Contracts 0.177.0: project secrets — written once, used by name, never read back (ADR-056, network.secret.use) (#137)

OP OpenVibers committed 29 days ago · d084bebae6 · 63 files, +7595 −75

**Project secrets (Contracts 0.177.0, ADR-056).**

The plan's Actor `secret_ref` "waits on a project secret store". Today each service that needs a project's own secret uses an operator-held environment variable with a hand-written grant (Watch's `WATCH_SECRET_GRANTS`, Bot's ONVIF references) or makes a value and shows it once (Actor's per-task webhook secret).

**ADR-056 (accepted):**
- **Who keeps them:** OpenVibe.Network keeps secrets per project and environment, because it already owns projects, credentials and their audit (ADR-014).
- **Write-only:** a project admin or owner sets a value, and setting it again bumps the version. No API returns a value to a person, staff included. Members see name, version, a keyed fingerprint and the grants.
- **Encrypted at rest:** AES-256-GCM under `NETWORK_SECRETS_KEY`, with a key id per row. Without the key the feature is off, never plaintext.
- **A name is not a capability:** a service uses a secret only when the project granted that secret to that service, for one of two purposes:
- `sign`: HMAC-SHA256 computed inside Network; the value never leaves;
- `reveal`: the value, only for an https origin the grant lists.
- **One first-party capability:** `network.secret.use` on `POST /internal/secrets/use`. Everything refused answers 404 `secret.not_found`.
- **Audit:** value and grant changes, and the first use per service, purpose and day. Archiving a project shreds its secrets.

**Contracts:**
- `network.project-secret@1`, `network.secret-use-request@1` and `network.secret-use-result@1`. Conditional rules require a message for sign and an origin for reveal, and forbid mixing their fields.
- The capability manifest, listed in Network's manifest. Fixtures, valid and invalid. Generated OpenAPI, TypeScript and the JSON Schema bundle regenerated.
- 20,106 checks pass; `compat` against v0.176.1 finds no breaking change.

Next: Network implements the store and routes, Services gets a console page, and Actor's `secret_ref` uses `sign`.

Changes

ddiff --git a/CHANGELOG.md b/CHANGELOG.md
iindex 8e2bceb7..e1d8b02a 100644
---- a/CHANGELOG.md
++++ b/CHANGELOG.md
@@@ -4,6 +4,19 @@ All notable changes to `openvibe-contracts`. Releases are git tags (`vX.Y.Z`) th
  from `https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/<tag>`. Before v0.30.0,
  the notes were in the tag and commit messages (`git tag -n1`).
  
++## 0.177.0 — 2026-10-15
++
++- **Project secrets (ADR-056).** OpenVibe.Network keeps secrets per project and environment, written once and used by
++  name: no API returns a value to a person.
++  - `network.project-secret@1`: what members and staff see (name, environment, version, a keyed fingerprint, grants,
++    who set it and when).
++  - `network.secret.use` (first-party, `POST /internal/secrets/use`): a service the project granted a secret to either
++    signs a message with it (`sign`, HMAC-SHA256; the value never leaves Network) or receives the value for an https
++    origin the grant lists (`reveal`). `network.secret-use-request@1` and `network.secret-use-result@1` refuse a sign
++    without a message, a reveal without an origin, and either one mixed with the other's field.
++  - Listed in Network's manifest. Fixtures: valid signing and reveal grants, sign and reveal requests and results;
++    invalid a secret with its value, an upper-case name, an http origin, and mixed or missing fields.
++
  ## 0.176.1 — 2026-10-15
  
