@openvtc/trust-tasks 0.23.8 → 0.24.0

package/dist/external/accounts/setup/0.1/payload.d.ts

@@ -0,0 +1,535 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/external/accounts/setup/0.1/payload.schema.json
+ */
+import type { AccountContextId, AccountId, AccountSetupArtifacts, AuthModel, Ext } from "../../../../_shared/components.js";
+/**
+ * Generate the provider-side setup for an external account. The outer document members are owned by the framework — SPEC §6.3.
+ */
+export interface ExternalAccountsSetupPayload {
+    context: AccountContextId;
+    id: AccountId;
+    ext?: Ext;
+}
+export interface ExternalAccountsSetupResponsePayload {
+    setup: AccountSetupArtifacts;
+    ext?: Ext;
+}
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { AccountContextId, AccountId, AccountSetupArtifacts, AuthModel, Ext };
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/external/accounts/setup/0.1";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = ExternalAccountsSetupPayload;
+/** Trust Task response type URI (request type URI + "#response"). */
+export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/external/accounts/setup/0.1#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = ExternalAccountsSetupResponsePayload;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/external/accounts/setup/0.1";
+    readonly title: "External Accounts — Setup — payload";
+    readonly description: "Generate the provider-side setup for an external account. The outer document members are owned by the framework — SPEC §6.3.";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["context", "id"];
+    readonly properties: {
+        readonly context: {
+            readonly $ref: "#/$defs/AccountContextId";
+        };
+        readonly id: {
+            readonly $ref: "#/$defs/AccountId";
+        };
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+        };
+    };
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "External Accounts — Setup — response payload";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["setup"];
+            readonly properties: {
+                readonly setup: {
+                    readonly $ref: "#/$defs/AccountSetupArtifacts";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly AccountSetupArtifacts: {
+            readonly title: "AccountSetupArtifacts";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["model", "artifacts", "steps"];
+            readonly description: "What an administrator does at the provider to make an account usable, generated by the custodian from the account's settings, public material and bindings. Public material and policy only: never a private key or secret, and the custodian never asks for the provider's administrator credentials.";
+            readonly properties: {
+                readonly model: {
+                    readonly $ref: "#/$defs/AuthModel";
+                };
+                readonly artifacts: {
+                    readonly type: "array";
+                    readonly maxItems: 16;
+                    readonly items: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["name", "mediaType", "content"];
+                        readonly properties: {
+                            readonly name: {
+                                readonly type: "string";
+                                readonly maxLength: 128;
+                                readonly pattern: "^[A-Za-z0-9._-]+$";
+                                readonly description: "File name to save it under: `trust-anchor.pem`, `jwks.json`, `permissions-policy.json`, `crl.pem`.";
+                            };
+                            readonly mediaType: {
+                                readonly type: "string";
+                                readonly maxLength: 128;
+                                readonly pattern: "^[a-z]+/[a-z0-9.+-]+$";
+                            };
+                            readonly content: {
+                                readonly type: "string";
+                                readonly maxLength: 65536;
+                            };
+                        };
+                    };
+                };
+                readonly steps: {
+                    readonly type: "array";
+                    readonly maxItems: 32;
+                    readonly items: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["description"];
+                        readonly properties: {
+                            readonly description: {
+                                readonly type: "string";
+                                readonly maxLength: 1024;
+                            };
+                            readonly command: {
+                                readonly type: "string";
+                                readonly maxLength: 8192;
+                                readonly description: "A provider CLI command (`aws rolesanywhere create-trust-anchor …`, `gcloud iam workload-identity-pools providers create-oidc … --jwk-json-path`, `az ad app credential reset --cert …`), referring to artifacts by `name`.";
+                            };
+                        };
+                    };
+                };
+            };
+        };
+        readonly AuthModel: {
+            readonly title: "AuthModel";
+            readonly type: "string";
+            readonly enum: readonly ["aws-roles-anywhere", "gcp-wif-pinned", "azure-cert", "oauth2-private-key-jwt", "s3-static-presign", "sui-signer", "static-secret"];
