readonly pattern: "^arn:aws[a-z-]*:[a-z0-9-]+:[a-z0-9-]*:[0-9]{0,12}:[A-Za-z0-9+=,.@_/:-]+$";
+        };
+        readonly AwsRegion: {
+            readonly title: "AwsRegion";
+            readonly type: "string";
+            readonly pattern: "^[a-z]{2}(-gov)?-[a-z]+-[0-9]$";
+            readonly maxLength: 32;
+        };
+        readonly AccountContextId: {
+            readonly title: "AccountContextId";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 256;
+            readonly description: "The custodian context that owns the account. Act scope in this context decides who may manage the account and who may consume it; the account's keys are derived in this context's key space.";
+        };
+        readonly AccountId: {
+            readonly title: "AccountId";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 64;
+            readonly pattern: "^[a-z0-9][a-z0-9-]*$";
+            readonly description: "The account's identifier within its context, chosen by whoever creates it. Lowercase letters, digits and hyphens, so that it can be embedded in a certificate subject, a token subject or a provider-side condition without escaping. Unique per context; never reused after deletion while anything that names it (a provider-side trust policy, an audit row) may still exist.";
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export declare const SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/external/accounts/keys/rotate/0.1";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/external/accounts/keys/rotate/0.1";
+        readonly title: "External Accounts — Keys — Rotate — payload";
+        readonly description: "Rotate an external account's key: stage, confirm or abandon. The outer document members are owned by the framework — SPEC §6.3.";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly required: readonly ["context", "id", "phase"];
+        readonly properties: {
+            readonly context: {
+                readonly $ref: "#/$defs/AccountContextId";
+            };
+            readonly id: {
+                readonly $ref: "#/$defs/AccountId";
+            };
+            readonly phase: {
+                readonly type: "string";
+                readonly enum: readonly ["stage", "confirm", "abandon"];
+            };
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+            };
+        };
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "External Accounts — Keys — Rotate — response payload";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["account"];
+                readonly properties: {
+                    readonly account: {
+                        readonly $ref: "#/$defs/ExternalAccount";
+                    };
+                    readonly setup: {
+                        readonly $ref: "#/$defs/AccountSetupArtifacts";
+                        readonly description: "On `stage` only.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly AccountSetupArtifacts: {
+                readonly title: "AccountSetupArtifacts";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["model", "artifacts", "steps"];
+                readonly description: "What an administrator does at the provider to make an account usable, generated by the custodian from the account's settings, public material and bindings. Public material and policy only: never a private key or secret, and the custodian never asks for the provider's administrator credentials.";
+                readonly properties: {
+                    readonly model: {
+                        readonly $ref: "#/$defs/AuthModel";
+                    };
+                    readonly artifacts: {
+                        readonly type: "array";
+                        readonly maxItems: 16;
+                        readonly items: {
+                            readonly type: "object";
+                            readonly additionalProperties: false;
+                            readonly required: readonly ["name", "mediaType", "content"];
+                            readonly properties: {
+                                readonly name: {
+                                    readonly type: "string";
+                                    readonly maxLength: 128;
+                                    readonly pattern: "^[A-Za-z0-9._-]+$";
+                                    readonly description: "File name to save it under: `trust-anchor.pem`, `jwks.json`, `permissions-policy.json`, `crl.pem`.";
+                                };
+                                readonly mediaType: {
+                                    readonly type: "string";
+                                    readonly maxLength: 128;
+                                    readonly pattern: "^[a-z]+/[a-z0-9.+-]+$";
+                                };
+                                readonly content: {
+                                    readonly type: "string";
+                                    readonly maxLength: 65536;
+                                };
+                            };
+                        };
+                    };
+                    readonly steps: {
+                        readonly type: "array";
+                        readonly maxItems: 32;
+                        readonly items: {
+                            readonly type: "object";
+                            readonly additionalProperties: false;
+                            readonly required: readonly ["description"];
+                            readonly properties: {
+                                readonly description: {
+                                    readonly type: "string";
+                                    readonly maxLength: 1024;
+                                };
+                                readonly command: {
+                                    readonly type: "string";
+                                    readonly maxLength: 8192;
+                                    readonly description: "A provider CLI command (`aws rolesanywhere create-trust-anchor …`, `gcloud iam workload-identity-pools providers create-oidc … --jwk-json-path`, `az ad app credential reset --cert …`), referring to artifacts by `name`.";
+                                };
+                            };
+                        };
+                    };
+                };
+            };
+            readonly AuthModel: {
+                readonly title: "AuthModel";
+                readonly type: "string";
+                readonly enum: readonly ["aws-roles-anywhere", "gcp-wif-pinned", "azure-cert", "oauth2-private-key-jwt", "s3-static-presign", "sui-signer", "static-secret"];
+                readonly description: "How the account authenticates to its provider. Every model pins the custodian's verification material in the provider's own account, uploaded once, so no model requires the custodian to be reachable from the internet. `aws-roles-anywhere`: the custodian is the certificate authority of an IAM Roles Anywhere trust anchor, and signs CreateSession with a short-lived end-entity certificate it issued to the account's own key. `gcp-wif-pinned`: a Workload Identity Federation pool provider holds an uploaded JWKS; the custodian signs an ID token and exchanges it at Google's STS. `azure-cert`: a certificate uploaded to an Entra app registration; the custodian signs an RFC 7523 client assertion. `oauth2-private-key-jwt`: the same RFC 7523 client authentication against any token endpoint that registered the custodian's public key. `s3-static-presign`: an access-key pair for an S3-compatible store that cannot federate; the custodian presigns per-object URLs and never releases the key. `sui-signer`: a Sui address derived from the custodian's key; the custodian signs only allow-listed transactions. `static-secret`: an API key or token used inside the custodian by a named driver; last resort, never released.\n\nPlain OpenID Connect discovery federation is deliberately absent. It works by the provider fetching the issuer's JWKS from a public URL, which either makes the custodian reachable from the internet or makes whoever hosts a copy of the JWKS able to mint credentials for every federated role.";
+            };
+            readonly ExternalAccount: {
+                readonly title: "ExternalAccount";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["id", "label", "context", "settings", "state", "bindings", "egressHosts", "providerSetupRequired", "createdAt", "updatedAt"];
+                readonly description: "An account as every read returns it. Contains no private key, no secret and no issued credential, to any reader.";
+                readonly properties: {
+                    readonly id: {
+                        readonly $ref: "#/$defs/AccountId";
+                    };
+                    readonly label: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 128;
+                        readonly description: "Display name. Untrusted text: render it, never interpret it.";
+                    };
+                    readonly context: {
+                        readonly $ref: "#/$defs/AccountContextId";
+                    };
+                    readonly settings: {
+                        readonly $ref: "#/$defs/AccountSettings";
+                    };
+                    readonly state: {
+                        readonly $ref: "#/$defs/AccountState";
+                    };
+                    readonly publicMaterial: {
+                        readonly $ref: "#/$defs/AccountPublicMaterial";
+                        readonly description: "Absent for the static models, which hold a secret rather than a key.";
+                    };
+                    readonly secret: {
+                        readonly $ref: "#/$defs/AccountSecretInfo";
+                        readonly description: "Static models only; absent until the secret is set.";
+                    };
+                    readonly bindings: {
+                        readonly type: "array";
+                        readonly maxItems: 256;
+                        readonly items: {
+                            readonly $ref: "#/$defs/AccountBinding";
+                        };
+                    };
+                    readonly egressHosts: {
+                        readonly type: "array";
+                        readonly maxItems: 8;
+                        readonly items: {
+                            readonly type: "string";
+                            readonly maxLength: 253;
+                            readonly pattern: "^[a-z0-9.-]+$";
+                        };
+                        readonly description: "The provider hosts the custodian connects to on this account's behalf, derived by the custodian from its settings: the token or session endpoints issuance uses, and the destinations external/accounts/probe dials (the object store's host, for a storage model). The custodian MUST NOT connect anywhere else on the account's behalf, so an egress proxy can allow exactly this set. Empty only for a model that neither exchanges nor probes over the network.";
+                    };
+                    readonly providerSetupRequired: {
+                        readonly type: "boolean";
+                        readonly description: "True when the account cannot be used until its provider-side setup is redone: after a restore that could not carry its key or secret (a wrapped RSA key, a static secret), or after a rotation awaiting confirmation.";
+                    };
+                    readonly lastProbe: {
+                        readonly $ref: "#/$defs/AccountProbeReport";
+                    };
+                    readonly createdAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly updatedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                };
+            };
+            readonly AccountProbeReport: {
+                readonly title: "AccountProbeReport";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["at", "ok", "complete", "steps"];
+                readonly properties: {
+                    readonly at: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly ok: {
