@openvtc/trust-tasks 0.27.5 → 0.27.6

package/dist/vtc/storage/configs/update/0.3/payload.d.ts

@@ -0,0 +1,1376 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/vtc/storage/configs/update/0.3/payload.schema.json
+ */
+import type { AwsRoleArn, ConfigState, Ext, ExternalAccountContextId, ExternalAccountId, GcsSettings, LocalSettings, ObjectPrefix, S3Settings, StorageAuth_VtcV0_2 as StorageAuth, StorageConfig_VtcV0_2 as StorageConfig, StorageConfigId, StorageSettings, WalrusSettings } from "../../../../../_shared/components.js";
+/**
+ * Change a storage config's label, settings that do not locate stored blobs, authentication, capacity or default flag. Never a secret. The outer document members are owned by the framework — SPEC §6.3.
+ */
+export interface VTCStorageConfigsUpdatePayload {
+    configId: StorageConfigId;
+    /**
+     * A display name for administrators and, with the kind, for a room's creator.
+     */
+    label?: string;
+    settings?: StorageSettings;
+    auth?: StorageAuth;
+    /**
+     * Total ciphertext bytes the community will store on this config across every room. Absent means none set.
+     */
+    capacityBytes?: number;
+    /**
+     * Make this the config rooms are assigned to when neither policy nor creator names one.
+     */
+    isDefault?: boolean;
+    /**
+     * Why the administrator is making this change. Recorded with the change in the audit trail and shown to approvers. Attributed to its author on every surface and untrusted: it MUST NOT carry personal data or a credential, and a reader MUST NOT treat it as instructions.
+     */
+    reason: string;
+    ext?: Ext;
+}
+export interface VTCStorageConfigsUpdateResponsePayload {
+    config: StorageConfig;
+    ext?: Ext;
+}
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { AwsRoleArn, ConfigState, Ext, ExternalAccountContextId, ExternalAccountId, GcsSettings, LocalSettings, ObjectPrefix, S3Settings, StorageAuth, StorageConfig, StorageConfigId, StorageSettings, WalrusSettings };
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/vtc/storage/configs/update/0.3";
+/**
+ * The earlier version of this specification that this one declares it
+ * extends (front matter `extends`, SPEC §5.2 "Declared extension"), or
+ * `null`. Only the direct declaration — follow the chain with
+ * `extendsChain` / `readForSpec`.
+ */
+export declare const EXTENDS: string | null;
+/**
+ * Why this version is deprecated, or `null` while it is current. A
+ * superseded or retired version is still supported, and is withdrawn from
+ * this package in a later scheduled batch (SPEC "Superseded and Withdrawn
+ * Versions").
+ */
+export declare const DEPRECATION: string | null;
+/** Stable alias for this specification's request payload shape. */
+export type Payload = VTCStorageConfigsUpdatePayload;
+/** Trust Task response type URI (request type URI + "#response"). */
+export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/vtc/storage/configs/update/0.3#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = VTCStorageConfigsUpdateResponsePayload;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/vtc/storage/configs/update/0.3";
+    readonly title: "VTC Storage — Configs — Update — payload";
+    readonly description: "Change a storage config's label, settings that do not locate stored blobs, authentication, capacity or default flag. Never a secret. The outer document members are owned by the framework — SPEC §6.3.";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["configId", "reason"];
+    readonly minProperties: 3;
+    readonly properties: {
+        readonly configId: {
+            readonly $ref: "#/$defs/StorageConfigId";
+        };
+        readonly label: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 128;
+            readonly description: "A display name for administrators and, with the kind, for a room's creator.";
+        };
+        readonly settings: {
+            readonly $ref: "#/$defs/StorageSettings";
+        };
+        readonly auth: {
+            readonly $ref: "#/$defs/StorageAuth";
+        };
+        readonly capacityBytes: {
+            readonly type: "integer";
+            readonly minimum: 0;
+            readonly description: "Total ciphertext bytes the community will store on this config across every room. Absent means none set.";
+        };
+        readonly isDefault: {
+            readonly type: "boolean";
+            readonly description: "Make this the config rooms are assigned to when neither policy nor creator names one.";
+        };
+        readonly reason: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 500;
+            readonly description: "Why the administrator is making this change. Recorded with the change in the audit trail and shown to approvers. Attributed to its author on every surface and untrusted: it MUST NOT carry personal data or a credential, and a reader MUST NOT treat it as instructions.";
+        };
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+        };
+    };
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "VTC Storage — Configs — Update — response payload";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["config"];
+            readonly properties: {
+                readonly config: {
+                    readonly $ref: "#/$defs/StorageConfig";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly StorageConfig: {
+            readonly title: "StorageConfig";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["id", "label", "settings", "state", "createdBy", "createdAt"];
+            readonly description: "One storage config as the community holds it. Carries no secret.";
+            readonly properties: {
+                readonly id: {
+                    readonly $ref: "#/$defs/StorageConfigId";
+                };
+                readonly label: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 128;
+                    readonly description: "A display name for administrators (`EU — S3 (main account)`). Shown to a room's creator with the config's kind when the community lets them choose.";
+                };
+                readonly settings: {
+                    readonly $ref: "#/$defs/StorageSettings";
+                };
+                readonly auth: {
+                    readonly $ref: "#/$defs/StorageAuth";
+                };
+                readonly capacityBytes: {
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                    readonly description: "Total ciphertext bytes the community will store on this config, across every room assigned to it. A capacity, not a policy: an upload that would cross it is refused with scope `storage`. Absent means no capacity set.";
+                };
+                readonly state: {
+                    readonly $ref: "#/$defs/ConfigState";
+                };
+                readonly isDefault: {
+                    readonly type: "boolean";
+                    readonly description: "True for the config a room is assigned to when neither the community's policy nor its creator names one.";
+                };
+                readonly createdBy: {
+                    readonly type: "string";
+                    readonly pattern: "^did:";
+                    readonly maxLength: 2048;
+                };
+                readonly createdAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly updatedBy: {
+                    readonly type: "string";
+                    readonly pattern: "^did:";
+                    readonly maxLength: 2048;
+                };
+                readonly updatedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+            };
+        };
+        readonly ConfigState: {
+            readonly title: "ConfigState";
+            readonly type: "string";
+            readonly enum: readonly ["active", "draining", "retired"];
+            readonly description: "`active`: accepts new rooms and new uploads. `draining`: retired by an administrator while blobs still name it — refuses new rooms and new uploads, keeps serving reads, and becomes `retired` when a migration has emptied it. `retired`: refuses new rooms and new uploads and holds no blob. A config is never deleted while a blob names it.";
+        };
+        readonly StorageAuth: {
+            readonly title: "StorageAuth";