+            readonly description: "How the account authenticates to its provider. Every model pins the custodian's verification material in the provider's own account, uploaded once, so no model requires the custodian to be reachable from the internet. `aws-roles-anywhere`: the custodian is the certificate authority of an IAM Roles Anywhere trust anchor, and signs CreateSession with a short-lived end-entity certificate it issued to the account's own key. `gcp-wif-pinned`: a Workload Identity Federation pool provider holds an uploaded JWKS; the custodian signs an ID token and exchanges it at Google's STS. `azure-cert`: a certificate uploaded to an Entra app registration; the custodian signs an RFC 7523 client assertion. `oauth2-private-key-jwt`: the same RFC 7523 client authentication against any token endpoint that registered the custodian's public key. `s3-static-presign`: an access-key pair for an S3-compatible store that cannot federate; the custodian presigns per-object URLs and never releases the key. `sui-signer`: a Sui address derived from the custodian's key; the custodian signs only allow-listed transactions. `static-secret`: an API key or token used inside the custodian by a named driver; last resort, never released.\n\nPlain OpenID Connect discovery federation is deliberately absent. It works by the provider fetching the issuer's JWKS from a public URL, which either makes the custodian reachable from the internet or makes whoever hosts a copy of the JWKS able to mint credentials for every federated role.";
+        };
+        readonly AccountId: {
+            readonly title: "AccountId";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 64;
+            readonly pattern: "^[a-z0-9][a-z0-9-]*$";
+            readonly description: "The account's identifier within its context, chosen by whoever creates it. Lowercase letters, digits and hyphens, so that it can be embedded in a certificate subject, a token subject or a provider-side condition without escaping. Unique per context; never reused after deletion while anything that names it (a provider-side trust policy, an audit row) may still exist.";
+        };
+        readonly AccountContextId: {
+            readonly title: "AccountContextId";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 256;
+            readonly description: "The custodian context that owns the account. Act scope in this context decides who may manage the account and who may consume it; the account's keys are derived in this context's key space.";
+        };
+    };
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export declare const RESPONSE_PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $ref: "#/$defs/Response";
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "External Accounts — Setup — response payload";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["setup"];
+            readonly properties: {
+                readonly setup: {
+                    readonly $ref: "#/$defs/AccountSetupArtifacts";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly AccountSetupArtifacts: {
+            readonly title: "AccountSetupArtifacts";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["model", "artifacts", "steps"];
+            readonly description: "What an administrator does at the provider to make an account usable, generated by the custodian from the account's settings, public material and bindings. Public material and policy only: never a private key or secret, and the custodian never asks for the provider's administrator credentials.";
+            readonly properties: {
+                readonly model: {
+                    readonly $ref: "#/$defs/AuthModel";
+                };
+                readonly artifacts: {
+                    readonly type: "array";
+                    readonly maxItems: 16;
+                    readonly items: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["name", "mediaType", "content"];
+                        readonly properties: {
+                            readonly name: {
+                                readonly type: "string";
+                                readonly maxLength: 128;
+                                readonly pattern: "^[A-Za-z0-9._-]+$";
+                                readonly description: "File name to save it under: `trust-anchor.pem`, `jwks.json`, `permissions-policy.json`, `crl.pem`.";
+                            };
+                            readonly mediaType: {
+                                readonly type: "string";
+                                readonly maxLength: 128;
+                                readonly pattern: "^[a-z]+/[a-z0-9.+-]+$";
+                            };
+                            readonly content: {
+                                readonly type: "string";
+                                readonly maxLength: 65536;
+                            };
+                        };
+                    };
+                };
+                readonly steps: {
+                    readonly type: "array";
+                    readonly maxItems: 32;
+                    readonly items: {
+                        readonly type: "object";
+                        readonly additionalProperties: false;
+                        readonly required: readonly ["description"];
+                        readonly properties: {
+                            readonly description: {
+                                readonly type: "string";
+                                readonly maxLength: 1024;
+                            };
+                            readonly command: {
+                                readonly type: "string";
+                                readonly maxLength: 8192;
+                                readonly description: "A provider CLI command (`aws rolesanywhere create-trust-anchor …`, `gcloud iam workload-identity-pools providers create-oidc … --jwk-json-path`, `az ad app credential reset --cert …`), referring to artifacts by `name`.";
+                            };
+                        };
+                    };
+                };
+            };
+        };
+        readonly AuthModel: {
+            readonly title: "AuthModel";
+            readonly type: "string";
+            readonly enum: readonly ["aws-roles-anywhere", "gcp-wif-pinned", "azure-cert", "oauth2-private-key-jwt", "s3-static-presign", "sui-signer", "static-secret"];