  - **`media.object.s3`** lists CopyObject and UploadPartCopy (Media#113): server-side copies within the key's environment,
ddiff --git a/contracts/catalog.json b/contracts/catalog.json
iindex eae7a28e..548b8fda 100644
---- a/contracts/catalog.json
++++ b/contracts/catalog.json
@@@ -2883,6 +2883,36 @@
        "status": "active",
        "adr": "ADR-014"
      },
++    {
++      "id": "network.project-secret",
++      "version": "1.0.0",
++      "owner": "network",
++      "schema": "network/project-secret.v1.json",
++      "visibility": "first-party",
++      "compatibility": "backward",
++      "status": "active",
++      "adr": "ADR-056"
++    },
++    {
++      "id": "network.secret-use-request",
++      "version": "1.0.0",
++      "owner": "network",
++      "schema": "network/secret-use-request.v1.json",
++      "visibility": "first-party",
++      "compatibility": "backward",
++      "status": "active",
++      "adr": "ADR-056"
++    },
++    {
++      "id": "network.secret-use-result",
++      "version": "1.0.0",
++      "owner": "network",
++      "schema": "network/secret-use-result.v1.json",
++      "visibility": "first-party",
++      "compatibility": "backward",
++      "status": "active",
++      "adr": "ADR-056"
++    },
      {
        "id": "network.status-incident",
        "version": "1.0.0",
ddiff --git a/contracts/network/project-secret.v1.json b/contracts/network/project-secret.v1.json
nnew file mode 100644
iindex 00000000..7a815aeb
---- /dev/null
++++ b/contracts/network/project-secret.v1.json
@@@ -0,0 +1,37 @@
++{
++  "$schema": "https://json-schema.org/draft/2020-12/schema",
++  "$id": "https://openvibe.network/contracts/network/project-secret.v1.json",
++  "title": "ProjectSecret",
++  "description": "network.project-secret@1 (ADR-056): one project secret as OpenVibe.Network shows it to the project's members and staff — its name, environment, version, a keyed fingerprint and its grants. Never the value: a secret is written once and used by name (sign or reveal through network.secret.use).",
++  "type": "object",
++  "required": ["project_id", "environment", "name", "version", "fingerprint", "grants", "created_at", "created_by", "updated_at", "updated_by"],
++  "additionalProperties": false,
++  "$defs": {
++    "subject": { "type": "string", "pattern": "^usr_[0-9A-HJKMNP-TV-Z]{26}$" },
++    "grant": {
++      "type": "object",
++      "required": ["service", "purposes", "origins", "created_at", "created_by", "last_used_at"],
++      "additionalProperties": false,
++      "properties": {
++        "service": { "type": "string", "pattern": "^[a-z][a-z0-9-]{1,39}$", "description": "The service id the secret is granted to (its token's svc:<id>)." },
++        "purposes": { "type": "array", "minItems": 1, "maxItems": 2, "uniqueItems": true, "items": { "enum": ["sign", "reveal"] } },
++        "origins": { "type": "array", "maxItems": 10, "uniqueItems": true, "items": { "type": "string", "pattern": "^https://[a-z0-9.-]+(:[0-9]{1,5})?$" }, "description": "The https origins the value may be revealed for (reveal only; empty for sign)." },
++        "created_at": { "type": "string", "format": "date-time" },
++        "created_by": { "$ref": "#/$defs/subject" },
++        "last_used_at": { "type": ["string", "null"], "format": "date-time" }
++      }
++    }
++  },
++  "properties": {
++    "project_id": { "type": "string", "pattern": "^prj_[0-9A-HJKMNP-TV-Z]{26}$" },
++    "environment": { "enum": ["sandbox", "production"] },
++    "name": { "type": "string", "pattern": "^[a-z][a-z0-9_-]{0,63}$" },
++    "version": { "type": "integer", "minimum": 1, "description": "One more each time the value is set again." },
++    "fingerprint": { "type": "string", "pattern": "^[0-9a-f]{12}$", "description": "A keyed hash of the value: equal values have equal fingerprints, and it reveals nothing else." },
++    "grants": { "type": "array", "maxItems": 20, "items": { "$ref": "#/$defs/grant" } },
++    "created_at": { "type": "string", "format": "date-time" },
++    "created_by": { "$ref": "#/$defs/subject" },
++    "updated_at": { "type": "string", "format": "date-time" },
++    "updated_by": { "$ref": "#/$defs/subject" }
++  }
++}
ddiff --git a/contracts/network/secret-use-request.v1.json b/contracts/network/secret-use-request.v1.json
nnew file mode 100644
iindex 00000000..95ddba0f
---- /dev/null
++++ b/contracts/network/secret-use-request.v1.json
@@@ -0,0 +1,21 @@
++{
++  "$schema": "https://json-schema.org/draft/2020-12/schema",
++  "$id": "https://openvibe.network/contracts/network/secret-use-request.v1.json",
++  "title": "SecretUseRequest",
++  "description": "network.secret-use-request@1 (ADR-056): what a first-party service sends to POST /internal/secrets/use with network.secret.use. sign asks for HMAC-SHA256 of message under the secret (the value never leaves Network); reveal asks for the value, to send to origin. Either needs a grant of that secret to the calling service for that purpose (and origin).",
++  "type": "object",
++  "required": ["project_id", "environment", "name", "purpose"],
++  "additionalProperties": false,
++  "properties": {
++    "project_id": { "type": "string", "pattern": "^prj_[0-9A-HJKMNP-TV-Z]{26}$" },
++    "environment": { "enum": ["sandbox", "production"] },
++    "name": { "type": "string", "pattern": "^[a-z][a-z0-9_-]{0,63}$" },
++    "purpose": { "enum": ["sign", "reveal"] },
++    "message": { "type": "string", "maxLength": 1048576, "description": "sign: the exact text to sign (for a webhook delivery, \"<timestamp>.<raw body>\"). Not allowed with reveal." },
++    "origin": { "type": "string", "pattern": "^https://[a-z0-9.-]+(:[0-9]{1,5})?$", "description": "reveal: the https origin the value will be sent to; the grant must list it. Not allowed with sign." }
++  },
++  "allOf": [
++    { "if": { "properties": { "purpose": { "const": "sign" } } }, "then": { "required": ["message"], "not": { "required": ["origin"] } } },
++    { "if": { "properties": { "purpose": { "const": "reveal" } } }, "then": { "required": ["origin"], "not": { "required": ["message"] } } }
++  ]
++}
ddiff --git a/contracts/network/secret-use-result.v1.json b/contracts/network/secret-use-result.v1.json
nnew file mode 100644
iindex 00000000..f5949006
---- /dev/null
++++ b/contracts/network/secret-use-result.v1.json
@@@ -0,0 +1,20 @@
++{
++  "$schema": "https://json-schema.org/draft/2020-12/schema",
++  "$id": "https://openvibe.network/contracts/network/secret-use-result.v1.json",
++  "title": "SecretUseResult",
++  "description": "network.secret-use-result@1 (ADR-056): POST /internal/secrets/use's answer — the secret's name and version with the HMAC-SHA256 signature (sign) or the value (reveal). Sent with Cache-Control: no-store; a caller keeps a revealed value only as long as the request it is for.",
++  "type": "object",
++  "required": ["name", "version", "purpose"],
++  "additionalProperties": false,
++  "properties": {
++    "name": { "type": "string", "pattern": "^[a-z][a-z0-9_-]{0,63}$" },
++    "version": { "type": "integer", "minimum": 1 },
++    "purpose": { "enum": ["sign", "reveal"] },
++    "signature": { "type": "string", "pattern": "^[0-9a-f]{64}$", "description": "sign: the lowercase hex HMAC-SHA256 of the message under the secret." },
++    "value": { "type": "string", "minLength": 1, "maxLength": 8192, "description": "reveal: the value." }
++  },
++  "allOf": [
++    { "if": { "properties": { "purpose": { "const": "sign" } } }, "then": { "required": ["signature"], "not": { "required": ["value"] } } },
++    { "if": { "properties": { "purpose": { "const": "reveal" } } }, "then": { "required": ["value"], "not": { "required": ["signature"] } } }
++  ]
++}
ddiff --git a/docs/adr/ADR-056-project-secrets.md b/docs/adr/ADR-056-project-secrets.md
nnew file mode 100644
iindex 00000000..869f870d
---- /dev/null
++++ b/docs/adr/ADR-056-project-secrets.md
@@@ -0,0 +1,52 @@
++# ADR-056: Project secrets — written once, used by name, never read back
++
++**Status:** Accepted 2026-10-15 (plan T13/T17: the "project secret store" that `secret_ref` waits on). Amends ADR-014
++(Network owns projects and credentials) with one more thing a project holds, and ADR-044 §7 (Actor webhooks name a
++project secret by `secret_ref`).
++
++## Context
++
++- Services that act for a project need secrets the project's people choose: the key that signs Actor's webhook
++  deliveries to their server (ADR-044 names `secret_ref` for it), a token Watch sends when it checks their private API,
++  the password of their ONVIF camera (ADR-043).
++- Today each of these is an operator's environment variable with a hand-written grant (Watch's `WATCH_SECRET_GRANTS`,
++  Bot's `BOT_ONVIF_CAMERAS` references) or a value the service makes and shows once (Actor's per-task
++  `webhook_secret`). A project cannot bring its own, and nothing is managed in one place.
++- Network already owns what a project is, who its members are, its credentials and its audit (ADR-014).
++
++## Decision
++
++1. **Network keeps project secrets**, per project and environment (`sandbox`, `production`), each under a name
++   (`^[a-z][a-z0-9_-]{0,63}$`). A value is 1 to 8192 bytes of UTF-8, at most 50 secrets per project environment.
++2. **Write-only.** A project admin or owner sets a value (`PUT /api/v1/projects/:project/secrets/:env/:name`); setting it
++   again replaces it and adds one to its `version`. No API returns a value to a person, staff included. Members
++   (viewer and up) and staff read the metadata only: name, environment, version, a fingerprint, the grants, who set it
++   and when (`network.project-secret@1`). The fingerprint is a keyed hash, so it tells two values apart without
++   revealing either.
++3. **Encrypted at rest** with AES-256-GCM under a key held only in Network's environment (`NETWORK_SECRETS_KEY`, 32 random
++   bytes). Each row carries its key id, so the key can be rotated. Without the key the feature is off (503
++   `secrets.unavailable`), never plaintext.
++4. **A name is not a capability.** A service uses a secret only when the project granted that secret to that service:
++   `PUT …/:name/grants/:service { purposes, origins }`, admin or owner. There are two purposes:
++   - `sign`: Network computes HMAC-SHA256 of a message under the secret and answers the signature. The value never
++     leaves Network. This is how webhook deliveries are signed.
++   - `reveal`: Network answers the value, only to the granted service and only for an `origin` the grant lists (an
++     https origin the service will send it to). This is for credentials another system must receive as they are.
++5. **One first-party capability, `network.secret.use`**, on `POST /internal/secrets/use`
++   (`network.secret-use-request@1` → `network.secret-use-result@1`). The caller is the service in its token
++   (`svc:<id>`). A missing secret, a missing grant, a purpose or origin the grant does not list, and an archived project
++   all answer 404 `secret.not_found`, so a guess learns nothing.
++6. **Audit.** Every value set, deletion and grant change is a `dev_audit` row, and so is the first use of each secret per
++   service, purpose and UTC day. A grant records when it was last used. Values and messages are never written anywhere
++   but the encrypted column.
++7. **A project archived is crypto-shredded:** its secrets' ciphertexts are deleted when it is archived, and its metadata
++   stays in its audit.
++
++## Consequences
++
++- Actor's `secret_ref` names a secret in the task's project, granted to `actor` for `sign`. Watch, Bot and others follow
++  the same rule, and their operator-held grants become unnecessary for project resources.
++- The Services console shows and edits secrets through these routes with the person's own token, as it does apps and
++  grants. Services stores nothing.
++- A person without a project has no secret store. Personal resources keep their service's own secrets (Actor's per-task
++  webhook secret).
ddiff --git a/docs/adr/README.md b/docs/adr/README.md
iindex 0cca8d04..86c3e334 100644
---- a/docs/adr/README.md
++++ b/docs/adr/README.md
@@@ -49,3 +49,4 @@ Platform-wide decisions from the OpenVibe development roadmap (section 10). Each
  | [ADR-053](ADR-053-website-host-boundary.md) | The Website/Host boundary: OpenVibe.Website owns authoring (projects, pages, revisions, builds, Media asset pointers and intended domains) and OpenVibe.Host owns site, deploy, activation, domain binding/verification/TLS and serving; Website keeps no duplicate `host_sites`/`host_deploys` rows and calls Host's routes; a Website build is not a Host deploy; Website composes Host + Codes + Actor + Run + Media and is not OpenVibe.Sites | Proposed 2026-10-05 (plan T19), for the owner's review |
  | [ADR-054](ADR-054-inventory-authority.md) | The OpenVibe inventory: a new authority, OpenVibe.Inventory (`inventory`, `ov_inventory`), owns item kinds (contract + renderer per surface), definitions (`itd_`), instances (`inv_`), the equipped set and an append-only ledger; issuers grant within their namespace; no selling, buying, trading or conversion until a later money ADR (ADR-012/ADR-025); Live's cosmetics are the first kinds, migrated convert-verify-delete | Accepted 2026-10-09 (plan T21) |
  | [ADR-055](ADR-055-inventory-money.md) | Money and the inventory, in phases: A primary sales (an issuer prices an item in Vibes, booked by Billing as an ENTITLEMENT with a creator share, or in OpenCoins as a loyalty shop with no payout); B gifting between people for giftable items (an ADR-012 rule 6 amendment); C trading and a market stay closed (ADR-025); never paid chance (no cases, crates, loot boxes) | Proposed 2026-10-09 (plan T21), for the owner's decision |
++| [ADR-056](ADR-056-project-secrets.md) | Project secrets: OpenVibe.Network keeps them per project and environment, write-only (no API returns a value to a person), AES-256-GCM under `NETWORK_SECRETS_KEY`; a service uses one only when the project granted it, to `sign` (HMAC, the value never leaves Network) or to `reveal` it for a listed https origin, through first-party `network.secret.use`; archiving a project shreds its secrets | Accepted 2026-10-15 (plan T13/T17) |