+            readonly description: "How the community authenticates to a config's backend. Absent on a `local` config, which needs none.\n\n`vta-account` (RECOMMENDED): an external account in the community's VTA, named by the context that owns it and its identifier there. The VTA holds the long-lived authority; the community holds nothing that outlives a credential lifetime, and asks for credentials scoped to one room's prefix for at most 15 minutes, every issuance audited at the VTA. Required for a `walrus` config other than a `sealed` one, since the VTA's `sui-signer` account signs its storage transactions.\n\n`ambient`: the cloud identity of the machine the community runs on (an instance role, workload identity), downscoped to one room's prefix by the community itself under the rules of vtc/storage/configs/create/0.2 — on `s3`, by assuming `roleArn` (or the role the host is configured with) with an inline session policy; on `gcs`, by a Credential Access Boundary. Not audited or rate-limited by the VTA, and usable by anything on that machine that reaches the metadata endpoint. Not valid for `walrus`; `roleArn` is valid only on `s3`.\n\n`sealed` (discouraged): a long-lived credential stored by the community, set with vtc/storage/credentials/set (0.2: a `SealedStorageCredential`). Protects against every administrator through every surface the community offers; does NOT protect against whoever operates the machine, and a community labels it so wherever the config is shown.\n\n`ambient` and `sealed` are host-operator choices: a community MAY refuse either by its own host configuration, whatever its administrators ask.";
+            readonly oneOf: readonly [{
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["mode", "context", "account"];
+                readonly properties: {
+                    readonly mode: {
+                        readonly const: "vta-account";
+                    };
+                    readonly context: {
+                        readonly $ref: "#/$defs/ExternalAccountContextId";
+                    };
+                    readonly account: {
+                        readonly $ref: "#/$defs/ExternalAccountId";
+                    };
+                };
+            }, {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["mode"];
+                readonly properties: {
+                    readonly mode: {
+                        readonly const: "ambient";
+                    };
+                    readonly roleArn: {
+                        readonly $ref: "#/$defs/AwsRoleArn";
+                        readonly description: "`s3` only: the IAM role the community assumes, with the machine's ambient identity, to obtain each room-scoped session. Absent, the community assumes the role its host configuration names, and with none configured, the role of the ambient identity itself (which must then trust itself to be assumed). Refused on any other kind with `authNotAllowed`.";
+                    };
+                };
+            }, {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["mode"];
+                readonly properties: {
+                    readonly mode: {
+                        readonly const: "sealed";
+                    };
+                };
+            }];
+        };
+        readonly AwsRoleArn: {
+            readonly title: "AwsRoleArn";
+            readonly type: "string";
+            readonly minLength: 20;
+            readonly maxLength: 2048;
+            readonly pattern: "^arn:aws(-[a-z]+)*:iam::[0-9]{12}:role/[A-Za-z0-9+=,.@_/-]{1,512}$";
+            readonly description: "The ARN of an AWS IAM role, in any AWS partition (`arn:aws:`, `arn:aws-cn:`, `arn:aws-us-gov:`). Validated here because the community passes it to STS AssumeRole and derives the partition of the session policy's resources from it; it must never carry anything but a role ARN.";
+        };
+        readonly ExternalAccountId: {
+            readonly title: "ExternalAccountId";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 64;
+            readonly pattern: "^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$";
+            readonly description: "The identifier of an external account held by the community's VTA (the external/accounts/* family), which issues the community short-lived, room-scoped credentials and holds the long-lived authority itself.";
+        };
+        readonly ExternalAccountContextId: {
+            readonly title: "ExternalAccountContextId";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 256;
+            readonly description: "The context at the community's VTA that owns an external account. The VTA names an account by its context and its identifier, and decides who may use it by act scope in that context: the community must hold `external-auth-use` there, and be bound to the account, for the account to issue it anything. Naming a context grants nothing; the VTA's binding is the gate.";
+        };
+        readonly StorageSettings: {
+            readonly title: "StorageSettings";
+            readonly description: "A config's backend settings, discriminated by `kind`. Never a secret: a credential is a StorageAuth, held elsewhere.";
+            readonly oneOf: readonly [{
+                readonly $ref: "#/$defs/LocalSettings";
+            }, {
+                readonly $ref: "#/$defs/S3Settings";
+            }, {
+                readonly $ref: "#/$defs/GcsSettings";
+            }, {
+                readonly $ref: "#/$defs/WalrusSettings";
+            }];
+        };
+        readonly WalrusSettings: {
+            readonly title: "WalrusSettings";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["kind", "relayUrl", "aggregatorUrl", "epochs", "extendBeforeEpochs"];
+            readonly properties: {
+                readonly kind: {
+                    readonly const: "walrus";
+                };
+                readonly relayUrl: {
+                    readonly type: "string";
+                    readonly format: "uri";
+                    readonly maxLength: 2048;
+                    readonly pattern: "^https://";
+                    readonly description: "The Walrus upload relay the community writes through. The community never runs a publisher: a publisher holds a hot wallet in its own configuration, which is the long-lived secret these tasks exist to avoid.";
+                };
+                readonly aggregatorUrl: {
+                    readonly type: "string";
+                    readonly format: "uri";
+                    readonly maxLength: 2048;
+                    readonly pattern: "^https://";
+                    readonly description: "The Walrus aggregator the community reads through.";
+                };
+                readonly epochs: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                    readonly maximum: 53;
+                    readonly description: "Storage epochs to buy when a blob is registered. Walrus sells storage in epochs (two weeks on mainnet) and caps one purchase at 53.";
+                };
+                readonly extendBeforeEpochs: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                    readonly maximum: 52;
+                    readonly description: "How many epochs before a live blob's end epoch the community extends it. A blob that has become an orphan is not extended, and lapses: the Walrus form of deletion.";
+                };
+            };
+        };
+        readonly GcsSettings: {
+            readonly title: "GcsSettings";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["kind", "bucket"];
+            readonly properties: {
+                readonly kind: {
+                    readonly const: "gcs";
+                };
+                readonly bucket: {
+                    readonly type: "string";
+                    readonly minLength: 3;
+                    readonly maxLength: 222;
+                    readonly pattern: "^[a-z0-9][a-z0-9._-]{1,220}[a-z0-9]$";
+                    readonly description: "The bucket name. Validated against GCS naming rules here, because it is placed in a Credential Access Boundary condition and must never carry anything but a name.";
+                };
+                readonly prefix: {
+                    readonly $ref: "#/$defs/ObjectPrefix";
+                };
+            };
+        };
+        readonly ObjectPrefix: {
+            readonly title: "ObjectPrefix";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 256;
+            readonly pattern: "^[A-Za-z0-9!_.*'()/-]+/$";
+            readonly description: "A key prefix inside the bucket, ending in `/`, under which the config's `rooms/` tree is placed. Restricted to the S3 safe-character set so that it can be placed in a downscoped policy without escaping.";
+        };
+        readonly S3Settings: {
+            readonly title: "S3Settings";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["kind", "region", "bucket"];
+            readonly properties: {
+                readonly kind: {
+                    readonly const: "s3";
+                };
+                readonly endpoint: {
+                    readonly type: "string";
+                    readonly format: "uri";