+                        readonly type: "boolean";
+                        readonly description: "True when every step that ran succeeded.";
+                    };
+                    readonly complete: {
+                        readonly type: "boolean";
+                        readonly description: "True only when the canary steps (`put`, `get`, `delete`, or the model's equivalent) ran, so the account was exercised end to end. A probe that stopped after `exchange` because nothing named a canary prefix is `complete: false` even when `ok` is true, and does not clear `providerSetupRequired`.";
+                    };
+                    readonly steps: {
+                        readonly type: "array";
+                        readonly maxItems: 8;
+                        readonly items: {
+                            readonly type: "object";
+                            readonly additionalProperties: false;
+                            readonly required: readonly ["step", "ok"];
+                            readonly properties: {
+                                readonly step: {
+                                    readonly $ref: "#/$defs/AccountProbeStep";
+                                };
+                                readonly ok: {
+                                    readonly type: "boolean";
+                                };
+                                readonly durationMs: {
+                                    readonly type: "integer";
+                                    readonly minimum: 0;
+                                };
+                                readonly providerError: {
+                                    readonly type: "string";
+                                    readonly maxLength: 2048;
+                                    readonly description: "The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.";
+                                };
+                                readonly providerRequestId: {
+                                    readonly type: "string";
+                                    readonly maxLength: 256;
+                                    readonly pattern: "^[!-~]+$";
+                                };
+                            };
+                        };
+                        readonly description: "In order; the first failing step ends the probe.";
+                    };
+                };
+            };
+            readonly AccountProbeStep: {
+                readonly title: "AccountProbeStep";
+                readonly type: "string";
+                readonly enum: readonly ["sign", "exchange", "put", "get", "delete", "decode"];
+                readonly description: "`sign`: the custodian signed its assertion, session request or test transaction. `exchange`: the provider issued a credential for it. `put`, `get`, `delete`: one canary object at the narrowest scope of the account's bindings. `decode`: for `sui-signer`, a built test transaction passed the allow-list (it is never submitted).";
+            };
+            readonly AccountBinding: {
+                readonly title: "AccountBinding";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["consumer", "maxTtlSeconds", "ratePerMinute"];
+                readonly description: "Who may use an account, and how far. One binding per consumer per account. A binding is checked before anything is signed: the caller must be `consumer`, proven by the request's own proof; the request must sit inside `scopeCeiling`; its TTL must not exceed `maxTtlSeconds`; and the binding's rate must not be exhausted.";
+                readonly properties: {
+                    readonly consumer: {
+                        readonly type: "string";
+                        readonly minLength: 7;
+                        readonly maxLength: 2048;
+                        readonly pattern: "^did:[a-z0-9]+:\\S+$";
+                        readonly description: "The DID of the integration allowed to use the account.";
+                    };
+                    readonly scopeCeiling: {
+                        readonly $ref: "#/$defs/CredentialScopeCeiling";
+                        readonly description: "Required for storage and OAuth models; absent for `sui-signer`, whose ceiling is the account's own allow-list and caps.";
+                    };
+                    readonly maxTtlSeconds: {
+                        readonly type: "integer";
+                        readonly minimum: 60;
+                        readonly maximum: 3600;
+                        readonly description: "The longest credential lifetime the consumer may request. 900 (15 minutes) is RECOMMENDED; the ceiling is one hour.";
+                    };
+                    readonly ratePerMinute: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                        readonly maximum: 600;
+                        readonly description: "Issuances or signatures per minute for this binding.";
+                    };
+                    readonly sourceCidrs: {
+                        readonly type: "array";
+                        readonly maxItems: 16;
+                        readonly items: {
+                            readonly type: "string";
+                            readonly maxLength: 49;
+                            readonly pattern: "^[0-9a-fA-F:.]+/[0-9]{1,3}$";
+                        };
+                        readonly description: "Where the provider supports it (`aws:SourceIp`), issued credentials are pinned to these networks, so a credential lifted from the consumer is useless elsewhere.";
+                    };
+                    readonly grantedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                };
+            };
+            readonly CredentialScopeCeiling: {
+                readonly title: "CredentialScopeCeiling";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly description: "The widest scope a binding's consumer may request. An issuance is inside the ceiling when its `prefix` begins with one of `prefixes`, every one of its `actions` is in `actions`, and every one of its `scopes` is in `scopes`. Absent members confer nothing: a ceiling with no `prefixes` permits no storage issuance.";
+                readonly properties: {
+                    readonly prefixes: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly maxItems: 64;
+                        readonly uniqueItems: true;
+                        readonly items: {
+                            readonly $ref: "#/$defs/ProviderObjectPrefix";
+                        };
+                    };
+                    readonly actions: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly maxItems: 3;
+                        readonly uniqueItems: true;
+                        readonly items: {
+                            readonly $ref: "#/$defs/ProviderObjectAction";
+                        };
+                    };
+                    readonly scopes: {
+                        readonly type: "array";
+                        readonly maxItems: 64;
+                        readonly uniqueItems: true;
+                        readonly items: {
+                            readonly type: "string";
+                            readonly maxLength: 256;
+                            readonly pattern: "^[!#-\\[\\]-~]+$";
+                        };
+                    };
+                };
+            };
+            readonly ProviderObjectAction: {
+                readonly title: "ProviderObjectAction";
+                readonly type: "string";
+                readonly enum: readonly ["put", "get", "delete"];
+                readonly description: "`put`: write an object. `get`: read one. `delete`: remove one. No list, ACL, policy or bucket-level action exists here, so none can be granted.";
+            };
+            readonly ProviderObjectPrefix: {
+                readonly title: "ProviderObjectPrefix";
+                readonly type: "string";
+                readonly minLength: 2;
+                readonly maxLength: 512;
+                readonly pattern: "^([a-z0-9][a-z0-9._-]{0,127}/){1,16}$";
+                readonly description: "An object-key prefix within the account's bucket: one or more segments of lowercase letters, digits, `.`, `_` and `-`, each beginning with a letter or digit and ending with `/`. No quote, backslash, wildcard, whitespace, `..` segment or empty segment can appear. That is deliberate: the custodian places this value inside a provider policy — an IAM session policy (JSON), a GCS Credential Access Boundary condition (CEL) — and a value able to carry a metacharacter can break out of the string it is placed in and widen the policy. That is a known class of defect (CVE-2026-42811, a CEL injection in downscoped GCS credentials). Even with this pattern, a custodian MUST build provider policies with the provider language's own encoder, never by string interpolation.";
+            };
+            readonly AccountSecretInfo: {
+                readonly title: "AccountSecretInfo";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["fingerprint", "setAt"];
+                readonly description: "That a static model's secret is set, and which one. Never its value.";
+                readonly properties: {
+                    readonly fingerprint: {
+                        readonly $ref: "#/$defs/SecretFingerprint";
+                    };
+                    readonly setAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                };
+            };
+            readonly SecretFingerprint: {
+                readonly title: "SecretFingerprint";
+                readonly type: "string";
+                readonly pattern: "^hmacsha256:[A-Za-z0-9_-]{22}$";
+                readonly maxLength: 33;
+                readonly description: "Which secret is set, without being a way to test guesses at it. `hmacsha256:` followed by the base64url encoding, without padding, of the first 16 bytes of HMAC-SHA256 over the secret's bytes under a fingerprint key the custodian holds and never discloses. Comparable only between fingerprints made by the same custodian: a re-entered value can be confirmed, while the same secret at two custodians gives unrelated fingerprints. Never a bare hash of the secret, which would let anyone who reads it run a dictionary against it offline; and deliberately not a DigestMultibase, since multihash has no code for a keyed digest.";
+            };
+            readonly AccountPublicMaterial: {
+                readonly title: "AccountPublicMaterial";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["algorithm", "keyFingerprint"];
+                readonly description: "The public half of the account's key, as the provider needs it. Never a private key.";
+                readonly properties: {
+                    readonly algorithm: {
+                        readonly type: "string";
+                        readonly enum: readonly ["ES256", "RS256", "Secp256r1"];
+                    };
+                    readonly keyFingerprint: {
+                        readonly $ref: "#/$defs/DigestMultibase";
+                        readonly description: "Digest of the public key's SubjectPublicKeyInfo DER.";
+                    };
+                    readonly publicKeyJwk: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["kty", "kid"];
+                        readonly description: "The public key as a JWK, with `kid`. Public members only: the schema admits no private member (`d`, `p`, `q`, `dp`, `dq`, `qi`), so a document carrying one fails validation.";
+                        readonly properties: {
+                            readonly kty: {
+                                readonly type: "string";
+                                readonly enum: readonly ["EC", "RSA"];
+                            };
+                            readonly crv: {
+                                readonly type: "string";
+                                readonly enum: readonly ["P-256"];
+                            };
+                            readonly x: {
+                                readonly type: "string";