ddiff --git a/fixtures/network.project-secret/invalid/http-origin.json b/fixtures/network.project-secret/invalid/http-origin.json
nnew file mode 100644
iindex 00000000..c4e87f40
---- /dev/null
++++ b/fixtures/network.project-secret/invalid/http-origin.json
@@@ -0,0 +1,25 @@
++{
++  "project_id": "prj_01M4XE52PGJDVR1KZ1AG9VYW3Q",
++  "environment": "production",
++  "name": "webhook-signing",
++  "version": 2,
++  "fingerprint": "3fa9c1d0be72",
++  "grants": [
++    {
++      "service": "watch",
++      "purposes": [
++        "reveal"
++      ],
++      "origins": [
++        "http://api.example.com"
++      ],
++      "created_at": "2026-10-15T05:00:00Z",
++      "created_by": "usr_01M3JCFXCJZ2NS0732AKPCVVHR",
++      "last_used_at": null
++    }
++  ],
++  "created_at": "2026-10-15T04:58:00Z",
++  "created_by": "usr_01M3JCFXCJZ2NS0732AKPCVVHR",
++  "updated_at": "2026-10-15T05:10:00Z",
++  "updated_by": "usr_01M3JCFXCJZ2NS0732AKPCVVHR"
++}
ddiff --git a/fixtures/network.project-secret/invalid/upper-name.json b/fixtures/network.project-secret/invalid/upper-name.json
nnew file mode 100644
iindex 00000000..a8e0a057
---- /dev/null
++++ b/fixtures/network.project-secret/invalid/upper-name.json
@@@ -0,0 +1,23 @@
++{
++  "project_id": "prj_01M4XE52PGJDVR1KZ1AG9VYW3Q",
++  "environment": "production",
++  "name": "Webhook",
++  "version": 2,
++  "fingerprint": "3fa9c1d0be72",
++  "grants": [
++    {
++      "service": "actor",
++      "purposes": [
++        "sign"
++      ],
++      "origins": [],
++      "created_at": "2026-10-15T05:00:00Z",
++      "created_by": "usr_01M3JCFXCJZ2NS0732AKPCVVHR",
++      "last_used_at": null
++    }
++  ],
++  "created_at": "2026-10-15T04:58:00Z",
++  "created_by": "usr_01M3JCFXCJZ2NS0732AKPCVVHR",
++  "updated_at": "2026-10-15T05:10:00Z",
++  "updated_by": "usr_01M3JCFXCJZ2NS0732AKPCVVHR"
++}
ddiff --git a/fixtures/network.project-secret/invalid/with-value.json b/fixtures/network.project-secret/invalid/with-value.json
nnew file mode 100644
iindex 00000000..71440939
---- /dev/null
++++ b/fixtures/network.project-secret/invalid/with-value.json
@@@ -0,0 +1,24 @@
++{
++  "project_id": "prj_01M4XE52PGJDVR1KZ1AG9VYW3Q",
++  "environment": "production",
++  "name": "webhook-signing",
++  "version": 2,
++  "fingerprint": "3fa9c1d0be72",
++  "grants": [
++    {
++      "service": "actor",
++      "purposes": [
++        "sign"
++      ],
++      "origins": [],
++      "created_at": "2026-10-15T05:00:00Z",
++      "created_by": "usr_01M3JCFXCJZ2NS0732AKPCVVHR",
++      "last_used_at": null
++    }
++  ],
++  "created_at": "2026-10-15T04:58:00Z",
++  "created_by": "usr_01M3JCFXCJZ2NS0732AKPCVVHR",
++  "updated_at": "2026-10-15T05:10:00Z",
++  "updated_by": "usr_01M3JCFXCJZ2NS0732AKPCVVHR",
++  "value": "hunter2"
++}
ddiff --git a/fixtures/network.project-secret/valid/reveal-grant.json b/fixtures/network.project-secret/valid/reveal-grant.json
nnew file mode 100644
iindex 00000000..4f920748
---- /dev/null
++++ b/fixtures/network.project-secret/valid/reveal-grant.json
@@@ -0,0 +1,25 @@
++{
++  "project_id": "prj_01M4XE52PGJDVR1KZ1AG9VYW3Q",
++  "environment": "production",
++  "name": "api_token",
++  "version": 1,
++  "fingerprint": "3fa9c1d0be72",
++  "grants": [
++    {
++      "service": "watch",
++      "purposes": [
++        "reveal"
++      ],
++      "origins": [
++        "https://api.example.com"
++      ],
++      "created_at": "2026-10-15T05:00:00Z",
++      "created_by": "usr_01M3JCFXCJZ2NS0732AKPCVVHR",
++      "last_used_at": "2026-10-15T05:30:00Z"
++    }
++  ],
++  "created_at": "2026-10-15T04:58:00Z",
++  "created_by": "usr_01M3JCFXCJZ2NS0732AKPCVVHR",
++  "updated_at": "2026-10-15T05:10:00Z",
++  "updated_by": "usr_01M3JCFXCJZ2NS0732AKPCVVHR"
++}
ddiff --git a/fixtures/network.project-secret/valid/signing-key.json b/fixtures/network.project-secret/valid/signing-key.json
nnew file mode 100644
iindex 00000000..bfca322c
---- /dev/null
++++ b/fixtures/network.project-secret/valid/signing-key.json
@@@ -0,0 +1,23 @@
++{
++  "project_id": "prj_01M4XE52PGJDVR1KZ1AG9VYW3Q",
++  "environment": "production",
++  "name": "webhook-signing",
++  "version": 2,
++  "fingerprint": "3fa9c1d0be72",
++  "grants": [
++    {
++      "service": "actor",
++      "purposes": [
++        "sign"
++      ],
++      "origins": [],
++      "created_at": "2026-10-15T05:00:00Z",
++      "created_by": "usr_01M3JCFXCJZ2NS0732AKPCVVHR",
++      "last_used_at": null
++    }
++  ],
++  "created_at": "2026-10-15T04:58:00Z",
++  "created_by": "usr_01M3JCFXCJZ2NS0732AKPCVVHR",
++  "updated_at": "2026-10-15T05:10:00Z",
++  "updated_by": "usr_01M3JCFXCJZ2NS0732AKPCVVHR"
++}
ddiff --git a/fixtures/network.secret-use-request/invalid/reveal-with-message.json b/fixtures/network.secret-use-request/invalid/reveal-with-message.json
nnew file mode 100644
iindex 00000000..9f4fd488
---- /dev/null
++++ b/fixtures/network.secret-use-request/invalid/reveal-with-message.json
@@@ -0,0 +1,8 @@
++{
++  "project_id": "prj_01M4XE52PGJDVR1KZ1AG9VYW3Q",
++  "environment": "production",
++  "name": "api_token",
++  "purpose": "reveal",
++  "origin": "https://api.example.com",
++  "message": "x"
++}
ddiff --git a/fixtures/network.secret-use-request/invalid/reveal-without-origin.json b/fixtures/network.secret-use-request/invalid/reveal-without-origin.json
nnew file mode 100644
iindex 00000000..d10a3bcf
---- /dev/null
++++ b/fixtures/network.secret-use-request/invalid/reveal-without-origin.json
@@@ -0,0 +1,6 @@
++{
++  "project_id": "prj_01M4XE52PGJDVR1KZ1AG9VYW3Q",
++  "environment": "production",
++  "name": "api_token",
++  "purpose": "reveal"
++}
ddiff --git a/fixtures/network.secret-use-request/invalid/sign-without-message.json b/fixtures/network.secret-use-request/invalid/sign-without-message.json
nnew file mode 100644
iindex 00000000..f35b67a3
---- /dev/null
++++ b/fixtures/network.secret-use-request/invalid/sign-without-message.json
@@@ -0,0 +1,6 @@
++{
++  "project_id": "prj_01M4XE52PGJDVR1KZ1AG9VYW3Q",
++  "environment": "production",
++  "name": "webhook-signing",
++  "purpose": "sign"
++}
ddiff --git a/fixtures/network.secret-use-request/valid/reveal.json b/fixtures/network.secret-use-request/valid/reveal.json
nnew file mode 100644
iindex 00000000..4f887753
---- /dev/null
++++ b/fixtures/network.secret-use-request/valid/reveal.json
@@@ -0,0 +1,7 @@
++{
++  "project_id": "prj_01M4XE52PGJDVR1KZ1AG9VYW3Q",
++  "environment": "sandbox",
++  "name": "api_token",
++  "purpose": "reveal",
++  "origin": "https://api.example.com"
++}
ddiff --git a/fixtures/network.secret-use-request/valid/sign.json b/fixtures/network.secret-use-request/valid/sign.json
nnew file mode 100644
iindex 00000000..c49913f5
---- /dev/null
++++ b/fixtures/network.secret-use-request/valid/sign.json
@@@ -0,0 +1,7 @@
++{
++  "project_id": "prj_01M4XE52PGJDVR1KZ1AG9VYW3Q",
++  "environment": "production",
++  "name": "webhook-signing",
++  "purpose": "sign",
++  "message": "1760504400.{\"state\":\"succeeded\"}"
++}
ddiff --git a/fixtures/network.secret-use-result/invalid/short-signature.json b/fixtures/network.secret-use-result/invalid/short-signature.json
nnew file mode 100644
iindex 00000000..2ec2892c
---- /dev/null
++++ b/fixtures/network.secret-use-result/invalid/short-signature.json
@@@ -0,0 +1,6 @@
++{
++  "name": "webhook-signing",
++  "version": 2,
++  "purpose": "sign",
++  "signature": "abc"
++}
ddiff --git a/fixtures/network.secret-use-result/invalid/sign-with-value.json b/fixtures/network.secret-use-result/invalid/sign-with-value.json
nnew file mode 100644
iindex 00000000..185fe444
---- /dev/null
++++ b/fixtures/network.secret-use-result/invalid/sign-with-value.json
@@@ -0,0 +1,7 @@
++{
++  "name": "webhook-signing",
++  "version": 2,
++  "purpose": "sign",
++  "signature": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
++  "value": "x"
++}
ddiff --git a/fixtures/network.secret-use-result/valid/signature.json b/fixtures/network.secret-use-result/valid/signature.json
nnew file mode 100644
iindex 00000000..97a9d8b9
---- /dev/null
++++ b/fixtures/network.secret-use-result/valid/signature.json
@@@ -0,0 +1,6 @@
++{
++  "name": "webhook-signing",
++  "version": 2,
++  "purpose": "sign",
++  "signature": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++}
ddiff --git a/fixtures/network.secret-use-result/valid/value.json b/fixtures/network.secret-use-result/valid/value.json
nnew file mode 100644
iindex 00000000..8063eb38
---- /dev/null
++++ b/fixtures/network.secret-use-result/valid/value.json
@@@ -0,0 +1,6 @@
++{
++  "name": "api_token",
++  "version": 1,
++  "purpose": "reveal",
++  "value": "kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk"
++}
ddiff --git a/generated/json-schema/bundle.json b/generated/json-schema/bundle.json
iindex 2173136a..d01031af 100644
---- a/generated/json-schema/bundle.json
++++ b/generated/json-schema/bundle.json
@@@ -29865,6 +29865,315 @@
          }
        }
      },
++    "network.project-secret": {
++      "version": "1.0.0",
++      "owner": "network",
++      "status": "active",
++      "schema": {
++        "$schema": "https://json-schema.org/draft/2020-12/schema",
++        "$id": "https://openvibe.network/contracts/network/project-secret.v1.json",
++        "title": "ProjectSecret",
++        "description": "network.project-secret@1 (ADR-056): one project secret as OpenVibe.Network shows it to the project's members and staff — its name, environment, version, a keyed fingerprint and its grants. Never the value: a secret is written once and used by name (sign or reveal through network.secret.use).",
++        "type": "object",
++        "required": [
++          "project_id",
++          "environment",
++          "name",
++          "version",
++          "fingerprint",
++          "grants",
++          "created_at",
++          "created_by",
++          "updated_at",
++          "updated_by"
++        ],
++        "additionalProperties": false,
++        "$defs": {
++          "subject": {
++            "type": "string",
++            "pattern": "^usr_[0-9A-HJKMNP-TV-Z]{26}$"
++          },
++          "grant": {
++            "type": "object",
++            "required": [
++              "service",
++              "purposes",
++              "origins",
++              "created_at",
++              "created_by",
++              "last_used_at"
++            ],
++            "additionalProperties": false,
++            "properties": {
++              "service": {
++                "type": "string",
++                "pattern": "^[a-z][a-z0-9-]{1,39}$",
++                "description": "The service id the secret is granted to (its token's svc:<id>)."
++              },
++              "purposes": {
++                "type": "array",
++                "minItems": 1,
++                "maxItems": 2,
++                "uniqueItems": true,
++                "items": {
++                  "enum": [
++                    "sign",
++                    "reveal"
++                  ]
++                }
++              },
++              "origins": {
++                "type": "array",
++                "maxItems": 10,
++                "uniqueItems": true,
++                "items": {
++                  "type": "string",
++                  "pattern": "^https://[a-z0-9.-]+(:[0-9]{1,5})?$"
++                },
++                "description": "The https origins the value may be revealed for (reveal only; empty for sign)."
++              },
++              "created_at": {
++                "type": "string",
++                "format": "date-time"
++              },
++              "created_by": {
++                "$ref": "#/$defs/subject"
++              },
++              "last_used_at": {
++                "type": [
++                  "string",
++                  "null"
++                ],
++                "format": "date-time"
++              }
++            }
++          }
++        },
++        "properties": {
++          "project_id": {
++            "type": "string",
++            "pattern": "^prj_[0-9A-HJKMNP-TV-Z]{26}$"
++          },
++          "environment": {
++            "enum": [
++              "sandbox",
++              "production"
++            ]
++          },
++          "name": {
++            "type": "string",
++            "pattern": "^[a-z][a-z0-9_-]{0,63}$"
++          },
++          "version": {
++            "type": "integer",
++            "minimum": 1,
++            "description": "One more each time the value is set again."
++          },
++          "fingerprint": {
++            "type": "string",
++            "pattern": "^[0-9a-f]{12}$",
++            "description": "A keyed hash of the value: equal values have equal fingerprints, and it reveals nothing else."
++          },
++          "grants": {
++            "type": "array",
++            "maxItems": 20,
++            "items": {
++              "$ref": "#/$defs/grant"
++            }
++          },
++          "created_at": {
++            "type": "string",
++            "format": "date-time"
++          },
++          "created_by": {
++            "$ref": "#/$defs/subject"
++          },
++          "updated_at": {
++            "type": "string",
++            "format": "date-time"
++          },
++          "updated_by": {
++            "$ref": "#/$defs/subject"
++          }
++        }
++      }
++    },
++    "network.secret-use-request": {
++      "version": "1.0.0",
++      "owner": "network",
++      "status": "active",
++      "schema": {
++        "$schema": "https://json-schema.org/draft/2020-12/schema",
++        "$id": "https://openvibe.network/contracts/network/secret-use-request.v1.json",
++        "title": "SecretUseRequest",
++        "description": "network.secret-use-request@1 (ADR-056): what a first-party service sends to POST /internal/secrets/use with network.secret.use. sign asks for HMAC-SHA256 of message under the secret (the value never leaves Network); reveal asks for the value, to send to origin. Either needs a grant of that secret to the calling service for that purpose (and origin).",
++        "type": "object",