+                    readonly maxLength: 2048;
+                    readonly pattern: "^https://";
+                    readonly description: "The S3 API endpoint, for a store other than AWS (R2, B2, MinIO). Absent means AWS S3 in `region`. HTTPS only.";
+                };
+                readonly region: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 64;
+                    readonly pattern: "^[a-z0-9-]+$";
+                    readonly description: "The bucket's region, as the store names it (`eu-west-1`; `auto` for R2).";
+                };
+                readonly bucket: {
+                    readonly type: "string";
+                    readonly minLength: 3;
+                    readonly maxLength: 63;
+                    readonly pattern: "^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$";
+                    readonly description: "The bucket name. Validated against S3 naming rules here, because it is placed in downscoped session policies and must never carry anything but a name.";
+                };
+                readonly prefix: {
+                    readonly $ref: "#/$defs/ObjectPrefix";
+                };
+                readonly pathStyle: {
+                    readonly type: "boolean";
+                    readonly description: "Address the bucket in the path rather than the host name, as MinIO usually needs. Absent means virtual-hosted style.";
+                };
+            };
+        };
+        readonly LocalSettings: {
+            readonly title: "LocalSettings";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["kind", "root"];
+            readonly properties: {
+                readonly kind: {
+                    readonly const: "local";
+                };
+                readonly root: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 1024;
+                    readonly pattern: "^/";
+                    readonly description: "Absolute path of the directory the community writes blobs under, on its own host. Created owner-only. Not carried by the community's backup: back it up beside it.";
+                };
+            };
+        };
+        readonly StorageConfigId: {
+            readonly title: "StorageConfigId";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 64;
+            readonly pattern: "^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$";
+            readonly description: "A storage config's identifier, chosen by the administrator who creates it and immutable thereafter: lowercase letters, digits and inner hyphens, at most 64 characters (`eu-s3-primary`, `walrus-main`). Unique within the community. Never reused after a config is retired, because blobs name their config by this value.";
+        };
+    };
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export declare const RESPONSE_PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $ref: "#/$defs/Response";
+    readonly $defs: {
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "VTC Storage — Configs — Update — response payload";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["config"];
+            readonly properties: {
+                readonly config: {
+                    readonly $ref: "#/$defs/StorageConfig";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+        readonly StorageConfig: {
+            readonly title: "StorageConfig";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["id", "label", "settings", "state", "createdBy", "createdAt"];
+            readonly description: "One storage config as the community holds it. Carries no secret.";
+            readonly properties: {
+                readonly id: {
+                    readonly $ref: "#/$defs/StorageConfigId";
+                };
+                readonly label: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 128;
+                    readonly description: "A display name for administrators (`EU — S3 (main account)`). Shown to a room's creator with the config's kind when the community lets them choose.";
+                };
+                readonly settings: {
+                    readonly $ref: "#/$defs/StorageSettings";
+                };
+                readonly auth: {
+                    readonly $ref: "#/$defs/StorageAuth";
+                };
+                readonly capacityBytes: {
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                    readonly description: "Total ciphertext bytes the community will store on this config, across every room assigned to it. A capacity, not a policy: an upload that would cross it is refused with scope `storage`. Absent means no capacity set.";
+                };
+                readonly state: {
+                    readonly $ref: "#/$defs/ConfigState";
+                };
+                readonly isDefault: {
+                    readonly type: "boolean";
+                    readonly description: "True for the config a room is assigned to when neither the community's policy nor its creator names one.";
+                };
+                readonly createdBy: {
+                    readonly type: "string";
+                    readonly pattern: "^did:";
+                    readonly maxLength: 2048;
+                };
+                readonly createdAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+                readonly updatedBy: {
+                    readonly type: "string";
+                    readonly pattern: "^did:";
+                    readonly maxLength: 2048;
+                };
+                readonly updatedAt: {
+                    readonly type: "string";
+                    readonly format: "date-time";
+                };
+            };
+        };
+        readonly ConfigState: {
+            readonly title: "ConfigState";
+            readonly type: "string";
+            readonly enum: readonly ["active", "draining", "retired"];
+            readonly description: "`active`: accepts new rooms and new uploads. `draining`: retired by an administrator while blobs still name it — refuses new rooms and new uploads, keeps serving reads, and becomes `retired` when a migration has emptied it. `retired`: refuses new rooms and new uploads and holds no blob. A config is never deleted while a blob names it.";
+        };
+        readonly StorageAuth: {
+            readonly title: "StorageAuth";
+            readonly description: "How the community authenticates to a config's backend. Absent on a `local` config, which needs none.\n\n`vta-account` (RECOMMENDED): an external account in the community's VTA, named by the context that owns it and its identifier there. The VTA holds the long-lived authority; the community holds nothing that outlives a credential lifetime, and asks for credentials scoped to one room's prefix for at most 15 minutes, every issuance audited at the VTA. Required for a `walrus` config other than a `sealed` one, since the VTA's `sui-signer` account signs its storage transactions.\n\n`ambient`: the cloud identity of the machine the community runs on (an instance role, workload identity), downscoped to one room's prefix by the community itself under the rules of vtc/storage/configs/create/0.2 — on `s3`, by assuming `roleArn` (or the role the host is configured with) with an inline session policy; on `gcs`, by a Credential Access Boundary. Not audited or rate-limited by the VTA, and usable by anything on that machine that reaches the metadata endpoint. Not valid for `walrus`; `roleArn` is valid only on `s3`.\n\n`sealed` (discouraged): a long-lived credential stored by the community, set with vtc/storage/credentials/set (0.2: a `SealedStorageCredential`). Protects against every administrator through every surface the community offers; does NOT protect against whoever operates the machine, and a community labels it so wherever the config is shown.\n\n`ambient` and `sealed` are host-operator choices: a community MAY refuse either by its own host configuration, whatever its administrators ask.";
+            readonly oneOf: readonly [{
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["mode", "context", "account"];
+                readonly properties: {
+                    readonly mode: {
+                        readonly const: "vta-account";
+                    };
+                    readonly context: {
+                        readonly $ref: "#/$defs/ExternalAccountContextId";
+                    };
+                    readonly account: {
+                        readonly $ref: "#/$defs/ExternalAccountId";
+                    };
+                };
+            }, {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["mode"];
+                readonly properties: {
+                    readonly mode: {
+                        readonly const: "ambient";
+                    };