+                                readonly maxLength: 1024;
+                                readonly pattern: "^[A-Za-z0-9_-]+$";
+                            };
+                            readonly y: {
+                                readonly type: "string";
+                                readonly maxLength: 1024;
+                                readonly pattern: "^[A-Za-z0-9_-]+$";
+                            };
+                            readonly n: {
+                                readonly type: "string";
+                                readonly maxLength: 1024;
+                                readonly pattern: "^[A-Za-z0-9_-]+$";
+                            };
+                            readonly e: {
+                                readonly type: "string";
+                                readonly maxLength: 16;
+                                readonly pattern: "^[A-Za-z0-9_-]+$";
+                            };
+                            readonly kid: {
+                                readonly type: "string";
+                                readonly maxLength: 128;
+                                readonly pattern: "^[!-~]+$";
+                            };
+                            readonly alg: {
+                                readonly type: "string";
+                                readonly enum: readonly ["ES256", "RS256"];
+                            };
+                            readonly use: {
+                                readonly type: "string";
+                                readonly const: "sig";
+                            };
+                        };
+                    };
+                    readonly certificatePem: {
+                        readonly type: "string";
+                        readonly maxLength: 16384;
+                        readonly pattern: "^-----BEGIN CERTIFICATE-----[A-Za-z0-9+/=\\r\\n]+-----END CERTIFICATE-----\\s*$";
+                        readonly description: "`aws-roles-anywhere`: the trust anchor's CA certificate. `azure-cert`: the certificate uploaded to the app registration.";
+                    };
+                    readonly address: {
+                        readonly type: "string";
+                        readonly pattern: "^0x[0-9a-f]{64}$";
+                        readonly description: "`sui-signer`: the Sui address the key controls.";
+                    };
+                    readonly pendingKeyFingerprint: {
+                        readonly $ref: "#/$defs/DigestMultibase";
+                        readonly description: "During a rotation (external/accounts/keys/rotate), the staged successor key, until it is confirmed and the current key retires.";
+                    };
+                };
+            };
+            readonly DigestMultibase: {
+                readonly title: "DigestMultibase";
+                readonly description: "A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.\n\nMultihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.\n\nThis definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.\n\nRestricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that \"interoperability is not guaranteed between implementations using such values\", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.";
+                readonly type: "string";
+                readonly minLength: 16;
+                readonly pattern: "^(z[1-9A-HJ-NP-Za-km-z]+|u[A-Za-z0-9_-]+)$";
+                readonly examples: readonly ["zQmbWqxBEKC3P8tqsKc98xmWNzrzDtRLMiMPL8wBuTGsMnR"];
+            };
+            readonly AccountState: {
+                readonly title: "AccountState";
+                readonly type: "string";
+                readonly enum: readonly ["active", "suspended", "archived"];
+                readonly description: "`active`: usable by its bindings. `suspended`: every issuance and signature is refused at once; management reads continue; resumable. `archived`: hidden from default listings, refused for use, restorable. Deletion removes the record.";
+            };
+            readonly AccountSettings: {
+                readonly title: "AccountSettings";
+                readonly description: "Per-model account settings, discriminated by `model`: every branch is an object whose `model` member is a `const`, which is what lets each generated binding emit a tagged union, so an unusable setting is answered as `external:invalidSettings` naming the member rather than as an unparseable payload. Never a secret: every value here is returned to anyone who may read the account. Branches are referred to by their `model` (\"the `sui-signer` settings\"). They carry no `title`, so that every binding renders each as a plain variant of this union.";
+                readonly oneOf: readonly [{
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["model", "region", "profileArn", "roleArn", "trustAnchorArn"];
+                    readonly description: "Egress: `rolesanywhere.<region>.amazonaws.com`, plus `sts.<region>.amazonaws.com` when `chainedRoleArn` is set.";
+                    readonly properties: {
+                        readonly model: {
+                            readonly type: "string";
+                            readonly const: "aws-roles-anywhere";
+                        };
+                        readonly region: {
+                            readonly $ref: "#/$defs/AwsRegion";
+                        };
+                        readonly trustAnchorArn: {
+                            readonly $ref: "#/$defs/AwsArn";
+                            readonly description: "The trust anchor holding the custodian's CA certificate. Recorded after the administrator creates it from external/accounts/setup.";
+                        };
+                        readonly profileArn: {
+                            readonly $ref: "#/$defs/AwsArn";
+                        };
+                        readonly roleArn: {
+                            readonly $ref: "#/$defs/AwsArn";
+                        };
+                        readonly chainedRoleArn: {
+                            readonly $ref: "#/$defs/AwsArn";
+                            readonly description: "When set, every issuance chains an AssumeRole into this role carrying the downscoping session policy, for deployments whose Roles Anywhere profile cannot carry one per request. Caps a credential at one hour.";
+                        };
+                        readonly bucket: {
+                            readonly $ref: "#/$defs/ProviderBucketName";
+                            readonly description: "The S3 bucket issuances are scoped within. Required for an account whose bindings issue storage scopes.";
+                        };
+                        readonly probePrefix: {
+                            readonly $ref: "#/$defs/ProviderObjectPrefix";
+                            readonly description: "Where external/accounts/probe writes its canary when no binding names a narrower prefix. Lets a new account be probed before anything is bound to it. Absent, a probe of an account with no bindings stops after `exchange` and reports `complete: false`.";
+                        };
+                    };
+                }, {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["model", "projectNumber", "poolId", "providerId"];
+                    readonly description: "Egress: `sts.googleapis.com`, plus `iamcredentials.googleapis.com` when `serviceAccount` is set.";
+                    readonly properties: {
+                        readonly model: {
+                            readonly type: "string";
+                            readonly const: "gcp-wif-pinned";
+                        };
+                        readonly projectNumber: {
+                            readonly type: "string";
+                            readonly pattern: "^[0-9]{1,20}$";
+                        };
+                        readonly poolId: {
+                            readonly type: "string";
+                            readonly pattern: "^[a-z0-9-]{4,32}$";
+                        };
+                        readonly providerId: {
+                            readonly type: "string";
+                            readonly pattern: "^[a-z0-9-]{4,32}$";
+                        };
+                        readonly serviceAccount: {
+                            readonly type: "string";
+                            readonly maxLength: 254;
+                            readonly pattern: "^[a-z0-9-]+@[a-z0-9-]+\\.iam\\.gserviceaccount\\.com$";
+                            readonly description: "When set, the federated token is exchanged for this service account's access token.";
+                        };
+                        readonly signingAlgorithm: {
+                            readonly type: "string";
+                            readonly enum: readonly ["ES256", "RS256"];
+                            readonly description: "The ID-token algorithm. ES256 unless the provider refuses it. Absent means ES256.";
+                        };
+                        readonly bucket: {
+                            readonly $ref: "#/$defs/ProviderBucketName";
+                            readonly description: "The GCS bucket issuances are scoped within, by a Credential Access Boundary.";
+                        };
+                        readonly probePrefix: {
+                            readonly $ref: "#/$defs/ProviderObjectPrefix";
+                            readonly description: "Where external/accounts/probe writes its canary when no binding names a narrower prefix. Lets a new account be probed before anything is bound to it. Absent, a probe of an account with no bindings stops after `exchange` and reports `complete: false`.";
+                        };
+                    };
+                }, {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["model", "tenantId", "clientId", "tokenScope"];
+                    readonly description: "Egress: `login.microsoftonline.com`, or the sovereign-cloud authority named in `authorityHost`.";
+                    readonly properties: {
+                        readonly model: {
+                            readonly type: "string";
+                            readonly const: "azure-cert";
+                        };
+                        readonly tenantId: {
+                            readonly type: "string";
+                            readonly pattern: "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$";
+                        };
+                        readonly clientId: {
+                            readonly type: "string";
+                            readonly pattern: "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$";
+                        };
+                        readonly tokenScope: {
+                            readonly type: "string";
+                            readonly maxLength: 512;
+                            readonly pattern: "^[A-Za-z0-9:/._-]+$";
+                            readonly description: "The `scope` requested at the token endpoint, such as `https://storage.azure.com/.default`.";
+                        };
+                        readonly authorityHost: {
+                            readonly type: "string";
+                            readonly maxLength: 253;
+                            readonly pattern: "^[a-z0-9.-]+$";
+                            readonly description: "Absent means `login.microsoftonline.com`.";
+                        };
+                    };
+                }, {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["model", "tokenEndpoint", "clientId"];
+                    readonly description: "Egress: the host of `tokenEndpoint`, and nothing else.";
+                    readonly properties: {
+                        readonly model: {
+                            readonly type: "string";
+                            readonly const: "oauth2-private-key-jwt";
+                        };
+                        readonly tokenEndpoint: {
+                            readonly $ref: "#/$defs/ProviderHttpsUrl";