++        "required": [
++          "project_id",
++          "environment",
++          "name",
++          "purpose"
++        ],
++        "additionalProperties": false,
++        "properties": {
++          "project_id": {
++            "type": "string",
++            "pattern": "^prj_[0-9A-HJKMNP-TV-Z]{26}$"
++          },
++          "environment": {
++            "enum": [
++              "sandbox",
++              "production"
++            ]
++          },
++          "name": {
++            "type": "string",
++            "pattern": "^[a-z][a-z0-9_-]{0,63}$"
++          },
++          "purpose": {
++            "enum": [
++              "sign",
++              "reveal"
++            ]
++          },
++          "message": {
++            "type": "string",
++            "maxLength": 1048576,
++            "description": "sign: the exact text to sign (for a webhook delivery, \"<timestamp>.<raw body>\"). Not allowed with reveal."
++          },
++          "origin": {
++            "type": "string",
++            "pattern": "^https://[a-z0-9.-]+(:[0-9]{1,5})?$",
++            "description": "reveal: the https origin the value will be sent to; the grant must list it. Not allowed with sign."
++          }
++        },
++        "allOf": [
++          {
++            "if": {
++              "properties": {
++                "purpose": {
++                  "const": "sign"
++                }
++              }
++            },
++            "then": {
++              "required": [
++                "message"
++              ],
++              "not": {
++                "required": [
++                  "origin"
++                ]
++              }
++            }
++          },
++          {
++            "if": {
++              "properties": {
++                "purpose": {
++                  "const": "reveal"
++                }
++              }
++            },
++            "then": {
++              "required": [
++                "origin"
++              ],
++              "not": {
++                "required": [
++                  "message"
++                ]
++              }
++            }
++          }
++        ]
++      }
++    },
++    "network.secret-use-result": {
++      "version": "1.0.0",
++      "owner": "network",
++      "status": "active",
++      "schema": {
++        "$schema": "https://json-schema.org/draft/2020-12/schema",
++        "$id": "https://openvibe.network/contracts/network/secret-use-result.v1.json",
++        "title": "SecretUseResult",
++        "description": "network.secret-use-result@1 (ADR-056): POST /internal/secrets/use's answer — the secret's name and version with the HMAC-SHA256 signature (sign) or the value (reveal). Sent with Cache-Control: no-store; a caller keeps a revealed value only as long as the request it is for.",
++        "type": "object",
++        "required": [
++          "name",
++          "version",
++          "purpose"
++        ],
++        "additionalProperties": false,
++        "properties": {
++          "name": {
++            "type": "string",
++            "pattern": "^[a-z][a-z0-9_-]{0,63}$"
++          },
++          "version": {
++            "type": "integer",
++            "minimum": 1
++          },
++          "purpose": {
++            "enum": [
++              "sign",
++              "reveal"
++            ]
++          },
++          "signature": {
++            "type": "string",
++            "pattern": "^[0-9a-f]{64}$",
++            "description": "sign: the lowercase hex HMAC-SHA256 of the message under the secret."
++          },
++          "value": {
++            "type": "string",
++            "minLength": 1,
++            "maxLength": 8192,
++            "description": "reveal: the value."
++          }
++        },
++        "allOf": [
++          {
++            "if": {
++              "properties": {
++                "purpose": {
++                  "const": "sign"
++                }
++              }
++            },
++            "then": {
++              "required": [
++                "signature"
++              ],
++              "not": {
++                "required": [
++                  "value"
++                ]
++              }
++            }
++          },
++          {
++            "if": {
++              "properties": {
++                "purpose": {
++                  "const": "reveal"
++                }
++              }
++            },
++            "then": {
++              "required": [
++                "value"
++              ],
++              "not": {
++                "required": [
++                  "signature"
++                ]
++              }
++            }
++          }
++        ]
++      }
++    },
      "network.status-incident": {
        "version": "1.0.0",
        "owner": "network",
ddiff --git a/generated/openapi/actor.json b/generated/openapi/actor.json
iindex 33fb558c..2384ffbc 100644
---- a/generated/openapi/actor.json
++++ b/generated/openapi/actor.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Actor API",
--  "version": "0.176.1",
--  "description": "Routes of OpenVibe.Actor as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.177.0",
++  "description": "Routes of OpenVibe.Actor as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/ai.json b/generated/openapi/ai.json
iindex c3b23323..e967b8a8 100644
---- a/generated/openapi/ai.json
++++ b/generated/openapi/ai.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.AI API",
--  "version": "0.176.1",
--  "description": "Routes of OpenVibe.AI as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.177.0",
++  "description": "Routes of OpenVibe.AI as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/billing.json b/generated/openapi/billing.json
iindex d4082f13..1b935da3 100644
---- a/generated/openapi/billing.json
++++ b/generated/openapi/billing.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Billing API",
--  "version": "0.176.1",
--  "description": "Routes of OpenVibe.Billing as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.177.0",
++  "description": "Routes of OpenVibe.Billing as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/blog.json b/generated/openapi/blog.json
iindex ac89d479..e85f737e 100644
---- a/generated/openapi/blog.json
++++ b/generated/openapi/blog.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Blog API",
--  "version": "0.176.1",
--  "description": "Routes of OpenVibe.Blog as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.177.0",
++  "description": "Routes of OpenVibe.Blog as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/bot.json b/generated/openapi/bot.json
iindex 60896f3c..8fe51461 100644
---- a/generated/openapi/bot.json
++++ b/generated/openapi/bot.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Bot API",
--  "version": "0.176.1",
--  "description": "Routes of OpenVibe.Bot as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.177.0",
++  "description": "Routes of OpenVibe.Bot as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/chat.json b/generated/openapi/chat.json
iindex c2ba3d1a..3e512a28 100644
---- a/generated/openapi/chat.json
++++ b/generated/openapi/chat.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Chat API",
--  "version": "0.176.1",
--  "description": "Routes of OpenVibe.Chat as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.177.0",
++  "description": "Routes of OpenVibe.Chat as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/codes.json b/generated/openapi/codes.json
iindex 02c01808..8a2080bd 100644
---- a/generated/openapi/codes.json
++++ b/generated/openapi/codes.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Codes API",
--  "version": "0.176.1",
--  "description": "Routes of OpenVibe.Codes as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.177.0",
++  "description": "Routes of OpenVibe.Codes as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/community.json b/generated/openapi/community.json
iindex 3c9d2e96..911d5af2 100644
---- a/generated/openapi/community.json
++++ b/generated/openapi/community.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Community API",
--  "version": "0.176.1",
--  "description": "Routes of OpenVibe.Community as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.177.0",
++  "description": "Routes of OpenVibe.Community as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/coupons.json b/generated/openapi/coupons.json
iindex 5c6fe371..c7a51c11 100644
---- a/generated/openapi/coupons.json
++++ b/generated/openapi/coupons.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Coupons API",
--  "version": "0.176.1",
--  "description": "Routes of OpenVibe.Coupons as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.177.0",
++  "description": "Routes of OpenVibe.Coupons as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/deals.json b/generated/openapi/deals.json
iindex e060ac58..35208db1 100644
---- a/generated/openapi/deals.json
++++ b/generated/openapi/deals.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Deals API",
--  "version": "0.176.1",
--  "description": "Routes of OpenVibe.Deals as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.177.0",
++  "description": "Routes of OpenVibe.Deals as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/events.json b/generated/openapi/events.json
iindex 3fa92f18..42486092 100644
---- a/generated/openapi/events.json
++++ b/generated/openapi/events.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Events API",
--  "version": "0.176.1",
--  "description": "Routes of OpenVibe.Events as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.177.0",
++  "description": "Routes of OpenVibe.Events as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/food.json b/generated/openapi/food.json
iindex 86ee3a65..f4cfbe46 100644
---- a/generated/openapi/food.json
++++ b/generated/openapi/food.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Food API",
--  "version": "0.176.1",
--  "description": "Routes of OpenVibe.Food as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.177.0",
++  "description": "Routes of OpenVibe.Food as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/games.json b/generated/openapi/games.json
iindex c652c00d..757ab797 100644
---- a/generated/openapi/games.json
++++ b/generated/openapi/games.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Games API",
--  "version": "0.176.1",
--  "description": "Routes of OpenVibe.Games as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.177.0",
++  "description": "Routes of OpenVibe.Games as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/host.json b/generated/openapi/host.json
iindex 6d9bf9f8..e4a705af 100644
---- a/generated/openapi/host.json
++++ b/generated/openapi/host.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Host API",
--  "version": "0.176.1",
--  "description": "Routes of OpenVibe.Host as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.177.0",
++  "description": "Routes of OpenVibe.Host as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/index.json b/generated/openapi/index.json
iindex cca58896..aa657368 100644
---- a/generated/openapi/index.json
++++ b/generated/openapi/index.json
@@@ -131,8 +131,8 @@
        "service": "network",
        "name": "OpenVibe.Network",
        "origin": "https://openvibe.network",
--      "operations": 40,
--      "capabilities": 28
++      "operations": 41,
++      "capabilities": 29
      },
      {
        "service": "news",
ddiff --git a/generated/openapi/inventory.json b/generated/openapi/inventory.json
iindex 915b8690..1be602bd 100644
---- a/generated/openapi/inventory.json
++++ b/generated/openapi/inventory.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Inventory API",
--  "version": "0.176.1",
--  "description": "Routes of OpenVibe.Inventory as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.177.0",
++  "description": "Routes of OpenVibe.Inventory as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/live.json b/generated/openapi/live.json
iindex af0c5918..3276d589 100644
---- a/generated/openapi/live.json
++++ b/generated/openapi/live.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Live API",
--  "version": "0.176.1",
--  "description": "Routes of OpenVibe.Live as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.177.0",
++  "description": "Routes of OpenVibe.Live as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/media-hub.json b/generated/openapi/media-hub.json
iindex 863512a4..cacabcfc 100644
---- a/generated/openapi/media-hub.json
++++ b/generated/openapi/media-hub.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.MediaHub API",
--  "version": "0.176.1",
--  "description": "Routes of OpenVibe.MediaHub as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.177.0",
++  "description": "Routes of OpenVibe.MediaHub as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/media.json b/generated/openapi/media.json
iindex 59fb84b2..e2cc4c54 100644
---- a/generated/openapi/media.json
++++ b/generated/openapi/media.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Media API",
--  "version": "0.176.1",
--  "description": "Routes of OpenVibe.Media as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.177.0",
++  "description": "Routes of OpenVibe.Media as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/network.json b/generated/openapi/network.json
iindex 05b4812c..f0d7f064 100644
---- a/generated/openapi/network.json
++++ b/generated/openapi/network.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Network API",
--  "version": "0.176.1",
--  "description": "Routes of OpenVibe.Network as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.177.0",
++  "description": "Routes of OpenVibe.Network as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
@@@ -2217,6 +2217,62 @@
      }
     }
    },
++  "/internal/secrets/use": {
++   "post": {
++    "operationId": "post_internal_secrets_use",
++    "summary": "Sign with, or reveal, a project secret the project granted to the calling service (ADR-056): sign answers HMAC-SHA256 of a message and never the value; reveal answers the value only for an origin the ",