+                    readonly roleArn: {
+                        readonly $ref: "#/$defs/AwsRoleArn";
+                        readonly description: "`s3` only: the IAM role the community assumes, with the machine's ambient identity, to obtain each room-scoped session. Absent, the community assumes the role its host configuration names, and with none configured, the role of the ambient identity itself (which must then trust itself to be assumed). Refused on any other kind with `authNotAllowed`.";
+                    };
+                };
+            }, {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["mode"];
+                readonly properties: {
+                    readonly mode: {
+                        readonly const: "sealed";
+                    };
+                };
+            }];
+        };
+        readonly AwsRoleArn: {
+            readonly title: "AwsRoleArn";
+            readonly type: "string";
+            readonly minLength: 20;
+            readonly maxLength: 2048;
+            readonly pattern: "^arn:aws(-[a-z]+)*:iam::[0-9]{12}:role/[A-Za-z0-9+=,.@_/-]{1,512}$";
+            readonly description: "The ARN of an AWS IAM role, in any AWS partition (`arn:aws:`, `arn:aws-cn:`, `arn:aws-us-gov:`). Validated here because the community passes it to STS AssumeRole and derives the partition of the session policy's resources from it; it must never carry anything but a role ARN.";
+        };
+        readonly ExternalAccountId: {
+            readonly title: "ExternalAccountId";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 64;
+            readonly pattern: "^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$";
+            readonly description: "The identifier of an external account held by the community's VTA (the external/accounts/* family), which issues the community short-lived, room-scoped credentials and holds the long-lived authority itself.";
+        };
+        readonly ExternalAccountContextId: {
+            readonly title: "ExternalAccountContextId";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 256;
+            readonly description: "The context at the community's VTA that owns an external account. The VTA names an account by its context and its identifier, and decides who may use it by act scope in that context: the community must hold `external-auth-use` there, and be bound to the account, for the account to issue it anything. Naming a context grants nothing; the VTA's binding is the gate.";
+        };
+        readonly StorageSettings: {
+            readonly title: "StorageSettings";
+            readonly description: "A config's backend settings, discriminated by `kind`. Never a secret: a credential is a StorageAuth, held elsewhere.";
+            readonly oneOf: readonly [{
+                readonly $ref: "#/$defs/LocalSettings";
+            }, {
+                readonly $ref: "#/$defs/S3Settings";
+            }, {
+                readonly $ref: "#/$defs/GcsSettings";
+            }, {
+                readonly $ref: "#/$defs/WalrusSettings";
+            }];
+        };
+        readonly WalrusSettings: {
+            readonly title: "WalrusSettings";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["kind", "relayUrl", "aggregatorUrl", "epochs", "extendBeforeEpochs"];
+            readonly properties: {
+                readonly kind: {
+                    readonly const: "walrus";
+                };
+                readonly relayUrl: {
+                    readonly type: "string";
+                    readonly format: "uri";
+                    readonly maxLength: 2048;
+                    readonly pattern: "^https://";
+                    readonly description: "The Walrus upload relay the community writes through. The community never runs a publisher: a publisher holds a hot wallet in its own configuration, which is the long-lived secret these tasks exist to avoid.";
+                };
+                readonly aggregatorUrl: {
+                    readonly type: "string";
+                    readonly format: "uri";
+                    readonly maxLength: 2048;
+                    readonly pattern: "^https://";
+                    readonly description: "The Walrus aggregator the community reads through.";
+                };
+                readonly epochs: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                    readonly maximum: 53;
+                    readonly description: "Storage epochs to buy when a blob is registered. Walrus sells storage in epochs (two weeks on mainnet) and caps one purchase at 53.";
+                };
+                readonly extendBeforeEpochs: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                    readonly maximum: 52;
+                    readonly description: "How many epochs before a live blob's end epoch the community extends it. A blob that has become an orphan is not extended, and lapses: the Walrus form of deletion.";
+                };
+            };
+        };
+        readonly GcsSettings: {
+            readonly title: "GcsSettings";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["kind", "bucket"];
+            readonly properties: {
+                readonly kind: {
+                    readonly const: "gcs";
+                };
+                readonly bucket: {
+                    readonly type: "string";
+                    readonly minLength: 3;
+                    readonly maxLength: 222;
+                    readonly pattern: "^[a-z0-9][a-z0-9._-]{1,220}[a-z0-9]$";
+                    readonly description: "The bucket name. Validated against GCS naming rules here, because it is placed in a Credential Access Boundary condition and must never carry anything but a name.";
+                };
+                readonly prefix: {
+                    readonly $ref: "#/$defs/ObjectPrefix";
+                };
+            };
+        };
+        readonly ObjectPrefix: {
+            readonly title: "ObjectPrefix";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 256;
+            readonly pattern: "^[A-Za-z0-9!_.*'()/-]+/$";
+            readonly description: "A key prefix inside the bucket, ending in `/`, under which the config's `rooms/` tree is placed. Restricted to the S3 safe-character set so that it can be placed in a downscoped policy without escaping.";
+        };
+        readonly S3Settings: {
+            readonly title: "S3Settings";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["kind", "region", "bucket"];
+            readonly properties: {
+                readonly kind: {
+                    readonly const: "s3";
+                };
+                readonly endpoint: {
+                    readonly type: "string";
+                    readonly format: "uri";
+                    readonly maxLength: 2048;
+                    readonly pattern: "^https://";
+                    readonly description: "The S3 API endpoint, for a store other than AWS (R2, B2, MinIO). Absent means AWS S3 in `region`. HTTPS only.";
+                };
+                readonly region: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 64;
+                    readonly pattern: "^[a-z0-9-]+$";
+                    readonly description: "The bucket's region, as the store names it (`eu-west-1`; `auto` for R2).";
+                };
+                readonly bucket: {
+                    readonly type: "string";
+                    readonly minLength: 3;
+                    readonly maxLength: 63;
+                    readonly pattern: "^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$";
+                    readonly description: "The bucket name. Validated against S3 naming rules here, because it is placed in downscoped session policies and must never carry anything but a name.";
+                };
+                readonly prefix: {
+                    readonly $ref: "#/$defs/ObjectPrefix";
+                };
+                readonly pathStyle: {
+                    readonly type: "boolean";
+                    readonly description: "Address the bucket in the path rather than the host name, as MinIO usually needs. Absent means virtual-hosted style.";
+                };
+            };
+        };
+        readonly LocalSettings: {
+            readonly title: "LocalSettings";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["kind", "root"];
+            readonly properties: {
+                readonly kind: {
+                    readonly const: "local";
+                };
+                readonly root: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 1024;
+                    readonly pattern: "^/";
+                    readonly description: "Absolute path of the directory the community writes blobs under, on its own host. Created owner-only. Not carried by the community's backup: back it up beside it.";