+                        };
+                        readonly clientId: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                            readonly maxLength: 512;
+                            readonly pattern: "^[!-~]+$";
+                        };
+                        readonly audience: {
+                            readonly type: "string";
+                            readonly maxLength: 2048;
+                            readonly pattern: "^[!-~]+$";
+                            readonly description: "The assertion's `aud`. Absent means `tokenEndpoint`.";
+                        };
+                        readonly scopes: {
+                            readonly type: "array";
+                            readonly maxItems: 64;
+                            readonly uniqueItems: true;
+                            readonly items: {
+                                readonly type: "string";
+                                readonly maxLength: 256;
+                                readonly pattern: "^[!#-\\[\\]-~]+$";
+                            };
+                            readonly description: "The scopes a binding may request, the ceiling for every issuance.";
+                        };
+                        readonly signingAlgorithm: {
+                            readonly type: "string";
+                            readonly enum: readonly ["ES256", "RS256"];
+                        };
+                    };
+                }, {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["model", "endpoint", "region", "bucket", "accessKeyId"];
+                    readonly description: "Issuance needs no egress: presigning is a computation inside the custodian, and the consumer uses the URL itself. The probe connects to the host of `endpoint`, which `egressHosts` therefore lists.";
+                    readonly properties: {
+                        readonly model: {
+                            readonly type: "string";
+                            readonly const: "s3-static-presign";
+                        };
+                        readonly endpoint: {
+                            readonly $ref: "#/$defs/ProviderHttpsUrl";
+                        };
+                        readonly region: {
+                            readonly type: "string";
+                            readonly maxLength: 64;
+                            readonly pattern: "^[a-z0-9-]+$";
+                            readonly description: "The SigV4 signing region; `auto` for Cloudflare R2.";
+                        };
+                        readonly bucket: {
+                            readonly $ref: "#/$defs/ProviderBucketName";
+                        };
+                        readonly pathStyle: {
+                            readonly type: "boolean";
+                            readonly description: "Address the bucket in the path rather than the host name, as MinIO usually needs.";
+                        };
+                        readonly accessKeyId: {
+                            readonly type: "string";
+                            readonly maxLength: 128;
+                            readonly pattern: "^[A-Za-z0-9]+$";
+                            readonly description: "The access key's identifier. Not a secret: it appears in every presigned URL. The secret half is set with external/accounts/secret/set and never returned.";
+                        };
+                        readonly probePrefix: {
+                            readonly $ref: "#/$defs/ProviderObjectPrefix";
+                            readonly description: "Where external/accounts/probe writes its canary when no binding names a narrower prefix. Lets a new account be probed before anything is bound to it. Absent, a probe of an account with no bindings stops after `exchange` and reports `complete: false`.";
+                        };
+                    };
+                }, {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["model", "network", "allowedCalls", "maxGasBudgetMist", "maxGasPerDayMist"];
+                    readonly description: "No egress: the custodian signs and the consumer submits the transaction. The allow-list, the gas caps and the coin caps are the account's whole authority; a transaction outside them is refused before anything is signed.";
+                    readonly properties: {
+                        readonly model: {
+                            readonly type: "string";
+                            readonly const: "sui-signer";
+                        };
+                        readonly network: {
+                            readonly type: "string";
+                            readonly enum: readonly ["mainnet", "testnet", "devnet"];
+                        };
+                        readonly allowedCalls: {
+                            readonly type: "array";
+                            readonly minItems: 1;
+                            readonly maxItems: 32;
+                            readonly items: {
+                                readonly $ref: "#/$defs/SuiMoveCall";
+                            };
+                            readonly description: "Every MoveCall command in a signed transaction must name one of these. For Walrus storage: the system package's `register_blob`, `certify_blob`, `extend_blob` and `delete_blob`, and the coin calls needed to pay for them.";
+                        };
+                        readonly allowedObjects: {
+                            readonly type: "array";
+                            readonly maxItems: 32;
+                            readonly items: {
+                                readonly type: "string";
+                                readonly pattern: "^0x[0-9a-f]{64}$";
+                            };
+                            readonly description: "Shared objects a transaction may take as input, such as the Walrus system and staking objects. Absent means any object the allowed calls accept.";
+                        };
+                        readonly maxGasBudgetMist: {
+                            readonly type: "integer";
+                            readonly minimum: 1;
+                            readonly description: "The largest gas budget one transaction may declare.";
+                        };
+                        readonly maxGasPerDayMist: {
+                            readonly type: "integer";
+                            readonly minimum: 1;
+                            readonly description: "The total gas budget signed per rolling 24 hours.";
+                        };
+                        readonly maxCoinOutPerTx: {
+                            readonly type: "array";
+                            readonly maxItems: 8;
+                            readonly items: {
+                                readonly type: "object";
+                                readonly additionalProperties: false;
+                                readonly required: readonly ["coinType", "amount"];
+                                readonly properties: {
+                                    readonly coinType: {
+                                        readonly type: "string";
+                                        readonly maxLength: 512;
+                                        readonly pattern: "^0x[0-9a-f]{1,64}::[A-Za-z0-9_]+::[A-Za-z0-9_]+$";
+                                    };
+                                    readonly amount: {
+                                        readonly type: "integer";
+                                        readonly minimum: 0;
+                                    };
+                                };
+                            };
+                            readonly description: "Per coin type, the most a single transaction may spend or transfer out of the account's address, in the coin's smallest unit. A coin type not listed may not leave the address at all.";
+                        };
+                    };
+                }, {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["model", "driver", "baseUrl"];
+                    readonly description: "Egress: the host of `baseUrl`. The secret is set with external/accounts/secret/set and used only inside the custodian by `driver`; a provider reachable only by handing the consumer the raw key is not supported.";
+                    readonly properties: {
+                        readonly model: {
+                            readonly type: "string";
+                            readonly const: "static-secret";
+                        };
+                        readonly driver: {
+                            readonly type: "string";
+                            readonly maxLength: 64;
+                            readonly pattern: "^[a-z0-9][a-z0-9-]*$";
+                            readonly description: "The custodian's driver that uses the secret: performs a login or token exchange and returns a short-lived result. A custodian refuses a driver it does not implement.";
+                        };
+                        readonly baseUrl: {
+                            readonly $ref: "#/$defs/ProviderHttpsUrl";
+                        };
+                    };
+                }];
+            };
+            readonly ProviderHttpsUrl: {
+                readonly title: "ProviderHttpsUrl";
+                readonly type: "string";
+                readonly format: "uri";
+                readonly maxLength: 2048;
+                readonly pattern: "^https://[^\\s\"'\\\\]+$";
+            };
+            readonly SuiMoveCall: {
+                readonly title: "SuiMoveCall";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["package", "module", "function"];
+                readonly description: "One Move function an account's transactions may call.";
+                readonly properties: {
+                    readonly package: {
+                        readonly type: "string";
+                        readonly pattern: "^0x[0-9a-f]{64}$";
+                    };
+                    readonly module: {
+                        readonly type: "string";
+                        readonly pattern: "^[A-Za-z][A-Za-z0-9_]{0,127}$";
+                    };
+                    readonly function: {
+                        readonly type: "string";
+                        readonly pattern: "^[A-Za-z][A-Za-z0-9_]{0,127}$";
+                    };
+                };
+            };
+            readonly ProviderBucketName: {
+                readonly title: "ProviderBucketName";
+                readonly type: "string";
+                readonly minLength: 3;
+                readonly maxLength: 63;
+                readonly pattern: "^[a-z0-9][a-z0-9.-]*[a-z0-9]$";
+                readonly description: "A bucket name as S3 and GCS accept it. Validated rather than free so that it can be placed in a provider policy without escaping.";
+            };
+            readonly AwsArn: {
+                readonly title: "AwsArn";
+                readonly type: "string";
+                readonly maxLength: 2048;
+                readonly pattern: "^arn:aws[a-z-]*:[a-z0-9-]+:[a-z0-9-]*:[0-9]{0,12}:[A-Za-z0-9+=,.@_/:-]+$";
+            };
+            readonly AwsRegion: {
+                readonly title: "AwsRegion";
+                readonly type: "string";
+                readonly pattern: "^[a-z]{2}(-gov)?-[a-z]+-[0-9]$";
+                readonly maxLength: 32;
+            };
+            readonly AccountContextId: {
+                readonly title: "AccountContextId";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 256;
+                readonly description: "The custodian context that owns the account. Act scope in this context decides who may manage the account and who may consume it; the account's keys are derived in this context's key space.";
+            };
+            readonly AccountId: {
+                readonly title: "AccountId";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 64;
+                readonly pattern: "^[a-z0-9][a-z0-9-]*$";