+            readonly description: "How the account authenticates to its provider. Every model pins the custodian's verification material in the provider's own account, uploaded once, so no model requires the custodian to be reachable from the internet. `aws-roles-anywhere`: the custodian is the certificate authority of an IAM Roles Anywhere trust anchor, and signs CreateSession with a short-lived end-entity certificate it issued to the account's own key. `gcp-wif-pinned`: a Workload Identity Federation pool provider holds an uploaded JWKS; the custodian signs an ID token and exchanges it at Google's STS. `azure-cert`: a certificate uploaded to an Entra app registration; the custodian signs an RFC 7523 client assertion. `oauth2-private-key-jwt`: the same RFC 7523 client authentication against any token endpoint that registered the custodian's public key. `s3-static-presign`: an access-key pair for an S3-compatible store that cannot federate; the custodian presigns per-object URLs and never releases the key. `sui-signer`: a Sui address derived from the custodian's key; the custodian signs only allow-listed transactions. `static-secret`: an API key or token used inside the custodian by a named driver; last resort, never released.\n\nPlain OpenID Connect discovery federation is deliberately absent. It works by the provider fetching the issuer's JWKS from a public URL, which either makes the custodian reachable from the internet or makes whoever hosts a copy of the JWKS able to mint credentials for every federated role.";
+        };
+        readonly AccountId: {
+            readonly title: "AccountId";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 64;
+            readonly pattern: "^[a-z0-9][a-z0-9-]*$";
+            readonly description: "The account's identifier within its context, chosen by whoever creates it. Lowercase letters, digits and hyphens, so that it can be embedded in a certificate subject, a token subject or a provider-side condition without escaping. Unique per context; never reused after deletion while anything that names it (a provider-side trust policy, an audit row) may still exist.";
+        };
+        readonly AccountContextId: {
+            readonly title: "AccountContextId";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 256;
+            readonly description: "The custodian context that owns the account. Act scope in this context decides who may manage the account and who may consume it; the account's keys are derived in this context's key space.";
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export declare const SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/external/accounts/setup/0.1";
+    readonly isBearer: false;
+    readonly isProofRequired: false;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: false;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/external/accounts/setup/0.1";
+        readonly title: "External Accounts — Setup — payload";
+        readonly description: "Generate the provider-side setup for an external account. The outer document members are owned by the framework — SPEC §6.3.";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly required: readonly ["context", "id"];
+        readonly properties: {
+            readonly context: {
+                readonly $ref: "#/$defs/AccountContextId";
+            };
+            readonly id: {
+                readonly $ref: "#/$defs/AccountId";
+            };
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+            };
+        };
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "External Accounts — Setup — response payload";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["setup"];
+                readonly properties: {
+                    readonly setup: {
+                        readonly $ref: "#/$defs/AccountSetupArtifacts";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly AccountSetupArtifacts: {
+                readonly title: "AccountSetupArtifacts";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["model", "artifacts", "steps"];
+                readonly description: "What an administrator does at the provider to make an account usable, generated by the custodian from the account's settings, public material and bindings. Public material and policy only: never a private key or secret, and the custodian never asks for the provider's administrator credentials.";
+                readonly properties: {
+                    readonly model: {
+                        readonly $ref: "#/$defs/AuthModel";
+                    };
+                    readonly artifacts: {
+                        readonly type: "array";
+                        readonly maxItems: 16;
+                        readonly items: {
+                            readonly type: "object";
+                            readonly additionalProperties: false;
+                            readonly required: readonly ["name", "mediaType", "content"];
+                            readonly properties: {
+                                readonly name: {
+                                    readonly type: "string";
+                                    readonly maxLength: 128;
+                                    readonly pattern: "^[A-Za-z0-9._-]+$";
+                                    readonly description: "File name to save it under: `trust-anchor.pem`, `jwks.json`, `permissions-policy.json`, `crl.pem`.";
+                                };
+                                readonly mediaType: {
+                                    readonly type: "string";
+                                    readonly maxLength: 128;
+                                    readonly pattern: "^[a-z]+/[a-z0-9.+-]+$";
+                                };
+                                readonly content: {
+                                    readonly type: "string";
+                                    readonly maxLength: 65536;
+                                };
+                            };
+                        };
+                    };
+                    readonly steps: {
+                        readonly type: "array";
+                        readonly maxItems: 32;
+                        readonly items: {
+                            readonly type: "object";