++    "description": "**network.secret.use** (first-party): Sign with, or reveal, a project secret the project granted to the calling service (ADR-056): sign answers HMAC-SHA256 of a message and never the value; reveal answers the value only for an origin the grant lists.",
++    "tags": [
++     "network.secret"
++    ],
++    "x-openvibe-capabilities": [
++     "network.secret.use"
++    ],
++    "x-openvibe-visibility": [
++     "first-party"
++    ],
++    "x-openvibe-quota-class": "secrets-use",
++    "security": [
++     {
++      "openvibeToken": [
++       "network.secret.use"
++      ]
++     }
++    ],
++    "requestBody": {
++     "required": false,
++     "content": {
++      "application/json": {
++       "schema": {
++        "$ref": "#/components/schemas/network.secret-use-request.v1"
++       }
++      }
++     }
++    },
++    "responses": {
++     "2XX": {
++      "description": "Success",
++      "content": {
++       "application/json": {
++        "schema": {
++         "$ref": "#/components/schemas/network.secret-use-result.v1"
++        }
++       }
++      }
++     },
++     "default": {
++      "description": "An error (RFC 9457 problem details)",
++      "content": {
++       "application/problem+json": {
++        "schema": {
++         "$ref": "#/components/schemas/errors.problem.v1"
++        }
++       }
++      }
++     }
++    }
++   }
++  },
    "/internal/url-registry/resolved": {
     "get": {
      "operationId": "get_internal_url_registry_resolved",
@@@ -4540,6 +4596,168 @@
       }
      }
     },
++   "network.secret-use-request.v1": {
++    "title": "SecretUseRequest",
++    "description": "network.secret-use-request@1 (ADR-056): what a first-party service sends to POST /internal/secrets/use with network.secret.use. sign asks for HMAC-SHA256 of message under the secret (the value never leaves Network); reveal asks for the value, to send to origin. Either needs a grant of that secret to the calling service for that purpose (and origin).",
++    "type": "object",
++    "required": [
++     "project_id",
++     "environment",
++     "name",
++     "purpose"
++    ],
++    "additionalProperties": false,
++    "properties": {
++     "project_id": {
++      "type": "string",
++      "pattern": "^prj_[0-9A-HJKMNP-TV-Z]{26}$"
++     },
++     "environment": {
++      "enum": [
++       "sandbox",
++       "production"
++      ]
++     },
++     "name": {
++      "type": "string",
++      "pattern": "^[a-z][a-z0-9_-]{0,63}$"
++     },
++     "purpose": {
++      "enum": [
++       "sign",
++       "reveal"
++      ]
++     },
++     "message": {
++      "type": "string",
++      "maxLength": 1048576,
++      "description": "sign: the exact text to sign (for a webhook delivery, \"<timestamp>.<raw body>\"). Not allowed with reveal."
++     },
++     "origin": {
++      "type": "string",
++      "pattern": "^https://[a-z0-9.-]+(:[0-9]{1,5})?$",
++      "description": "reveal: the https origin the value will be sent to; the grant must list it. Not allowed with sign."
++     }
++    },
++    "allOf": [
++     {
++      "if": {
++       "properties": {
++        "purpose": {
++         "const": "sign"
++        }
++       }
++      },
++      "then": {
++       "required": [
++        "message"
++       ],
++       "not": {
++        "required": [
++         "origin"
++        ]
++       }
++      }
++     },
++     {
++      "if": {
++       "properties": {
++        "purpose": {
++         "const": "reveal"
++        }
++       }
++      },
++      "then": {
++       "required": [
++        "origin"
++       ],
++       "not": {
++        "required": [
++         "message"
++        ]
++       }
++      }
++     }
++    ]
++   },
++   "network.secret-use-result.v1": {
++    "title": "SecretUseResult",
++    "description": "network.secret-use-result@1 (ADR-056): POST /internal/secrets/use's answer — the secret's name and version with the HMAC-SHA256 signature (sign) or the value (reveal). Sent with Cache-Control: no-store; a caller keeps a revealed value only as long as the request it is for.",
++    "type": "object",
++    "required": [
++     "name",
++     "version",
++     "purpose"
++    ],
++    "additionalProperties": false,
++    "properties": {
++     "name": {
++      "type": "string",
++      "pattern": "^[a-z][a-z0-9_-]{0,63}$"
++     },
++     "version": {
++      "type": "integer",
++      "minimum": 1
++     },
++     "purpose": {
++      "enum": [
++       "sign",
++       "reveal"
++      ]
++     },
++     "signature": {
++      "type": "string",
++      "pattern": "^[0-9a-f]{64}$",
++      "description": "sign: the lowercase hex HMAC-SHA256 of the message under the secret."
++     },
++     "value": {
++      "type": "string",
++      "minLength": 1,
++      "maxLength": 8192,
++      "description": "reveal: the value."
++     }
++    },
++    "allOf": [
++     {
++      "if": {
++       "properties": {
++        "purpose": {
++         "const": "sign"
++        }
++       }
++      },
++      "then": {
++       "required": [
++        "signature"
++       ],
++       "not": {
++        "required": [
++         "value"
++        ]
++       }
++      }
++     },
++     {
++      "if": {
++       "properties": {
++        "purpose": {
++         "const": "reveal"
++        }
++       }
++      },
++      "then": {
++       "required": [
++        "value"
++       ],
++       "not": {
++        "required": [
++         "signature"
++        ]
++       }
++      }
++     }
++    ]
++   },
     "network.staff-list-result.v1": {
      "title": "NetworkStaffListResult",
      "description": "network.staff-list-result@1: the answer of network.staff.read on OpenVibe.Network. GET /api/v1/staff/moderators[?service=chat|live|community|pastes|calls] (a service token holding network.staff.read, or a signed-in person holding staff.moderation.logs) → { service, staff }: the network's global moderators, admins and the owner who are not banned, with the staff capabilities their role holds in the contracts staff map; ?service keeps those holding the capability that moderates that service (another service name keeps those holding staff.content.moderate; an invalid value is ignored and answered as null). Answered with Cache-Control: private, no-store; a person without staff.moderation.logs gets 403 { error: forbidden }.",
ddiff --git a/generated/openapi/news.json b/generated/openapi/news.json
iindex 16b953f6..2db65733 100644
---- a/generated/openapi/news.json
++++ b/generated/openapi/news.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.News API",
--  "version": "0.176.1",
--  "description": "Routes of OpenVibe.News as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.177.0",
++  "description": "Routes of OpenVibe.News as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/openre.json b/generated/openapi/openre.json
iindex 3f3967ca..b8350085 100644
---- a/generated/openapi/openre.json
++++ b/generated/openapi/openre.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenRestream API",
--  "version": "0.176.1",
--  "description": "Routes of OpenRestream as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.177.0",
++  "description": "Routes of OpenRestream as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/play.json b/generated/openapi/play.json
iindex c8ecece3..29a6a809 100644
---- a/generated/openapi/play.json
++++ b/generated/openapi/play.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Play API",
--  "version": "0.176.1",
--  "description": "Routes of OpenVibe.Play as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.177.0",
++  "description": "Routes of OpenVibe.Play as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/reviews.json b/generated/openapi/reviews.json
iindex 525ad3ad..cd26d9f2 100644
---- a/generated/openapi/reviews.json
++++ b/generated/openapi/reviews.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Reviews API",
--  "version": "0.176.1",
--  "description": "Routes of OpenVibe.Reviews as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.177.0",
++  "description": "Routes of OpenVibe.Reviews as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/run.json b/generated/openapi/run.json
iindex a91f65e9..4e4896c4 100644
---- a/generated/openapi/run.json
++++ b/generated/openapi/run.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Run API",
--  "version": "0.176.1",
--  "description": "Routes of OpenVibe.Run as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.177.0",
++  "description": "Routes of OpenVibe.Run as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/search.json b/generated/openapi/search.json
iindex 4667297c..a7baccfd 100644
---- a/generated/openapi/search.json
++++ b/generated/openapi/search.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Search API",
--  "version": "0.176.1",
--  "description": "Routes of OpenVibe.Search as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.177.0",
++  "description": "Routes of OpenVibe.Search as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/services.json b/generated/openapi/services.json
iindex 31a17f83..628ec652 100644
---- a/generated/openapi/services.json
++++ b/generated/openapi/services.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Services API",
--  "version": "0.176.1",
--  "description": "Routes of OpenVibe.Services as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.177.0",
++  "description": "Routes of OpenVibe.Services as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/sources.json b/generated/openapi/sources.json
iindex 36f1543b..9d0230a2 100644
---- a/generated/openapi/sources.json
++++ b/generated/openapi/sources.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Sources API",
--  "version": "0.176.1",
--  "description": "Routes of OpenVibe.Sources as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.177.0",
++  "description": "Routes of OpenVibe.Sources as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/space.json b/generated/openapi/space.json
iindex 80575364..641d7302 100644
---- a/generated/openapi/space.json
++++ b/generated/openapi/space.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Space API",
--  "version": "0.176.1",
--  "description": "Routes of OpenVibe.Space as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.177.0",
++  "description": "Routes of OpenVibe.Space as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/tips.json b/generated/openapi/tips.json
iindex 9b0cecb1..7e878c14 100644
---- a/generated/openapi/tips.json
++++ b/generated/openapi/tips.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Tips API",
--  "version": "0.176.1",
--  "description": "Routes of OpenVibe.Tips as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.177.0",
++  "description": "Routes of OpenVibe.Tips as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/tools.json b/generated/openapi/tools.json
iindex 8c4a522e..5c48cd28 100644
---- a/generated/openapi/tools.json
++++ b/generated/openapi/tools.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Tools API",
--  "version": "0.176.1",
--  "description": "Routes of OpenVibe.Tools as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.177.0",
++  "description": "Routes of OpenVibe.Tools as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/trade.json b/generated/openapi/trade.json
iindex c3fbec98..648ad507 100644
---- a/generated/openapi/trade.json
++++ b/generated/openapi/trade.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Trade API",
--  "version": "0.176.1",
--  "description": "Routes of OpenVibe.Trade as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.177.0",
++  "description": "Routes of OpenVibe.Trade as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/vip.json b/generated/openapi/vip.json
iindex c18a6279..abc81db0 100644
---- a/generated/openapi/vip.json
++++ b/generated/openapi/vip.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.VIP API",
--  "version": "0.176.1",
--  "description": "Routes of OpenVibe.VIP as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.177.0",
++  "description": "Routes of OpenVibe.VIP as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/watch.json b/generated/openapi/watch.json
iindex f25ba4d0..d222b5ef 100644
---- a/generated/openapi/watch.json
++++ b/generated/openapi/watch.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Watch API",
--  "version": "0.176.1",
--  "description": "Routes of OpenVibe.Watch as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.177.0",
++  "description": "Routes of OpenVibe.Watch as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/wiki.json b/generated/openapi/wiki.json
iindex 5e67d998..5fef2414 100644
---- a/generated/openapi/wiki.json
++++ b/generated/openapi/wiki.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Wiki API",
--  "version": "0.176.1",
--  "description": "Routes of OpenVibe.Wiki as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.177.0",
++  "description": "Routes of OpenVibe.Wiki as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/work.json b/generated/openapi/work.json
iindex 53e82cd0..da13899d 100644
---- a/generated/openapi/work.json
++++ b/generated/openapi/work.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Work API",
--  "version": "0.176.1",
--  "description": "Routes of OpenVibe.Work as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.177.0",
++  "description": "Routes of OpenVibe.Work as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/zone.json b/generated/openapi/zone.json
iindex c201a82f..e113a575 100644
---- a/generated/openapi/zone.json
++++ b/generated/openapi/zone.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Zone API",
--  "version": "0.176.1",
--  "description": "Routes of OpenVibe.Zone as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.177.0",
++  "description": "Routes of OpenVibe.Zone as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/typescript/index.d.ts b/generated/typescript/index.d.ts
iindex 2e52a65f..a1d4ac73 100644
---- a/generated/typescript/index.d.ts
++++ b/generated/typescript/index.d.ts
@@@ -149739,6 +149739,6624 @@ export interface ProjectUsageResult {
    };
  }
  