+                readonly description: "The account's identifier within its context, chosen by whoever creates it. Lowercase letters, digits and hyphens, so that it can be embedded in a certificate subject, a token subject or a provider-side condition without escaping. Unique per context; never reused after deletion while anything that names it (a provider-side trust policy, an audit row) may still exist.";
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export declare const RESPONSE_SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/external/accounts/keys/rotate/0.1#response";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $ref: "#/$defs/Response";
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "External Accounts — Keys — Rotate — response payload";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["account"];
+                readonly properties: {
+                    readonly account: {
+                        readonly $ref: "#/$defs/ExternalAccount";
+                    };
+                    readonly setup: {
+                        readonly $ref: "#/$defs/AccountSetupArtifacts";
+                        readonly description: "On `stage` only.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly AccountSetupArtifacts: {
+                readonly title: "AccountSetupArtifacts";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["model", "artifacts", "steps"];
+                readonly description: "What an administrator does at the provider to make an account usable, generated by the custodian from the account's settings, public material and bindings. Public material and policy only: never a private key or secret, and the custodian never asks for the provider's administrator credentials.";
+                readonly properties: {
+                    readonly model: {
+                        readonly $ref: "#/$defs/AuthModel";
+                    };
+                    readonly artifacts: {
+                        readonly type: "array";
+                        readonly maxItems: 16;
+                        readonly items: {
+                            readonly type: "object";
+                            readonly additionalProperties: false;
+                            readonly required: readonly ["name", "mediaType", "content"];
+                            readonly properties: {
+                                readonly name: {
+                                    readonly type: "string";
+                                    readonly maxLength: 128;
+                                    readonly pattern: "^[A-Za-z0-9._-]+$";
+                                    readonly description: "File name to save it under: `trust-anchor.pem`, `jwks.json`, `permissions-policy.json`, `crl.pem`.";
+                                };
+                                readonly mediaType: {
+                                    readonly type: "string";
+                                    readonly maxLength: 128;
+                                    readonly pattern: "^[a-z]+/[a-z0-9.+-]+$";
+                                };
+                                readonly content: {
+                                    readonly type: "string";
+                                    readonly maxLength: 65536;
+                                };
+                            };
+                        };
+                    };
+                    readonly steps: {
+                        readonly type: "array";
+                        readonly maxItems: 32;
+                        readonly items: {
+                            readonly type: "object";
+                            readonly additionalProperties: false;
+                            readonly required: readonly ["description"];
+                            readonly properties: {
+                                readonly description: {
+                                    readonly type: "string";
+                                    readonly maxLength: 1024;
+                                };
+                                readonly command: {
+                                    readonly type: "string";
+                                    readonly maxLength: 8192;
+                                    readonly description: "A provider CLI command (`aws rolesanywhere create-trust-anchor …`, `gcloud iam workload-identity-pools providers create-oidc … --jwk-json-path`, `az ad app credential reset --cert …`), referring to artifacts by `name`.";
+                                };
+                            };
+                        };
+                    };
+                };
+            };
+            readonly AuthModel: {
+                readonly title: "AuthModel";
+                readonly type: "string";
+                readonly enum: readonly ["aws-roles-anywhere", "gcp-wif-pinned", "azure-cert", "oauth2-private-key-jwt", "s3-static-presign", "sui-signer", "static-secret"];
+                readonly description: "How the account authenticates to its provider. Every model pins the custodian's verification material in the provider's own account, uploaded once, so no model requires the custodian to be reachable from the internet. `aws-roles-anywhere`: the custodian is the certificate authority of an IAM Roles Anywhere trust anchor, and signs CreateSession with a short-lived end-entity certificate it issued to the account's own key. `gcp-wif-pinned`: a Workload Identity Federation pool provider holds an uploaded JWKS; the custodian signs an ID token and exchanges it at Google's STS. `azure-cert`: a certificate uploaded to an Entra app registration; the custodian signs an RFC 7523 client assertion. `oauth2-private-key-jwt`: the same RFC 7523 client authentication against any token endpoint that registered the custodian's public key. `s3-static-presign`: an access-key pair for an S3-compatible store that cannot federate; the custodian presigns per-object URLs and never releases the key. `sui-signer`: a Sui address derived from the custodian's key; the custodian signs only allow-listed transactions. `static-secret`: an API key or token used inside the custodian by a named driver; last resort, never released.\n\nPlain OpenID Connect discovery federation is deliberately absent. It works by the provider fetching the issuer's JWKS from a public URL, which either makes the custodian reachable from the internet or makes whoever hosts a copy of the JWKS able to mint credentials for every federated role.";
+            };
+            readonly ExternalAccount: {
+                readonly title: "ExternalAccount";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["id", "label", "context", "settings", "state", "bindings", "egressHosts", "providerSetupRequired", "createdAt", "updatedAt"];
+                readonly description: "An account as every read returns it. Contains no private key, no secret and no issued credential, to any reader.";
+                readonly properties: {
+                    readonly id: {
+                        readonly $ref: "#/$defs/AccountId";
+                    };
+                    readonly label: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 128;
+                        readonly description: "Display name. Untrusted text: render it, never interpret it.";
+                    };
+                    readonly context: {
+                        readonly $ref: "#/$defs/AccountContextId";
+                    };
+                    readonly settings: {
+                        readonly $ref: "#/$defs/AccountSettings";
+                    };
+                    readonly state: {
+                        readonly $ref: "#/$defs/AccountState";
+                    };
+                    readonly publicMaterial: {
+                        readonly $ref: "#/$defs/AccountPublicMaterial";
+                        readonly description: "Absent for the static models, which hold a secret rather than a key.";
+                    };
+                    readonly secret: {
+                        readonly $ref: "#/$defs/AccountSecretInfo";
+                        readonly description: "Static models only; absent until the secret is set.";
+                    };
+                    readonly bindings: {
+                        readonly type: "array";
+                        readonly maxItems: 256;
+                        readonly items: {
+                            readonly $ref: "#/$defs/AccountBinding";
+                        };
+                    };
+                    readonly egressHosts: {
+                        readonly type: "array";
+                        readonly maxItems: 8;
+                        readonly items: {
+                            readonly type: "string";
+                            readonly maxLength: 253;
+                            readonly pattern: "^[a-z0-9.-]+$";
+                        };
+                        readonly description: "The provider hosts the custodian connects to on this account's behalf, derived by the custodian from its settings: the token or session endpoints issuance uses, and the destinations external/accounts/probe dials (the object store's host, for a storage model). The custodian MUST NOT connect anywhere else on the account's behalf, so an egress proxy can allow exactly this set. Empty only for a model that neither exchanges nor probes over the network.";
+                    };
+                    readonly providerSetupRequired: {
+                        readonly type: "boolean";
+                        readonly description: "True when the account cannot be used until its provider-side setup is redone: after a restore that could not carry its key or secret (a wrapped RSA key, a static secret), or after a rotation awaiting confirmation.";
+                    };
+                    readonly lastProbe: {
+                        readonly $ref: "#/$defs/AccountProbeReport";
+                    };
+                    readonly createdAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly updatedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                };
+            };
+            readonly AccountProbeReport: {
+                readonly title: "AccountProbeReport";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["at", "ok", "complete", "steps"];
+                readonly properties: {
+                    readonly at: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly ok: {
+                        readonly type: "boolean";
+                        readonly description: "True when every step that ran succeeded.";
+                    };
+                    readonly complete: {
+                        readonly type: "boolean";
+                        readonly description: "True only when the canary steps (`put`, `get`, `delete`, or the model's equivalent) ran, so the account was exercised end to end. A probe that stopped after `exchange` because nothing named a canary prefix is `complete: false` even when `ok` is true, and does not clear `providerSetupRequired`.";
+                    };
+                    readonly steps: {
+                        readonly type: "array";
+                        readonly maxItems: 8;
+                        readonly items: {
+                            readonly type: "object";
+                            readonly additionalProperties: false;
+                            readonly required: readonly ["step", "ok"];
+                            readonly properties: {
+                                readonly step: {
+                                    readonly $ref: "#/$defs/AccountProbeStep";
+                                };
+                                readonly ok: {
+                                    readonly type: "boolean";
+                                };
+                                readonly durationMs: {
+                                    readonly type: "integer";
+                                    readonly minimum: 0;
+                                };
+                                readonly providerError: {
+                                    readonly type: "string";
+                                    readonly maxLength: 2048;