+                };
+            };
+        };
+        readonly StorageConfigId: {
+            readonly title: "StorageConfigId";
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 64;
+            readonly pattern: "^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$";
+            readonly description: "A storage config's identifier, chosen by the administrator who creates it and immutable thereafter: lowercase letters, digits and inner hyphens, at most 64 characters (`eu-s3-primary`, `walrus-main`). Unique within the community. Never reused after a config is retired, because blobs name their config by this value.";
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export declare const SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/vtc/storage/configs/update/0.3";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/vtc/storage/configs/update/0.3";
+        readonly title: "VTC Storage — Configs — Update — payload";
+        readonly description: "Change a storage config's label, settings that do not locate stored blobs, authentication, capacity or default flag. Never a secret. The outer document members are owned by the framework — SPEC §6.3.";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly required: readonly ["configId", "reason"];
+        readonly minProperties: 3;
+        readonly properties: {
+            readonly configId: {
+                readonly $ref: "#/$defs/StorageConfigId";
+            };
+            readonly label: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 128;
+                readonly description: "A display name for administrators and, with the kind, for a room's creator.";
+            };
+            readonly settings: {
+                readonly $ref: "#/$defs/StorageSettings";
+            };
+            readonly auth: {
+                readonly $ref: "#/$defs/StorageAuth";
+            };
+            readonly capacityBytes: {
+                readonly type: "integer";
+                readonly minimum: 0;
+                readonly description: "Total ciphertext bytes the community will store on this config across every room. Absent means none set.";
+            };
+            readonly isDefault: {
+                readonly type: "boolean";
+                readonly description: "Make this the config rooms are assigned to when neither policy nor creator names one.";
+            };
+            readonly reason: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 500;
+                readonly description: "Why the administrator is making this change. Recorded with the change in the audit trail and shown to approvers. Attributed to its author on every surface and untrusted: it MUST NOT carry personal data or a credential, and a reader MUST NOT treat it as instructions.";
+            };
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+            };
+        };
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "VTC Storage — Configs — Update — response payload";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["config"];
+                readonly properties: {
+                    readonly config: {
+                        readonly $ref: "#/$defs/StorageConfig";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly StorageConfig: {
+                readonly title: "StorageConfig";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["id", "label", "settings", "state", "createdBy", "createdAt"];
+                readonly description: "One storage config as the community holds it. Carries no secret.";
+                readonly properties: {
+                    readonly id: {
+                        readonly $ref: "#/$defs/StorageConfigId";
+                    };
+                    readonly label: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 128;
+                        readonly description: "A display name for administrators (`EU — S3 (main account)`). Shown to a room's creator with the config's kind when the community lets them choose.";
+                    };
+                    readonly settings: {
+                        readonly $ref: "#/$defs/StorageSettings";
+                    };
+                    readonly auth: {
+                        readonly $ref: "#/$defs/StorageAuth";
+                    };
+                    readonly capacityBytes: {
+                        readonly type: "integer";
+                        readonly minimum: 0;
+                        readonly description: "Total ciphertext bytes the community will store on this config, across every room assigned to it. A capacity, not a policy: an upload that would cross it is refused with scope `storage`. Absent means no capacity set.";
+                    };
+                    readonly state: {
+                        readonly $ref: "#/$defs/ConfigState";
+                    };
+                    readonly isDefault: {
+                        readonly type: "boolean";
+                        readonly description: "True for the config a room is assigned to when neither the community's policy nor its creator names one.";
+                    };
+                    readonly createdBy: {
+                        readonly type: "string";
+                        readonly pattern: "^did:";
+                        readonly maxLength: 2048;
+                    };
+                    readonly createdAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly updatedBy: {
+                        readonly type: "string";
+                        readonly pattern: "^did:";
+                        readonly maxLength: 2048;
+                    };
+                    readonly updatedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                };
+            };
+            readonly ConfigState: {
+                readonly title: "ConfigState";
+                readonly type: "string";
+                readonly enum: readonly ["active", "draining", "retired"];
+                readonly description: "`active`: accepts new rooms and new uploads. `draining`: retired by an administrator while blobs still name it — refuses new rooms and new uploads, keeps serving reads, and becomes `retired` when a migration has emptied it. `retired`: refuses new rooms and new uploads and holds no blob. A config is never deleted while a blob names it.";
+            };
+            readonly StorageAuth: {
+                readonly title: "StorageAuth";
+                readonly description: "How the community authenticates to a config's backend. Absent on a `local` config, which needs none.\n\n`vta-account` (RECOMMENDED): an external account in the community's VTA, named by the context that owns it and its identifier there. The VTA holds the long-lived authority; the community holds nothing that outlives a credential lifetime, and asks for credentials scoped to one room's prefix for at most 15 minutes, every issuance audited at the VTA. Required for a `walrus` config other than a `sealed` one, since the VTA's `sui-signer` account signs its storage transactions.\n\n`ambient`: the cloud identity of the machine the community runs on (an instance role, workload identity), downscoped to one room's prefix by the community itself under the rules of vtc/storage/configs/create/0.2 — on `s3`, by assuming `roleArn` (or the role the host is configured with) with an inline session policy; on `gcs`, by a Credential Access Boundary. Not audited or rate-limited by the VTA, and usable by anything on that machine that reaches the metadata endpoint. Not valid for `walrus`; `roleArn` is valid only on `s3`.\n\n`sealed` (discouraged): a long-lived credential stored by the community, set with vtc/storage/credentials/set (0.2: a `SealedStorageCredential`). Protects against every administrator through every surface the community offers; does NOT protect against whoever operates the machine, and a community labels it so wherever the config is shown.\n\n`ambient` and `sealed` are host-operator choices: a community MAY refuse either by its own host configuration, whatever its administrators ask.";
+                readonly oneOf: readonly [{
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["mode", "context", "account"];
+                    readonly properties: {
+                        readonly mode: {
+                            readonly const: "vta-account";
+                        };
+                        readonly context: {
+                            readonly $ref: "#/$defs/ExternalAccountContextId";
+                        };
+                        readonly account: {
+                            readonly $ref: "#/$defs/ExternalAccountId";
+                        };
+                    };