+                            readonly additionalProperties: false;
+                            readonly required: readonly ["description"];
+                            readonly properties: {
+                                readonly description: {
+                                    readonly type: "string";
+                                    readonly maxLength: 1024;
+                                };
+                                readonly command: {
+                                    readonly type: "string";
+                                    readonly maxLength: 8192;
+                                    readonly description: "A provider CLI command (`aws rolesanywhere create-trust-anchor …`, `gcloud iam workload-identity-pools providers create-oidc … --jwk-json-path`, `az ad app credential reset --cert …`), referring to artifacts by `name`.";
+                                };
+                            };
+                        };
+                    };
+                };
+            };
+            readonly AuthModel: {
+                readonly title: "AuthModel";
+                readonly type: "string";
+                readonly enum: readonly ["aws-roles-anywhere", "gcp-wif-pinned", "azure-cert", "oauth2-private-key-jwt", "s3-static-presign", "sui-signer", "static-secret"];
+                readonly description: "How the account authenticates to its provider. Every model pins the custodian's verification material in the provider's own account, uploaded once, so no model requires the custodian to be reachable from the internet. `aws-roles-anywhere`: the custodian is the certificate authority of an IAM Roles Anywhere trust anchor, and signs CreateSession with a short-lived end-entity certificate it issued to the account's own key. `gcp-wif-pinned`: a Workload Identity Federation pool provider holds an uploaded JWKS; the custodian signs an ID token and exchanges it at Google's STS. `azure-cert`: a certificate uploaded to an Entra app registration; the custodian signs an RFC 7523 client assertion. `oauth2-private-key-jwt`: the same RFC 7523 client authentication against any token endpoint that registered the custodian's public key. `s3-static-presign`: an access-key pair for an S3-compatible store that cannot federate; the custodian presigns per-object URLs and never releases the key. `sui-signer`: a Sui address derived from the custodian's key; the custodian signs only allow-listed transactions. `static-secret`: an API key or token used inside the custodian by a named driver; last resort, never released.\n\nPlain OpenID Connect discovery federation is deliberately absent. It works by the provider fetching the issuer's JWKS from a public URL, which either makes the custodian reachable from the internet or makes whoever hosts a copy of the JWKS able to mint credentials for every federated role.";
+            };
+            readonly AccountId: {
+                readonly title: "AccountId";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 64;
+                readonly pattern: "^[a-z0-9][a-z0-9-]*$";
+                readonly description: "The account's identifier within its context, chosen by whoever creates it. Lowercase letters, digits and hyphens, so that it can be embedded in a certificate subject, a token subject or a provider-side condition without escaping. Unique per context; never reused after deletion while anything that names it (a provider-side trust policy, an audit row) may still exist.";
+            };
+            readonly AccountContextId: {
+                readonly title: "AccountContextId";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 256;
+                readonly description: "The custodian context that owns the account. Act scope in this context decides who may manage the account and who may consume it; the account's keys are derived in this context's key space.";
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export declare const RESPONSE_SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/external/accounts/setup/0.1#response";
+    readonly isBearer: false;
+    readonly isProofRequired: false;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: false;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $ref: "#/$defs/Response";
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "External Accounts — Setup — response payload";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["setup"];
+                readonly properties: {
+                    readonly setup: {
+                        readonly $ref: "#/$defs/AccountSetupArtifacts";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly AccountSetupArtifacts: {
+                readonly title: "AccountSetupArtifacts";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["model", "artifacts", "steps"];
+                readonly description: "What an administrator does at the provider to make an account usable, generated by the custodian from the account's settings, public material and bindings. Public material and policy only: never a private key or secret, and the custodian never asks for the provider's administrator credentials.";
+                readonly properties: {
+                    readonly model: {
+                        readonly $ref: "#/$defs/AuthModel";
+                    };
+                    readonly artifacts: {
+                        readonly type: "array";
+                        readonly maxItems: 16;
+                        readonly items: {
+                            readonly type: "object";
+                            readonly additionalProperties: false;
+                            readonly required: readonly ["name", "mediaType", "content"];
+                            readonly properties: {
+                                readonly name: {
+                                    readonly type: "string";
+                                    readonly maxLength: 128;
+                                    readonly pattern: "^[A-Za-z0-9._-]+$";
+                                    readonly description: "File name to save it under: `trust-anchor.pem`, `jwks.json`, `permissions-policy.json`, `crl.pem`.";