+                                    readonly description: "The provider's error, verbatim and truncated, so an administrator sees the cloud's own words. Untrusted text. A custodian MUST remove any credential, signature or token from it first.";
+                                };
+                                readonly providerRequestId: {
+                                    readonly type: "string";
+                                    readonly maxLength: 256;
+                                    readonly pattern: "^[!-~]+$";
+                                };
+                            };
+                        };
+                        readonly description: "In order; the first failing step ends the probe.";
+                    };
+                };
+            };
+            readonly AccountProbeStep: {
+                readonly title: "AccountProbeStep";
+                readonly type: "string";
+                readonly enum: readonly ["sign", "exchange", "put", "get", "delete", "decode"];
+                readonly description: "`sign`: the custodian signed its assertion, session request or test transaction. `exchange`: the provider issued a credential for it. `put`, `get`, `delete`: one canary object at the narrowest scope of the account's bindings. `decode`: for `sui-signer`, a built test transaction passed the allow-list (it is never submitted).";
+            };
+            readonly AccountBinding: {
+                readonly title: "AccountBinding";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["consumer", "maxTtlSeconds", "ratePerMinute"];
+                readonly description: "Who may use an account, and how far. One binding per consumer per account. A binding is checked before anything is signed: the caller must be `consumer`, proven by the request's own proof; the request must sit inside `scopeCeiling`; its TTL must not exceed `maxTtlSeconds`; and the binding's rate must not be exhausted.";
+                readonly properties: {
+                    readonly consumer: {
+                        readonly type: "string";
+                        readonly minLength: 7;
+                        readonly maxLength: 2048;
+                        readonly pattern: "^did:[a-z0-9]+:\\S+$";
+                        readonly description: "The DID of the integration allowed to use the account.";
+                    };
+                    readonly scopeCeiling: {
+                        readonly $ref: "#/$defs/CredentialScopeCeiling";
+                        readonly description: "Required for storage and OAuth models; absent for `sui-signer`, whose ceiling is the account's own allow-list and caps.";
+                    };
+                    readonly maxTtlSeconds: {
+                        readonly type: "integer";
+                        readonly minimum: 60;
+                        readonly maximum: 3600;
+                        readonly description: "The longest credential lifetime the consumer may request. 900 (15 minutes) is RECOMMENDED; the ceiling is one hour.";
+                    };
+                    readonly ratePerMinute: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                        readonly maximum: 600;
+                        readonly description: "Issuances or signatures per minute for this binding.";
+                    };
+                    readonly sourceCidrs: {
+                        readonly type: "array";
+                        readonly maxItems: 16;
+                        readonly items: {
+                            readonly type: "string";
+                            readonly maxLength: 49;
+                            readonly pattern: "^[0-9a-fA-F:.]+/[0-9]{1,3}$";
+                        };
+                        readonly description: "Where the provider supports it (`aws:SourceIp`), issued credentials are pinned to these networks, so a credential lifted from the consumer is useless elsewhere.";
+                    };
+                    readonly grantedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                };
+            };
+            readonly CredentialScopeCeiling: {
+                readonly title: "CredentialScopeCeiling";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly description: "The widest scope a binding's consumer may request. An issuance is inside the ceiling when its `prefix` begins with one of `prefixes`, every one of its `actions` is in `actions`, and every one of its `scopes` is in `scopes`. Absent members confer nothing: a ceiling with no `prefixes` permits no storage issuance.";
+                readonly properties: {
+                    readonly prefixes: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly maxItems: 64;
+                        readonly uniqueItems: true;
+                        readonly items: {
+                            readonly $ref: "#/$defs/ProviderObjectPrefix";
+                        };
+                    };
+                    readonly actions: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly maxItems: 3;
+                        readonly uniqueItems: true;
+                        readonly items: {
+                            readonly $ref: "#/$defs/ProviderObjectAction";
+                        };
+                    };
+                    readonly scopes: {
+                        readonly type: "array";
+                        readonly maxItems: 64;
+                        readonly uniqueItems: true;
+                        readonly items: {
+                            readonly type: "string";
+                            readonly maxLength: 256;
+                            readonly pattern: "^[!#-\\[\\]-~]+$";
+                        };
+                    };
+                };
+            };
+            readonly ProviderObjectAction: {
+                readonly title: "ProviderObjectAction";
+                readonly type: "string";
+                readonly enum: readonly ["put", "get", "delete"];
+                readonly description: "`put`: write an object. `get`: read one. `delete`: remove one. No list, ACL, policy or bucket-level action exists here, so none can be granted.";
+            };
+            readonly ProviderObjectPrefix: {
+                readonly title: "ProviderObjectPrefix";
+                readonly type: "string";
+                readonly minLength: 2;
+                readonly maxLength: 512;
+                readonly pattern: "^([a-z0-9][a-z0-9._-]{0,127}/){1,16}$";
+                readonly description: "An object-key prefix within the account's bucket: one or more segments of lowercase letters, digits, `.`, `_` and `-`, each beginning with a letter or digit and ending with `/`. No quote, backslash, wildcard, whitespace, `..` segment or empty segment can appear. That is deliberate: the custodian places this value inside a provider policy — an IAM session policy (JSON), a GCS Credential Access Boundary condition (CEL) — and a value able to carry a metacharacter can break out of the string it is placed in and widen the policy. That is a known class of defect (CVE-2026-42811, a CEL injection in downscoped GCS credentials). Even with this pattern, a custodian MUST build provider policies with the provider language's own encoder, never by string interpolation.";
+            };
+            readonly AccountSecretInfo: {
+                readonly title: "AccountSecretInfo";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["fingerprint", "setAt"];
+                readonly description: "That a static model's secret is set, and which one. Never its value.";
+                readonly properties: {
+                    readonly fingerprint: {
+                        readonly $ref: "#/$defs/SecretFingerprint";
+                    };
+                    readonly setAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                };
+            };
+            readonly SecretFingerprint: {
+                readonly title: "SecretFingerprint";
+                readonly type: "string";
+                readonly pattern: "^hmacsha256:[A-Za-z0-9_-]{22}$";
+                readonly maxLength: 33;
+                readonly description: "Which secret is set, without being a way to test guesses at it. `hmacsha256:` followed by the base64url encoding, without padding, of the first 16 bytes of HMAC-SHA256 over the secret's bytes under a fingerprint key the custodian holds and never discloses. Comparable only between fingerprints made by the same custodian: a re-entered value can be confirmed, while the same secret at two custodians gives unrelated fingerprints. Never a bare hash of the secret, which would let anyone who reads it run a dictionary against it offline; and deliberately not a DigestMultibase, since multihash has no code for a keyed digest.";
+            };
+            readonly AccountPublicMaterial: {
+                readonly title: "AccountPublicMaterial";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["algorithm", "keyFingerprint"];
+                readonly description: "The public half of the account's key, as the provider needs it. Never a private key.";
+                readonly properties: {
+                    readonly algorithm: {
+                        readonly type: "string";
+                        readonly enum: readonly ["ES256", "RS256", "Secp256r1"];
+                    };
+                    readonly keyFingerprint: {
+                        readonly $ref: "#/$defs/DigestMultibase";
+                        readonly description: "Digest of the public key's SubjectPublicKeyInfo DER.";
+                    };
+                    readonly publicKeyJwk: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["kty", "kid"];
+                        readonly description: "The public key as a JWK, with `kid`. Public members only: the schema admits no private member (`d`, `p`, `q`, `dp`, `dq`, `qi`), so a document carrying one fails validation.";
+                        readonly properties: {
+                            readonly kty: {
+                                readonly type: "string";
+                                readonly enum: readonly ["EC", "RSA"];
+                            };
+                            readonly crv: {
+                                readonly type: "string";
+                                readonly enum: readonly ["P-256"];
+                            };
+                            readonly x: {
+                                readonly type: "string";
+                                readonly maxLength: 1024;
+                                readonly pattern: "^[A-Za-z0-9_-]+$";
+                            };
+                            readonly y: {
+                                readonly type: "string";
+                                readonly maxLength: 1024;
+                                readonly pattern: "^[A-Za-z0-9_-]+$";
+                            };
+                            readonly n: {
+                                readonly type: "string";
+                                readonly maxLength: 1024;
+                                readonly pattern: "^[A-Za-z0-9_-]+$";
+                            };
+                            readonly e: {
+                                readonly type: "string";
+                                readonly maxLength: 16;
+                                readonly pattern: "^[A-Za-z0-9_-]+$";
+                            };
+                            readonly kid: {
+                                readonly type: "string";
+                                readonly maxLength: 128;
+                                readonly pattern: "^[!-~]+$";
+                            };
+                            readonly alg: {
+                                readonly type: "string";
+                                readonly enum: readonly ["ES256", "RS256"];
+                            };
+                            readonly use: {
+                                readonly type: "string";
+                                readonly const: "sig";
+                            };
+                        };