+                }, {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["mode"];
+                    readonly properties: {
+                        readonly mode: {
+                            readonly const: "ambient";
+                        };
+                        readonly roleArn: {
+                            readonly $ref: "#/$defs/AwsRoleArn";
+                            readonly description: "`s3` only: the IAM role the community assumes, with the machine's ambient identity, to obtain each room-scoped session. Absent, the community assumes the role its host configuration names, and with none configured, the role of the ambient identity itself (which must then trust itself to be assumed). Refused on any other kind with `authNotAllowed`.";
+                        };
+                    };
+                }, {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["mode"];
+                    readonly properties: {
+                        readonly mode: {
+                            readonly const: "sealed";
+                        };
+                    };
+                }];
+            };
+            readonly AwsRoleArn: {
+                readonly title: "AwsRoleArn";
+                readonly type: "string";
+                readonly minLength: 20;
+                readonly maxLength: 2048;
+                readonly pattern: "^arn:aws(-[a-z]+)*:iam::[0-9]{12}:role/[A-Za-z0-9+=,.@_/-]{1,512}$";
+                readonly description: "The ARN of an AWS IAM role, in any AWS partition (`arn:aws:`, `arn:aws-cn:`, `arn:aws-us-gov:`). Validated here because the community passes it to STS AssumeRole and derives the partition of the session policy's resources from it; it must never carry anything but a role ARN.";
+            };
+            readonly ExternalAccountId: {
+                readonly title: "ExternalAccountId";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 64;
+                readonly pattern: "^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$";
+                readonly description: "The identifier of an external account held by the community's VTA (the external/accounts/* family), which issues the community short-lived, room-scoped credentials and holds the long-lived authority itself.";
+            };
+            readonly ExternalAccountContextId: {
+                readonly title: "ExternalAccountContextId";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 256;
+                readonly description: "The context at the community's VTA that owns an external account. The VTA names an account by its context and its identifier, and decides who may use it by act scope in that context: the community must hold `external-auth-use` there, and be bound to the account, for the account to issue it anything. Naming a context grants nothing; the VTA's binding is the gate.";
+            };
+            readonly StorageSettings: {
+                readonly title: "StorageSettings";
+                readonly description: "A config's backend settings, discriminated by `kind`. Never a secret: a credential is a StorageAuth, held elsewhere.";
+                readonly oneOf: readonly [{
+                    readonly $ref: "#/$defs/LocalSettings";
+                }, {
+                    readonly $ref: "#/$defs/S3Settings";
+                }, {
+                    readonly $ref: "#/$defs/GcsSettings";
+                }, {
+                    readonly $ref: "#/$defs/WalrusSettings";
+                }];
+            };
+            readonly WalrusSettings: {
+                readonly title: "WalrusSettings";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "relayUrl", "aggregatorUrl", "epochs", "extendBeforeEpochs"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "walrus";
+                    };
+                    readonly relayUrl: {
+                        readonly type: "string";
+                        readonly format: "uri";
+                        readonly maxLength: 2048;
+                        readonly pattern: "^https://";
+                        readonly description: "The Walrus upload relay the community writes through. The community never runs a publisher: a publisher holds a hot wallet in its own configuration, which is the long-lived secret these tasks exist to avoid.";
+                    };
+                    readonly aggregatorUrl: {
+                        readonly type: "string";
+                        readonly format: "uri";
+                        readonly maxLength: 2048;
+                        readonly pattern: "^https://";
+                        readonly description: "The Walrus aggregator the community reads through.";
+                    };
+                    readonly epochs: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                        readonly maximum: 53;
+                        readonly description: "Storage epochs to buy when a blob is registered. Walrus sells storage in epochs (two weeks on mainnet) and caps one purchase at 53.";
+                    };
+                    readonly extendBeforeEpochs: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                        readonly maximum: 52;
+                        readonly description: "How many epochs before a live blob's end epoch the community extends it. A blob that has become an orphan is not extended, and lapses: the Walrus form of deletion.";
+                    };
+                };
+            };
+            readonly GcsSettings: {
+                readonly title: "GcsSettings";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "bucket"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "gcs";
+                    };
+                    readonly bucket: {
+                        readonly type: "string";
+                        readonly minLength: 3;
+                        readonly maxLength: 222;
+                        readonly pattern: "^[a-z0-9][a-z0-9._-]{1,220}[a-z0-9]$";
+                        readonly description: "The bucket name. Validated against GCS naming rules here, because it is placed in a Credential Access Boundary condition and must never carry anything but a name.";
+                    };
+                    readonly prefix: {
+                        readonly $ref: "#/$defs/ObjectPrefix";
+                    };
+                };
+            };
+            readonly ObjectPrefix: {
+                readonly title: "ObjectPrefix";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 256;
+                readonly pattern: "^[A-Za-z0-9!_.*'()/-]+/$";
+                readonly description: "A key prefix inside the bucket, ending in `/`, under which the config's `rooms/` tree is placed. Restricted to the S3 safe-character set so that it can be placed in a downscoped policy without escaping.";
+            };
+            readonly S3Settings: {
+                readonly title: "S3Settings";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "region", "bucket"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "s3";
+                    };
+                    readonly endpoint: {
+                        readonly type: "string";
+                        readonly format: "uri";
+                        readonly maxLength: 2048;
+                        readonly pattern: "^https://";
+                        readonly description: "The S3 API endpoint, for a store other than AWS (R2, B2, MinIO). Absent means AWS S3 in `region`. HTTPS only.";
+                    };
+                    readonly region: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 64;
+                        readonly pattern: "^[a-z0-9-]+$";
+                        readonly description: "The bucket's region, as the store names it (`eu-west-1`; `auto` for R2).";
+                    };
+                    readonly bucket: {
+                        readonly type: "string";
+                        readonly minLength: 3;
+                        readonly maxLength: 63;
+                        readonly pattern: "^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$";
+                        readonly description: "The bucket name. Validated against S3 naming rules here, because it is placed in downscoped session policies and must never carry anything but a name.";
+                    };
+                    readonly prefix: {
+                        readonly $ref: "#/$defs/ObjectPrefix";
+                    };
+                    readonly pathStyle: {
+                        readonly type: "boolean";
+                        readonly description: "Address the bucket in the path rather than the host name, as MinIO usually needs. Absent means virtual-hosted style.";
+                    };
+                };
+            };
+            readonly LocalSettings: {