++/** [email protected] (owner: network) */
++/**
++ * network.project-secret@1 (ADR-056): one project secret as OpenVibe.Network shows it to the project's members and staff — its name, environment, version, a keyed fingerprint and its grants. Never the value: a secret is written once and used by name (sign or reveal through network.secret.use).
++ */
++export interface ProjectSecret {
++  project_id: string;
++  environment: "sandbox" | "production";
++  name: string;
++  /**
++   * One more each time the value is set again.
++   */
++  version: number;
++  /**
++   * A keyed hash of the value: equal values have equal fingerprints, and it reveals nothing else.
++   */
++  fingerprint: string;
++  /**
++   * @maxItems 20
++   */
++  grants:
++    | []
++    | [
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        }
++      ]
++    | [
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        }
++      ]
++    | [
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        }
++      ]
++    | [
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        }
++      ]
++    | [
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        }
++      ]
++    | [
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        }
++      ]
++    | [
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        }
++      ]
++    | [
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        }
++      ]
++    | [
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        }
++      ]
++    | [
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        }
++      ]
++    | [
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        }
++      ]
++    | [
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        }
++      ]
++    | [
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        }
++      ]
++    | [
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        }
++      ]
++    | [
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        }
++      ]
++    | [
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        }
++      ]
++    | [
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        }
++      ]
++    | [
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        }
++      ]
++    | [
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        }
++      ]
++    | [
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        },
++        {
++          /**
++           * The service id the secret is granted to (its token's svc:<id>).
++           */
++          service: string;
++          /**
++           * @minItems 1
++           * @maxItems 2
++           */
++          purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];
++          /**
++           * The https origins the value may be revealed for (reveal only; empty for sign).
++           *
++           * @maxItems 10
++           */
++          origins:
++            | []
++            | [string]
++            | [string, string]
++            | [string, string, string]
++            | [string, string, string, string]
++            | [string, string, string, string, string]
++            | [string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string]
++            | [string, string, string, string, string, string, string, string, string, string];
++          created_at: string;
++          created_by: string;
++          last_used_at: string | null;
++        }
++      ];
++  created_at: string;
++  created_by: string;
++  updated_at: string;
++  updated_by: string;
++}
++
++/** [email protected] (owner: network) */
++/**
++ * network.secret-use-request@1 (ADR-056): what a first-party service sends to POST /internal/secrets/use with network.secret.use. sign asks for HMAC-SHA256 of message under the secret (the value never leaves Network); reveal asks for the value, to send to origin. Either needs a grant of that secret to the calling service for that purpose (and origin).
++ */
++export type SecretUseRequest = {
++  [k: string]: unknown | undefined;
++} & {
++  project_id: string;
++  environment: "sandbox" | "production";
++  name: string;
++  purpose: "sign" | "reveal";
++  /**
++   * sign: the exact text to sign (for a webhook delivery, "<timestamp>.<raw body>"). Not allowed with reveal.
++   */
++  message?: string;
++  /**
++   * reveal: the https origin the value will be sent to; the grant must list it. Not allowed with sign.
++   */
++  origin?: string;
++};
++
++/** [email protected] (owner: network) */
++/**
++ * network.secret-use-result@1 (ADR-056): POST /internal/secrets/use's answer — the secret's name and version with the HMAC-SHA256 signature (sign) or the value (reveal). Sent with Cache-Control: no-store; a caller keeps a revealed value only as long as the request it is for.
++ */
++export type SecretUseResult = {
++  [k: string]: unknown | undefined;
++} & {
++  name: string;
++  version: number;
++  purpose: "sign" | "reveal";
++  /**
++   * sign: the lowercase hex HMAC-SHA256 of the message under the secret.
++   */
++  signature?: string;
++  /**
++   * reveal: the value.
++   */
++  value?: string;
++};
++
  /** [email protected] (owner: network) */
  /**
   * network.status-incident@1 (roadmap WS-N task 12): one incident or maintenance window on openvibe.network/status, public. An incident moves investigating → identified → monitoring → resolved; a maintenance window scheduled → in_progress → completed. Each change adds an update with its message; the newest state is the incident's. Services are registry ids. Messages are plain text written for people (no internal hostnames, secrets or personal data).
ddiff --git a/manifests/capabilities/network.secret.use.json b/manifests/capabilities/network.secret.use.json
nnew file mode 100644
iindex 00000000..fb3a3ed1
---- /dev/null
++++ b/manifests/capabilities/network.secret.use.json
@@@ -0,0 +1,21 @@
++{
++  "id": "network.secret.use",
++  "version": "1.0",
++  "owner": "network",
++  "status": "active",
++  "visibility": "first-party",
++  "description": "Sign with, or reveal, a project secret the project granted to the calling service (ADR-056): sign answers HMAC-SHA256 of a message and never the value; reveal answers the value only for an origin the grant lists.",
++  "inputSchema": "network.secret-use-request@1",
++  "outputSchema": "network.secret-use-result@1",
++  "permissions": [
++    "secrets:use"
++  ],
++  "resourceConstraints": [
++    "project"
++  ],
++  "quotaClass": "secrets-use",
++  "events": [],
++  "implementedBy": [
++    "POST /internal/secrets/use"
++  ]
++}
ddiff --git a/manifests/services/network.json b/manifests/services/network.json
iindex adc0b0bd..9a66bb52 100644
---- a/manifests/services/network.json
++++ b/manifests/services/network.json
@@@ -60,6 +60,7 @@
      "network.registry.read",
      "network.resource.read",
      "network.resource.report",
++    "network.secret.use",
      "network.staff.read",
      "network.status.incident"
    ],
ddiff --git a/package.json b/package.json
iindex 1cd6b7aa..6324a9dd 100644
---- a/package.json
++++ b/package.json
@@@ -1,6 +1,6 @@
  {
    "name": "openvibe-contracts",
--  "version": "0.176.1",
++  "version": "0.177.0",
    "description": "Machine-readable contracts for the OpenVibe network: schemas, manifests, ids, error envelope, capability checks.",
    "main": "index.js",
    "types": "generated/typescript/index.d.ts",