+                    };
+                    readonly certificatePem: {
+                        readonly type: "string";
+                        readonly maxLength: 16384;
+                        readonly pattern: "^-----BEGIN CERTIFICATE-----[A-Za-z0-9+/=\\r\\n]+-----END CERTIFICATE-----\\s*$";
+                        readonly description: "`aws-roles-anywhere`: the trust anchor's CA certificate. `azure-cert`: the certificate uploaded to the app registration.";
+                    };
+                    readonly address: {
+                        readonly type: "string";
+                        readonly pattern: "^0x[0-9a-f]{64}$";
+                        readonly description: "`sui-signer`: the Sui address the key controls.";
+                    };
+                    readonly pendingKeyFingerprint: {
+                        readonly $ref: "#/$defs/DigestMultibase";
+                        readonly description: "During a rotation (external/accounts/keys/rotate), the staged successor key, until it is confirmed and the current key retires.";
+                    };
+                };
+            };
+            readonly DigestMultibase: {
+                readonly title: "DigestMultibase";
+                readonly description: "A cryptographic digest as a multibase-encoded multihash — the encoding the W3C Verifiable Credentials Data Model 2.0 defines for `digestMultibase`, and the one `did:webvh` uses for its SCID and entry hashes.\n\nMultihash carries the hash algorithm in-band, so the value is self-describing and the wire format survives an algorithm change without a schema revision; multibase does the same for the base encoding, so a verifier never infers base58 from base64url by context. A bare hex string or a `sha-256:`-style prefix hard-codes one algorithm into the wire contract and is non-conforming here.\n\nThis definition constrains the *encoding only*. What the digest is computed over is stated by each referencing field, because it differs legitimately: a digest over a JSON document is taken over its RFC 8785 (JCS) canonicalization, while a digest over an opaque artifact is taken over its bytes. A field whose input is a JSON document and which does not name a canonicalization is not reproducible.\n\nRestricted to the two multibase headers W3C Controlled Identifiers 1.0 §2.4 normatively requires — `z` (base58btc) and `u` (base64url-no-pad). CID permits others but states that \"interoperability is not guaranteed between implementations using such values\", and a registry whose purpose is interoperability should not mint digests a conforming verifier may be unable to read. The alphabets are enforced rather than assumed: base58btc excludes 0, O, I and l, and an earlier permissive pattern let three published examples carry digests that were not valid base58 at all. base58btc is RECOMMENDED, for consistency with `did:key` and `did:webvh`.";
+                readonly type: "string";
+                readonly minLength: 16;
+                readonly pattern: "^(z[1-9A-HJ-NP-Za-km-z]+|u[A-Za-z0-9_-]+)$";
+                readonly examples: readonly ["zQmbWqxBEKC3P8tqsKc98xmWNzrzDtRLMiMPL8wBuTGsMnR"];
+            };
+            readonly AccountState: {
+                readonly title: "AccountState";
+                readonly type: "string";
+                readonly enum: readonly ["active", "suspended", "archived"];
+                readonly description: "`active`: usable by its bindings. `suspended`: every issuance and signature is refused at once; management reads continue; resumable. `archived`: hidden from default listings, refused for use, restorable. Deletion removes the record.";
+            };
+            readonly AccountSettings: {
+                readonly title: "AccountSettings";
+                readonly description: "Per-model account settings, discriminated by `model`: every branch is an object whose `model` member is a `const`, which is what lets each generated binding emit a tagged union, so an unusable setting is answered as `external:invalidSettings` naming the member rather than as an unparseable payload. Never a secret: every value here is returned to anyone who may read the account. Branches are referred to by their `model` (\"the `sui-signer` settings\"). They carry no `title`, so that every binding renders each as a plain variant of this union.";
+                readonly oneOf: readonly [{
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["model", "region", "profileArn", "roleArn", "trustAnchorArn"];
+                    readonly description: "Egress: `rolesanywhere.<region>.amazonaws.com`, plus `sts.<region>.amazonaws.com` when `chainedRoleArn` is set.";
+                    readonly properties: {
+                        readonly model: {
+                            readonly type: "string";
+                            readonly const: "aws-roles-anywhere";
+                        };
+                        readonly region: {
+                            readonly $ref: "#/$defs/AwsRegion";
+                        };
+                        readonly trustAnchorArn: {
+                            readonly $ref: "#/$defs/AwsArn";
+                            readonly description: "The trust anchor holding the custodian's CA certificate. Recorded after the administrator creates it from external/accounts/setup.";
+                        };
+                        readonly profileArn: {
+                            readonly $ref: "#/$defs/AwsArn";
+                        };
+                        readonly roleArn: {
+                            readonly $ref: "#/$defs/AwsArn";
+                        };
+                        readonly chainedRoleArn: {
+                            readonly $ref: "#/$defs/AwsArn";
+                            readonly description: "When set, every issuance chains an AssumeRole into this role carrying the downscoping session policy, for deployments whose Roles Anywhere profile cannot carry one per request. Caps a credential at one hour.";
+                        };
+                        readonly bucket: {
+                            readonly $ref: "#/$defs/ProviderBucketName";
+                            readonly description: "The S3 bucket issuances are scoped within. Required for an account whose bindings issue storage scopes.";
+                        };
+                        readonly probePrefix: {
+                            readonly $ref: "#/$defs/ProviderObjectPrefix";
+                            readonly description: "Where external/accounts/probe writes its canary when no binding names a narrower prefix. Lets a new account be probed before anything is bound to it. Absent, a probe of an account with no bindings stops after `exchange` and reports `complete: false`.";
+                        };
+                    };
+                }, {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["model", "projectNumber", "poolId", "providerId"];
+                    readonly description: "Egress: `sts.googleapis.com`, plus `iamcredentials.googleapis.com` when `serviceAccount` is set.";
+                    readonly properties: {
+                        readonly model: {
+                            readonly type: "string";
+                            readonly const: "gcp-wif-pinned";
+                        };
+                        readonly projectNumber: {
+                            readonly type: "string";
+                            readonly pattern: "^[0-9]{1,20}$";
+                        };
+                        readonly poolId: {
+                            readonly type: "string";
+                            readonly pattern: "^[a-z0-9-]{4,32}$";
+                        };
+                        readonly providerId: {
+                            readonly type: "string";
+                            readonly pattern: "^[a-z0-9-]{4,32}$";
+                        };
+                        readonly serviceAccount: {
+                            readonly type: "string";
+                            readonly maxLength: 254;
+                            readonly pattern: "^[a-z0-9-]+@[a-z0-9-]+\\.iam\\.gserviceaccount\\.com$";
+                            readonly description: "When set, the federated token is exchanged for this service account's access token.";
+                        };
+                        readonly signingAlgorithm: {
+                            readonly type: "string";
+                            readonly enum: readonly ["ES256", "RS256"];
+                            readonly description: "The ID-token algorithm. ES256 unless the provider refuses it. Absent means ES256.";
+                        };
+                        readonly bucket: {
+                            readonly $ref: "#/$defs/ProviderBucketName";
+                            readonly description: "The GCS bucket issuances are scoped within, by a Credential Access Boundary.";
+                        };
+                        readonly probePrefix: {
+                            readonly $ref: "#/$defs/ProviderObjectPrefix";
+                            readonly description: "Where external/accounts/probe writes its canary when no binding names a narrower prefix. Lets a new account be probed before anything is bound to it. Absent, a probe of an account with no bindings stops after `exchange` and reports `complete: false`.";
+                        };
+                    };
+                }, {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["model", "tenantId", "clientId", "tokenScope"];
+                    readonly description: "Egress: `login.microsoftonline.com`, or the sovereign-cloud authority named in `authorityHost`.";
+                    readonly properties: {
+                        readonly model: {
+                            readonly type: "string";
+                            readonly const: "azure-cert";
+                        };
+                        readonly tenantId: {
+                            readonly type: "string";
+                            readonly pattern: "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$";
+                        };
+                        readonly clientId: {
+                            readonly type: "string";
+                            readonly pattern: "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$";
+                        };
+                        readonly tokenScope: {
+                            readonly type: "string";
+                            readonly maxLength: 512;
+                            readonly pattern: "^[A-Za-z0-9:/._-]+$";
+                            readonly description: "The `scope` requested at the token endpoint, such as `https://storage.azure.com/.default`.";
+                        };
+                        readonly authorityHost: {
+                            readonly type: "string";
+                            readonly maxLength: 253;
+                            readonly pattern: "^[a-z0-9.-]+$";
+                            readonly description: "Absent means `login.microsoftonline.com`.";
+                        };
+                    };
+                }, {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["model", "tokenEndpoint", "clientId"];
+                    readonly description: "Egress: the host of `tokenEndpoint`, and nothing else.";
+                    readonly properties: {
+                        readonly model: {
+                            readonly type: "string";
+                            readonly const: "oauth2-private-key-jwt";
+                        };
+                        readonly tokenEndpoint: {
+                            readonly $ref: "#/$defs/ProviderHttpsUrl";
+                        };
+                        readonly clientId: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                            readonly maxLength: 512;
+                            readonly pattern: "^[!-~]+$";
+                        };
+                        readonly audience: {
+                            readonly type: "string";
+                            readonly maxLength: 2048;