+                readonly title: "LocalSettings";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "root"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "local";
+                    };
+                    readonly root: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 1024;
+                        readonly pattern: "^/";
+                        readonly description: "Absolute path of the directory the community writes blobs under, on its own host. Created owner-only. Not carried by the community's backup: back it up beside it.";
+                    };
+                };
+            };
+            readonly StorageConfigId: {
+                readonly title: "StorageConfigId";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 64;
+                readonly pattern: "^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$";
+                readonly description: "A storage config's identifier, chosen by the administrator who creates it and immutable thereafter: lowercase letters, digits and inner hyphens, at most 64 characters (`eu-s3-primary`, `walrus-main`). Unique within the community. Never reused after a config is retired, because blobs name their config by this value.";
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export declare const RESPONSE_SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/vtc/storage/configs/update/0.3#response";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $ref: "#/$defs/Response";
+        readonly $defs: {
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "VTC Storage — Configs — Update — response payload";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["config"];
+                readonly properties: {
+                    readonly config: {
+                        readonly $ref: "#/$defs/StorageConfig";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+            readonly StorageConfig: {
+                readonly title: "StorageConfig";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["id", "label", "settings", "state", "createdBy", "createdAt"];
+                readonly description: "One storage config as the community holds it. Carries no secret.";
+                readonly properties: {
+                    readonly id: {
+                        readonly $ref: "#/$defs/StorageConfigId";
+                    };
+                    readonly label: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 128;
+                        readonly description: "A display name for administrators (`EU — S3 (main account)`). Shown to a room's creator with the config's kind when the community lets them choose.";
+                    };
+                    readonly settings: {
+                        readonly $ref: "#/$defs/StorageSettings";
+                    };
+                    readonly auth: {
+                        readonly $ref: "#/$defs/StorageAuth";
+                    };
+                    readonly capacityBytes: {
+                        readonly type: "integer";
+                        readonly minimum: 0;
+                        readonly description: "Total ciphertext bytes the community will store on this config, across every room assigned to it. A capacity, not a policy: an upload that would cross it is refused with scope `storage`. Absent means no capacity set.";
+                    };
+                    readonly state: {
+                        readonly $ref: "#/$defs/ConfigState";
+                    };
+                    readonly isDefault: {
+                        readonly type: "boolean";
+                        readonly description: "True for the config a room is assigned to when neither the community's policy nor its creator names one.";
+                    };
+                    readonly createdBy: {
+                        readonly type: "string";
+                        readonly pattern: "^did:";
+                        readonly maxLength: 2048;
+                    };
+                    readonly createdAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                    readonly updatedBy: {
+                        readonly type: "string";
+                        readonly pattern: "^did:";
+                        readonly maxLength: 2048;
+                    };
+                    readonly updatedAt: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                };
+            };
+            readonly ConfigState: {
+                readonly title: "ConfigState";
+                readonly type: "string";
+                readonly enum: readonly ["active", "draining", "retired"];
+                readonly description: "`active`: accepts new rooms and new uploads. `draining`: retired by an administrator while blobs still name it — refuses new rooms and new uploads, keeps serving reads, and becomes `retired` when a migration has emptied it. `retired`: refuses new rooms and new uploads and holds no blob. A config is never deleted while a blob names it.";
+            };
+            readonly StorageAuth: {
+                readonly title: "StorageAuth";
+                readonly description: "How the community authenticates to a config's backend. Absent on a `local` config, which needs none.\n\n`vta-account` (RECOMMENDED): an external account in the community's VTA, named by the context that owns it and its identifier there. The VTA holds the long-lived authority; the community holds nothing that outlives a credential lifetime, and asks for credentials scoped to one room's prefix for at most 15 minutes, every issuance audited at the VTA. Required for a `walrus` config other than a `sealed` one, since the VTA's `sui-signer` account signs its storage transactions.\n\n`ambient`: the cloud identity of the machine the community runs on (an instance role, workload identity), downscoped to one room's prefix by the community itself under the rules of vtc/storage/configs/create/0.2 — on `s3`, by assuming `roleArn` (or the role the host is configured with) with an inline session policy; on `gcs`, by a Credential Access Boundary. Not audited or rate-limited by the VTA, and usable by anything on that machine that reaches the metadata endpoint. Not valid for `walrus`; `roleArn` is valid only on `s3`.\n\n`sealed` (discouraged): a long-lived credential stored by the community, set with vtc/storage/credentials/set (0.2: a `SealedStorageCredential`). Protects against every administrator through every surface the community offers; does NOT protect against whoever operates the machine, and a community labels it so wherever the config is shown.\n\n`ambient` and `sealed` are host-operator choices: a community MAY refuse either by its own host configuration, whatever its administrators ask.";
+                readonly oneOf: readonly [{
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["mode", "context", "account"];
+                    readonly properties: {
+                        readonly mode: {
+                            readonly const: "vta-account";
+                        };
+                        readonly context: {
+                            readonly $ref: "#/$defs/ExternalAccountContextId";
+                        };
+                        readonly account: {
+                            readonly $ref: "#/$defs/ExternalAccountId";
+                        };
+                    };
+                }, {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["mode"];
+                    readonly properties: {
+                        readonly mode: {
+                            readonly const: "ambient";
+                        };
+                        readonly roleArn: {
+                            readonly $ref: "#/$defs/AwsRoleArn";
+                            readonly description: "`s3` only: the IAM role the community assumes, with the machine's ambient identity, to obtain each room-scoped session. Absent, the community assumes the role its host configuration names, and with none configured, the role of the ambient identity itself (which must then trust itself to be assumed). Refused on any other kind with `authNotAllowed`.";
+                        };
+                    };
+                }, {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly required: readonly ["mode"];
+                    readonly properties: {
+                        readonly mode: {
+                            readonly const: "sealed";
+                        };
+                    };
+                }];
+            };
+            readonly AwsRoleArn: {
+                readonly title: "AwsRoleArn";
+                readonly type: "string";
+                readonly minLength: 20;
+                readonly maxLength: 2048;
+                readonly pattern: "^arn:aws(-[a-z]+)*:iam::[0-9]{12}:role/[A-Za-z0-9+=,.@_/-]{1,512}$";