diff --git a/CHANGELOG.md b/CHANGELOG.md

index 8e2bceb7..e1d8b02a 100644

--- a/CHANGELOG.md

+++ b/CHANGELOG.md

@@ -4,6 +4,19 @@ All notable changes to `openvibe-contracts`. Releases are git tags (`vX.Y.Z`) th

from `https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/<tag>`. Before v0.30.0,

the notes were in the tag and commit messages (`git tag -n1`).

+## 0.177.0 — 2026-10-15

+- **Project secrets (ADR-056).** OpenVibe.Network keeps secrets per project and environment, written once and used by

+ name: no API returns a value to a person.

+ - `network.project-secret@1`: what members and staff see (name, environment, version, a keyed fingerprint, grants,

+ who set it and when).

+ - `network.secret.use` (first-party, `POST /internal/secrets/use`): a service the project granted a secret to either

+ signs a message with it (`sign`, HMAC-SHA256; the value never leaves Network) or receives the value for an https

+ origin the grant lists (`reveal`). `network.secret-use-request@1` and `network.secret-use-result@1` refuse a sign

+ without a message, a reveal without an origin, and either one mixed with the other's field.

+ - Listed in Network's manifest. Fixtures: valid signing and reveal grants, sign and reveal requests and results;

+ invalid a secret with its value, an upper-case name, an http origin, and mixed or missing fields.

## 0.176.1 — 2026-10-15

- **`media.object.s3`** lists CopyObject and UploadPartCopy (Media#113): server-side copies within the key's environment,

diff --git a/contracts/catalog.json b/contracts/catalog.json

index eae7a28e..548b8fda 100644

--- a/contracts/catalog.json

+++ b/contracts/catalog.json

@@ -2883,6 +2883,36 @@

"status": "active",

"adr": "ADR-014"

+ {

+ "id": "network.project-secret",

+ "version": "1.0.0",

+ "owner": "network",

+ "schema": "network/project-secret.v1.json",

+ "visibility": "first-party",

+ "compatibility": "backward",

+ "status": "active",

+ "adr": "ADR-056"

+ },

+ {

+ "id": "network.secret-use-request",

+ "version": "1.0.0",

+ "owner": "network",

+ "schema": "network/secret-use-request.v1.json",

+ "visibility": "first-party",

+ "compatibility": "backward",

+ "status": "active",

+ "adr": "ADR-056"

+ },

+ {

+ "id": "network.secret-use-result",

+ "version": "1.0.0",

+ "owner": "network",

+ "schema": "network/secret-use-result.v1.json",

+ "visibility": "first-party",

+ "compatibility": "backward",

+ "status": "active",

+ "adr": "ADR-056"

+ },

{

"id": "network.status-incident",

"version": "1.0.0",

diff --git a/contracts/network/project-secret.v1.json b/contracts/network/project-secret.v1.json

new file mode 100644

index 00000000..7a815aeb

--- /dev/null

+++ b/contracts/network/project-secret.v1.json

@@ -0,0 +1,37 @@

+ "$schema": "https://json-schema.org/draft/2020-12/schema",

+ "$id": "https://openvibe.network/contracts/network/project-secret.v1.json",

+ "title": "ProjectSecret",

+ "description": "network.project-secret@1 (ADR-056): one project secret as OpenVibe.Network shows it to the project's members and staff — its name, environment, version, a keyed fingerprint and its grants. Never the value: a secret is written once and used by name (sign or reveal through network.secret.use).",

+ "type": "object",

+ "required": ["project_id", "environment", "name", "version", "fingerprint", "grants", "created_at", "created_by", "updated_at", "updated_by"],

+ "additionalProperties": false,

+ "$defs": {

+ "subject": { "type": "string", "pattern": "^usr_[0-9A-HJKMNP-TV-Z]{26}$" },

+ "grant": {

+ "type": "object",

+ "required": ["service", "purposes", "origins", "created_at", "created_by", "last_used_at"],

+ "additionalProperties": false,

+ "properties": {

+ "service": { "type": "string", "pattern": "^[a-z][a-z0-9-]{1,39}$", "description": "The service id the secret is granted to (its token's svc:<id>)." },

+ "purposes": { "type": "array", "minItems": 1, "maxItems": 2, "uniqueItems": true, "items": { "enum": ["sign", "reveal"] } },

+ "origins": { "type": "array", "maxItems": 10, "uniqueItems": true, "items": { "type": "string", "pattern": "^https://[a-z0-9.-]+(:[0-9]{1,5})?$" }, "description": "The https origins the value may be revealed for (reveal only; empty for sign)." },

+ "created_at": { "type": "string", "format": "date-time" },

+ "created_by": { "$ref": "#/$defs/subject" },

+ "last_used_at": { "type": ["string", "null"], "format": "date-time" }

+ }

+ },

+ "properties": {

+ "project_id": { "type": "string", "pattern": "^prj_[0-9A-HJKMNP-TV-Z]{26}$" },

+ "environment": { "enum": ["sandbox", "production"] },

+ "name": { "type": "string", "pattern": "^[a-z][a-z0-9_-]{0,63}$" },

+ "version": { "type": "integer", "minimum": 1, "description": "One more each time the value is set again." },

+ "fingerprint": { "type": "string", "pattern": "^[0-9a-f]{12}$", "description": "A keyed hash of the value: equal values have equal fingerprints, and it reveals nothing else." },

+ "grants": { "type": "array", "maxItems": 20, "items": { "$ref": "#/$defs/grant" } },

+ "created_at": { "type": "string", "format": "date-time" },

+ "created_by": { "$ref": "#/$defs/subject" },

+ "updated_at": { "type": "string", "format": "date-time" },

+ "updated_by": { "$ref": "#/$defs/subject" }

+ }

diff --git a/contracts/network/secret-use-request.v1.json b/contracts/network/secret-use-request.v1.json

new file mode 100644

index 00000000..95ddba0f

--- /dev/null

+++ b/contracts/network/secret-use-request.v1.json

@@ -0,0 +1,21 @@

+ "$schema": "https://json-schema.org/draft/2020-12/schema",

+ "$id": "https://openvibe.network/contracts/network/secret-use-request.v1.json",

+ "title": "SecretUseRequest",

+ "description": "network.secret-use-request@1 (ADR-056): what a first-party service sends to POST /internal/secrets/use with network.secret.use. sign asks for HMAC-SHA256 of message under the secret (the value never leaves Network); reveal asks for the value, to send to origin. Either needs a grant of that secret to the calling service for that purpose (and origin).",

+ "type": "object",

+ "required": ["project_id", "environment", "name", "purpose"],

+ "additionalProperties": false,

+ "properties": {

+ "project_id": { "type": "string", "pattern": "^prj_[0-9A-HJKMNP-TV-Z]{26}$" },

+ "environment": { "enum": ["sandbox", "production"] },

+ "name": { "type": "string", "pattern": "^[a-z][a-z0-9_-]{0,63}$" },

+ "purpose": { "enum": ["sign", "reveal"] },

+ "message": { "type": "string", "maxLength": 1048576, "description": "sign: the exact text to sign (for a webhook delivery, \"<timestamp>.<raw body>\"). Not allowed with reveal." },