+                            readonly pattern: "^[!-~]+$";
+                            readonly description: "The assertion's `aud`. Absent means `tokenEndpoint`.";
+                        };
+                        readonly scopes: {
+                            readonly type: "array";
+                            readonly maxItems: 64;
+                            readonly uniqueItems: true;
+                            readonly items: {
+                                readonly type: "string";
+                                readonly maxLength: 256;
+                                readonly pattern: "^[!#-\\[\\]-~]+$";
+                            };
+                            readonly description: "The scopes a binding may request, the ceiling for every issuance.";
+                        };
+                        readonly signingAlgorithm: {
+                            readonly type: "string";
+                            readonly enum: readonly ["ES256", "RS256"];
+                        };
+                    };
+                }, {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["model", "endpoint", "region", "bucket", "accessKeyId"];
+                    readonly description: "Issuance needs no egress: presigning is a computation inside the custodian, and the consumer uses the URL itself. The probe connects to the host of `endpoint`, which `egressHosts` therefore lists.";
+                    readonly properties: {
+                        readonly model: {
+                            readonly type: "string";
+                            readonly const: "s3-static-presign";
+                        };
+                        readonly endpoint: {
+                            readonly $ref: "#/$defs/ProviderHttpsUrl";
+                        };
+                        readonly region: {
+                            readonly type: "string";
+                            readonly maxLength: 64;
+                            readonly pattern: "^[a-z0-9-]+$";
+                            readonly description: "The SigV4 signing region; `auto` for Cloudflare R2.";
+                        };
+                        readonly bucket: {
+                            readonly $ref: "#/$defs/ProviderBucketName";
+                        };
+                        readonly pathStyle: {
+                            readonly type: "boolean";
+                            readonly description: "Address the bucket in the path rather than the host name, as MinIO usually needs.";
+                        };
+                        readonly accessKeyId: {
+                            readonly type: "string";
+                            readonly maxLength: 128;
+                            readonly pattern: "^[A-Za-z0-9]+$";
+                            readonly description: "The access key's identifier. Not a secret: it appears in every presigned URL. The secret half is set with external/accounts/secret/set and never returned.";
+                        };
+                        readonly probePrefix: {
+                            readonly $ref: "#/$defs/ProviderObjectPrefix";
+                            readonly description: "Where external/accounts/probe writes its canary when no binding names a narrower prefix. Lets a new account be probed before anything is bound to it. Absent, a probe of an account with no bindings stops after `exchange` and reports `complete: false`.";
+                        };
+                    };
+                }, {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["model", "network", "allowedCalls", "maxGasBudgetMist", "maxGasPerDayMist"];
+                    readonly description: "No egress: the custodian signs and the consumer submits the transaction. The allow-list, the gas caps and the coin caps are the account's whole authority; a transaction outside them is refused before anything is signed.";
+                    readonly properties: {
+                        readonly model: {
+                            readonly type: "string";
+                            readonly const: "sui-signer";
+                        };
+                        readonly network: {
+                            readonly type: "string";
+                            readonly enum: readonly ["mainnet", "testnet", "devnet"];
+                        };
+                        readonly allowedCalls: {
+                            readonly type: "array";
+                            readonly minItems: 1;
+                            readonly maxItems: 32;
+                            readonly items: {
+                                readonly $ref: "#/$defs/SuiMoveCall";
+                            };
+                            readonly description: "Every MoveCall command in a signed transaction must name one of these. For Walrus storage: the system package's `register_blob`, `certify_blob`, `extend_blob` and `delete_blob`, and the coin calls needed to pay for them.";
+                        };
+                        readonly allowedObjects: {
+                            readonly type: "array";
+                            readonly maxItems: 32;
+                            readonly items: {
+                                readonly type: "string";
+                                readonly pattern: "^0x[0-9a-f]{64}$";
+                            };
+                            readonly description: "Shared objects a transaction may take as input, such as the Walrus system and staking objects. Absent means any object the allowed calls accept.";
+                        };
+                        readonly maxGasBudgetMist: {
+                            readonly type: "integer";
+                            readonly minimum: 1;
+                            readonly description: "The largest gas budget one transaction may declare.";
+                        };
+                        readonly maxGasPerDayMist: {
+                            readonly type: "integer";
+                            readonly minimum: 1;
+                            readonly description: "The total gas budget signed per rolling 24 hours.";
+                        };
+                        readonly maxCoinOutPerTx: {
+                            readonly type: "array";
+                            readonly maxItems: 8;
+                            readonly items: {
+                                readonly type: "object";
+                                readonly additionalProperties: false;
+                                readonly required: readonly ["coinType", "amount"];
+                                readonly properties: {
+                                    readonly coinType: {
+                                        readonly type: "string";
+                                        readonly maxLength: 512;
+                                        readonly pattern: "^0x[0-9a-f]{1,64}::[A-Za-z0-9_]+::[A-Za-z0-9_]+$";
+                                    };
+                                    readonly amount: {
+                                        readonly type: "integer";
+                                        readonly minimum: 0;
+                                    };
+                                };
+                            };
+                            readonly description: "Per coin type, the most a single transaction may spend or transfer out of the account's address, in the coin's smallest unit. A coin type not listed may not leave the address at all.";
+                        };
+                    };
+                }, {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["model", "driver", "baseUrl"];
+                    readonly description: "Egress: the host of `baseUrl`. The secret is set with external/accounts/secret/set and used only inside the custodian by `driver`; a provider reachable only by handing the consumer the raw key is not supported.";
+                    readonly properties: {
+                        readonly model: {
+                            readonly type: "string";
+                            readonly const: "static-secret";
+                        };
+                        readonly driver: {
+                            readonly type: "string";
+                            readonly maxLength: 64;
+                            readonly pattern: "^[a-z0-9][a-z0-9-]*$";
+                            readonly description: "The custodian's driver that uses the secret: performs a login or token exchange and returns a short-lived result. A custodian refuses a driver it does not implement.";
+                        };
+                        readonly baseUrl: {
+                            readonly $ref: "#/$defs/ProviderHttpsUrl";
+                        };
+                    };
+                }];
+            };
+            readonly ProviderHttpsUrl: {
+                readonly title: "ProviderHttpsUrl";
+                readonly type: "string";
+                readonly format: "uri";
+                readonly maxLength: 2048;
+                readonly pattern: "^https://[^\\s\"'\\\\]+$";
+            };
+            readonly SuiMoveCall: {
+                readonly title: "SuiMoveCall";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["package", "module", "function"];
+                readonly description: "One Move function an account's transactions may call.";
+                readonly properties: {
+                    readonly package: {
+                        readonly type: "string";
+                        readonly pattern: "^0x[0-9a-f]{64}$";
+                    };
+                    readonly module: {
+                        readonly type: "string";
+                        readonly pattern: "^[A-Za-z][A-Za-z0-9_]{0,127}$";
+                    };
+                    readonly function: {
+                        readonly type: "string";
+                        readonly pattern: "^[A-Za-z][A-Za-z0-9_]{0,127}$";
+                    };
+                };
+            };
+            readonly ProviderBucketName: {
+                readonly title: "ProviderBucketName";
+                readonly type: "string";
+                readonly minLength: 3;
+                readonly maxLength: 63;
+                readonly pattern: "^[a-z0-9][a-z0-9.-]*[a-z0-9]$";
+                readonly description: "A bucket name as S3 and GCS accept it. Validated rather than free so that it can be placed in a provider policy without escaping.";
+            };
+            readonly AwsArn: {
+                readonly title: "AwsArn";
+                readonly type: "string";
+                readonly maxLength: 2048;
+                readonly pattern: "^arn:aws[a-z-]*:[a-z0-9-]+:[a-z0-9-]*:[0-9]{0,12}:[A-Za-z0-9+=,.@_/:-]+$";
+            };
+            readonly AwsRegion: {
+                readonly title: "AwsRegion";
+                readonly type: "string";
+                readonly pattern: "^[a-z]{2}(-gov)?-[a-z]+-[0-9]$";
+                readonly maxLength: 32;
+            };
+            readonly AccountContextId: {
+                readonly title: "AccountContextId";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 256;
+                readonly description: "The custodian context that owns the account. Act scope in this context decides who may manage the account and who may consume it; the account's keys are derived in this context's key space.";
+            };
+            readonly AccountId: {
+                readonly title: "AccountId";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 64;
+                readonly pattern: "^[a-z0-9][a-z0-9-]*$";
+                readonly description: "The account's identifier within its context, chosen by whoever creates it. Lowercase letters, digits and hyphens, so that it can be embedded in a certificate subject, a token subject or a provider-side condition without escaping. Unique per context; never reused after deletion while anything that names it (a provider-side trust policy, an audit row) may still exist.";
+            };
+        };
+    };
+};
+//# sourceMappingURL=payload.d.ts.map