+                readonly description: "The ARN of an AWS IAM role, in any AWS partition (`arn:aws:`, `arn:aws-cn:`, `arn:aws-us-gov:`). Validated here because the community passes it to STS AssumeRole and derives the partition of the session policy's resources from it; it must never carry anything but a role ARN.";
+            };
+            readonly ExternalAccountId: {
+                readonly title: "ExternalAccountId";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 64;
+                readonly pattern: "^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$";
+                readonly description: "The identifier of an external account held by the community's VTA (the external/accounts/* family), which issues the community short-lived, room-scoped credentials and holds the long-lived authority itself.";
+            };
+            readonly ExternalAccountContextId: {
+                readonly title: "ExternalAccountContextId";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 256;
+                readonly description: "The context at the community's VTA that owns an external account. The VTA names an account by its context and its identifier, and decides who may use it by act scope in that context: the community must hold `external-auth-use` there, and be bound to the account, for the account to issue it anything. Naming a context grants nothing; the VTA's binding is the gate.";
+            };
+            readonly StorageSettings: {
+                readonly title: "StorageSettings";
+                readonly description: "A config's backend settings, discriminated by `kind`. Never a secret: a credential is a StorageAuth, held elsewhere.";
+                readonly oneOf: readonly [{
+                    readonly $ref: "#/$defs/LocalSettings";
+                }, {
+                    readonly $ref: "#/$defs/S3Settings";
+                }, {
+                    readonly $ref: "#/$defs/GcsSettings";
+                }, {
+                    readonly $ref: "#/$defs/WalrusSettings";
+                }];
+            };
+            readonly WalrusSettings: {
+                readonly title: "WalrusSettings";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "relayUrl", "aggregatorUrl", "epochs", "extendBeforeEpochs"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "walrus";
+                    };
+                    readonly relayUrl: {
+                        readonly type: "string";
+                        readonly format: "uri";
+                        readonly maxLength: 2048;
+                        readonly pattern: "^https://";
+                        readonly description: "The Walrus upload relay the community writes through. The community never runs a publisher: a publisher holds a hot wallet in its own configuration, which is the long-lived secret these tasks exist to avoid.";
+                    };
+                    readonly aggregatorUrl: {
+                        readonly type: "string";
+                        readonly format: "uri";
+                        readonly maxLength: 2048;
+                        readonly pattern: "^https://";
+                        readonly description: "The Walrus aggregator the community reads through.";
+                    };
+                    readonly epochs: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                        readonly maximum: 53;
+                        readonly description: "Storage epochs to buy when a blob is registered. Walrus sells storage in epochs (two weeks on mainnet) and caps one purchase at 53.";
+                    };
+                    readonly extendBeforeEpochs: {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                        readonly maximum: 52;
+                        readonly description: "How many epochs before a live blob's end epoch the community extends it. A blob that has become an orphan is not extended, and lapses: the Walrus form of deletion.";
+                    };
+                };
+            };
+            readonly GcsSettings: {
+                readonly title: "GcsSettings";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "bucket"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "gcs";
+                    };
+                    readonly bucket: {
+                        readonly type: "string";
+                        readonly minLength: 3;
+                        readonly maxLength: 222;
+                        readonly pattern: "^[a-z0-9][a-z0-9._-]{1,220}[a-z0-9]$";
+                        readonly description: "The bucket name. Validated against GCS naming rules here, because it is placed in a Credential Access Boundary condition and must never carry anything but a name.";
+                    };
+                    readonly prefix: {
+                        readonly $ref: "#/$defs/ObjectPrefix";
+                    };
+                };
+            };
+            readonly ObjectPrefix: {
+                readonly title: "ObjectPrefix";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 256;
+                readonly pattern: "^[A-Za-z0-9!_.*'()/-]+/$";
+                readonly description: "A key prefix inside the bucket, ending in `/`, under which the config's `rooms/` tree is placed. Restricted to the S3 safe-character set so that it can be placed in a downscoped policy without escaping.";
+            };
+            readonly S3Settings: {
+                readonly title: "S3Settings";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "region", "bucket"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "s3";
+                    };
+                    readonly endpoint: {
+                        readonly type: "string";
+                        readonly format: "uri";
+                        readonly maxLength: 2048;
+                        readonly pattern: "^https://";
+                        readonly description: "The S3 API endpoint, for a store other than AWS (R2, B2, MinIO). Absent means AWS S3 in `region`. HTTPS only.";
+                    };
+                    readonly region: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 64;
+                        readonly pattern: "^[a-z0-9-]+$";
+                        readonly description: "The bucket's region, as the store names it (`eu-west-1`; `auto` for R2).";
+                    };
+                    readonly bucket: {
+                        readonly type: "string";
+                        readonly minLength: 3;
+                        readonly maxLength: 63;
+                        readonly pattern: "^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$";
+                        readonly description: "The bucket name. Validated against S3 naming rules here, because it is placed in downscoped session policies and must never carry anything but a name.";
+                    };
+                    readonly prefix: {
+                        readonly $ref: "#/$defs/ObjectPrefix";
+                    };
+                    readonly pathStyle: {
+                        readonly type: "boolean";
+                        readonly description: "Address the bucket in the path rather than the host name, as MinIO usually needs. Absent means virtual-hosted style.";
+                    };
+                };
+            };
+            readonly LocalSettings: {
+                readonly title: "LocalSettings";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["kind", "root"];
+                readonly properties: {
+                    readonly kind: {
+                        readonly const: "local";
+                    };
+                    readonly root: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 1024;
+                        readonly pattern: "^/";
+                        readonly description: "Absolute path of the directory the community writes blobs under, on its own host. Created owner-only. Not carried by the community's backup: back it up beside it.";
+                    };
+                };
+            };
+            readonly StorageConfigId: {
+                readonly title: "StorageConfigId";
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 64;
+                readonly pattern: "^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$";
+                readonly description: "A storage config's identifier, chosen by the administrator who creates it and immutable thereafter: lowercase letters, digits and inner hyphens, at most 64 characters (`eu-s3-primary`, `walrus-main`). Unique within the community. Never reused after a config is retired, because blobs name their config by this value.";
+            };
+        };
+    };
+};
+//# sourceMappingURL=payload.d.ts.map