+                                };
+                                readonly mediaType: {
+                                    readonly type: "string";
+                                    readonly maxLength: 128;
+                                    readonly pattern: "^[a-z]+/[a-z0-9.+-]+$";
+                                };
+                                readonly content: {
+                                    readonly type: "string";
+                                    readonly maxLength: 65536;
+                                };
+                            };
+                        };
+                    };
+                    readonly steps: {
+                        readonly type: "array";
+                        readonly maxItems: 32;
+                        readonly items: {
+                            readonly type: "object";
+                            readonly additionalProperties: false;
+                            readonly required: readonly ["description"];
+                            readonly properties: {
+                                readonly description: {
+                                    readonly type: "string";
+                                    readonly maxLength: 1024;
+                                };
+                                readonly command: {
+                                    readonly type: "string";
+                                    readonly maxLength: 8192;
+                                    readonly description: "A provider CLI command (`aws rolesanywhere create-trust-anchor …`, `gcloud iam workload-identity-pools providers create-oidc … --jwk-json-path`, `az ad app credential reset --cert …`), referring to artifacts by `name`.";
+                                };
+                            };
+                        };
+                    };
+                };
+            };
+            readonly AuthModel: {
+                readonly title: "AuthModel";
+                readonly type: "string";
+                readonly enum: readonly ["aws-roles-anywhere", "gcp-wif-pinned", "azure-cert", "oauth2-private-key-jwt", "s3-static-presign", "sui-signer", "static-secret"];
+                readonly description: "How the account authenticates to its provider. Every model pins the custodian's verification material in the provider's own account, uploaded once, so no model requires the custodian to be reachable from the internet. `aws-roles-anywhere`: the custodian is the certificate authority of an IAM Roles Anywhere trust anchor, and signs CreateSession with a short-lived end-entity certificate it issued to the account's own key. `gcp-wif-pinned`: a Workload Identity Federation pool provider holds an uploaded JWKS; the custodian signs an ID token and exchanges it at Google's STS. `azure-cert`: a certificate uploaded to an Entra app registration; the custodian signs an RFC 7523 client assertion. `oauth2-private-key-jwt`: the same RFC 7523 client authentication against any token endpoint that registered the custodian's public key. `s3-static-presign`: an access-key pair for an S3-compatible store that cannot federate; the custodian presigns per-object URLs and never releases the key. `sui-signer`: a Sui address derived from the custodian's key; the custodian signs only allow-listed transactions. `static-secret`: an API key or token used inside the custodian by a named driver; last resort, never released.\n\nPlain OpenID Connect discovery federation is deliberately absent. It works by the provider fetching the issuer's JWKS from a public URL, which either makes the custodian reachable from the internet or makes whoever hosts a copy of the JWKS able to mint credentials for every federated role.";
+            };
+            readonly AccountId: {
+                readonly title: "AccountId";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 64;
+                readonly pattern: "^[a-z0-9][a-z0-9-]*$";
+                readonly description: "The account's identifier within its context, chosen by whoever creates it. Lowercase letters, digits and hyphens, so that it can be embedded in a certificate subject, a token subject or a provider-side condition without escaping. Unique per context; never reused after deletion while anything that names it (a provider-side trust policy, an audit row) may still exist.";
+            };
+            readonly AccountContextId: {
+                readonly title: "AccountContextId";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 256;
+                readonly description: "The custodian context that owns the account. Act scope in this context decides who may manage the account and who may consume it; the account's keys are derived in this context's key space.";
+            };
+        };
+    };
+};
+//# sourceMappingURL=payload.d.ts.map

package/dist/external/accounts/setup/0.1/payload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../../src/external/accounts/setup/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,qBAAqB,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,mCAAmC,CAAC;AAG5H;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,gBAAgB,CAAC;IAC1B,EAAE,EAAE,SAAS,CAAC;IACd,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD,MAAM,WAAW,oCAAoC;IACnD,KAAK,EAAE,qBAAqB,CAAC;IAC7B,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AAED,kHAAkH;AAClH,YAAY,EAAE,gBAAgB,EAAE,SAAS,EAAE,qBAAqB,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;AAEnF,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,yDAAkE,CAAC;AAE3F,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,4BAA4B,CAAC;AAEnD,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,kEAA2E,CAAC;AAE7G,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,oCAAoC,CAAC;AAE5D;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoJjB,CAAC;AAEX,mEAAmE;AACnE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiI1B,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOP,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOhB,CAAC"}