+ "origin": { "type": "string", "pattern": "^https://[a-z0-9.-]+(:[0-9]{1,5})?$", "description": "reveal: the https origin the value will be sent to; the grant must list it. Not allowed with sign." }

+ },

+ "allOf": [

+ { "if": { "properties": { "purpose": { "const": "sign" } } }, "then": { "required": ["message"], "not": { "required": ["origin"] } } },

+ { "if": { "properties": { "purpose": { "const": "reveal" } } }, "then": { "required": ["origin"], "not": { "required": ["message"] } } }

+ ]

diff --git a/contracts/network/secret-use-result.v1.json b/contracts/network/secret-use-result.v1.json

new file mode 100644

index 00000000..f5949006

--- /dev/null

+++ b/contracts/network/secret-use-result.v1.json

@@ -0,0 +1,20 @@

+ "$schema": "https://json-schema.org/draft/2020-12/schema",

+ "$id": "https://openvibe.network/contracts/network/secret-use-result.v1.json",

+ "title": "SecretUseResult",

+ "description": "network.secret-use-result@1 (ADR-056): POST /internal/secrets/use's answer — the secret's name and version with the HMAC-SHA256 signature (sign) or the value (reveal). Sent with Cache-Control: no-store; a caller keeps a revealed value only as long as the request it is for.",

+ "type": "object",

+ "required": ["name", "version", "purpose"],

+ "additionalProperties": false,

+ "properties": {

+ "name": { "type": "string", "pattern": "^[a-z][a-z0-9_-]{0,63}$" },

+ "version": { "type": "integer", "minimum": 1 },

+ "purpose": { "enum": ["sign", "reveal"] },

+ "signature": { "type": "string", "pattern": "^[0-9a-f]{64}$", "description": "sign: the lowercase hex HMAC-SHA256 of the message under the secret." },

+ "value": { "type": "string", "minLength": 1, "maxLength": 8192, "description": "reveal: the value." }

+ },

+ "allOf": [

+ { "if": { "properties": { "purpose": { "const": "sign" } } }, "then": { "required": ["signature"], "not": { "required": ["value"] } } },

+ { "if": { "properties": { "purpose": { "const": "reveal" } } }, "then": { "required": ["value"], "not": { "required": ["signature"] } } }

+ ]

diff --git a/docs/adr/ADR-056-project-secrets.md b/docs/adr/ADR-056-project-secrets.md

new file mode 100644

index 00000000..869f870d

--- /dev/null

+++ b/docs/adr/ADR-056-project-secrets.md

@@ -0,0 +1,52 @@

+# ADR-056: Project secrets — written once, used by name, never read back

+**Status:** Accepted 2026-10-15 (plan T13/T17: the "project secret store" that `secret_ref` waits on). Amends ADR-014

+(Network owns projects and credentials) with one more thing a project holds, and ADR-044 §7 (Actor webhooks name a

+project secret by `secret_ref`).

+## Context

+- Services that act for a project need secrets the project's people choose: the key that signs Actor's webhook

+ deliveries to their server (ADR-044 names `secret_ref` for it), a token Watch sends when it checks their private API,

+ the password of their ONVIF camera (ADR-043).

+- Today each of these is an operator's environment variable with a hand-written grant (Watch's `WATCH_SECRET_GRANTS`,

+ Bot's `BOT_ONVIF_CAMERAS` references) or a value the service makes and shows once (Actor's per-task

+ `webhook_secret`). A project cannot bring its own, and nothing is managed in one place.

+- Network already owns what a project is, who its members are, its credentials and its audit (ADR-014).

+## Decision

+1. **Network keeps project secrets**, per project and environment (`sandbox`, `production`), each under a name

+ (`^[a-z][a-z0-9_-]{0,63}$`). A value is 1 to 8192 bytes of UTF-8, at most 50 secrets per project environment.

+2. **Write-only.** A project admin or owner sets a value (`PUT /api/v1/projects/:project/secrets/:env/:name`); setting it

+ again replaces it and adds one to its `version`. No API returns a value to a person, staff included. Members

+ (viewer and up) and staff read the metadata only: name, environment, version, a fingerprint, the grants, who set it

+ and when (`network.project-secret@1`). The fingerprint is a keyed hash, so it tells two values apart without

+ revealing either.

+3. **Encrypted at rest** with AES-256-GCM under a key held only in Network's environment (`NETWORK_SECRETS_KEY`, 32 random

+ bytes). Each row carries its key id, so the key can be rotated. Without the key the feature is off (503

+ `secrets.unavailable`), never plaintext.

+4. **A name is not a capability.** A service uses a secret only when the project granted that secret to that service:

+ `PUT …/:name/grants/:service { purposes, origins }`, admin or owner. There are two purposes:

+ - `sign`: Network computes HMAC-SHA256 of a message under the secret and answers the signature. The value never

+ leaves Network. This is how webhook deliveries are signed.

+ - `reveal`: Network answers the value, only to the granted service and only for an `origin` the grant lists (an

+ https origin the service will send it to). This is for credentials another system must receive as they are.

+5. **One first-party capability, `network.secret.use`**, on `POST /internal/secrets/use`

+ (`network.secret-use-request@1` → `network.secret-use-result@1`). The caller is the service in its token

+ (`svc:<id>`). A missing secret, a missing grant, a purpose or origin the grant does not list, and an archived project

+ all answer 404 `secret.not_found`, so a guess learns nothing.

+6. **Audit.** Every value set, deletion and grant change is a `dev_audit` row, and so is the first use of each secret per

+ service, purpose and UTC day. A grant records when it was last used. Values and messages are never written anywhere

+ but the encrypted column.

+7. **A project archived is crypto-shredded:** its secrets' ciphertexts are deleted when it is archived, and its metadata

+ stays in its audit.

+## Consequences

+- Actor's `secret_ref` names a secret in the task's project, granted to `actor` for `sign`. Watch, Bot and others follow

+ the same rule, and their operator-held grants become unnecessary for project resources.

+- The Services console shows and edits secrets through these routes with the person's own token, as it does apps and

+ grants. Services stores nothing.

+- A person without a project has no secret store. Personal resources keep their service's own secrets (Actor's per-task

+ webhook secret).

diff --git a/docs/adr/README.md b/docs/adr/README.md

index 0cca8d04..86c3e334 100644

--- a/docs/adr/README.md

+++ b/docs/adr/README.md

@@ -49,3 +49,4 @@ Platform-wide decisions from the OpenVibe development roadmap (section 10). Each

| [ADR-053](ADR-053-website-host-boundary.md) | The Website/Host boundary: OpenVibe.Website owns authoring (projects, pages, revisions, builds, Media asset pointers and intended domains) and OpenVibe.Host owns site, deploy, activation, domain binding/verification/TLS and serving; Website keeps no duplicate `host_sites`/`host_deploys` rows and calls Host's routes; a Website build is not a Host deploy; Website composes Host + Codes + Actor + Run + Media and is not OpenVibe.Sites | Proposed 2026-10-05 (plan T19), for the owner's review |

| [ADR-054](ADR-054-inventory-authority.md) | The OpenVibe inventory: a new authority, OpenVibe.Inventory (`inventory`, `ov_inventory`), owns item kinds (contract + renderer per surface), definitions (`itd_`), instances (`inv_`), the equipped set and an append-only ledger; issuers grant within their namespace; no selling, buying, trading or conversion until a later money ADR (ADR-012/ADR-025); Live's cosmetics are the first kinds, migrated convert-verify-delete | Accepted 2026-10-09 (plan T21) |

| [ADR-055](ADR-055-inventory-money.md) | Money and the inventory, in phases: A primary sales (an issuer prices an item in Vibes, booked by Billing as an ENTITLEMENT with a creator share, or in OpenCoins as a loyalty shop with no payout); B gifting between people for giftable items (an ADR-012 rule 6 amendment); C trading and a market stay closed (ADR-025); never paid chance (no cases, crates, loot boxes) | Proposed 2026-10-09 (plan T21), for the owner's decision |

+| [ADR-056](ADR-056-project-secrets.md) | Project secrets: OpenVibe.Network keeps them per project and environment, write-only (no API returns a value to a person), AES-256-GCM under `NETWORK_SECRETS_KEY`; a service uses one only when the project granted it, to `sign` (HMAC, the value never leaves Network) or to `reveal` it for a listed https origin, through first-party `network.secret.use`; archiving a project shreds its secrets | Accepted 2026-10-15 (plan T13/T17) |

diff --git a/fixtures/network.project-secret/invalid/http-origin.json b/fixtures/network.project-secret/invalid/http-origin.json

new file mode 100644

index 00000000..c4e87f40

--- /dev/null

+++ b/fixtures/network.project-secret/invalid/http-origin.json

@@ -0,0 +1,25 @@

+ "project_id": "prj_01M4XE52PGJDVR1KZ1AG9VYW3Q",

+ "environment": "production",

+ "name": "webhook-signing",

+ "version": 2,

+ "fingerprint": "3fa9c1d0be72",

+ "grants": [

+ {

+ "service": "watch",

+ "purposes": [

+ "reveal"

+ ],

+ "origins": [

+ "http://api.example.com"

+ ],

+ "created_at": "2026-10-15T05:00:00Z",

+ "created_by": "usr_01M3JCFXCJZ2NS0732AKPCVVHR",

+ "last_used_at": null

+ }

+ ],

+ "created_at": "2026-10-15T04:58:00Z",

+ "created_by": "usr_01M3JCFXCJZ2NS0732AKPCVVHR",

+ "updated_at": "2026-10-15T05:10:00Z",

+ "updated_by": "usr_01M3JCFXCJZ2NS0732AKPCVVHR"

diff --git a/fixtures/network.project-secret/invalid/upper-name.json b/fixtures/network.project-secret/invalid/upper-name.json

new file mode 100644

index 00000000..a8e0a057

--- /dev/null

+++ b/fixtures/network.project-secret/invalid/upper-name.json

@@ -0,0 +1,23 @@

+ "project_id": "prj_01M4XE52PGJDVR1KZ1AG9VYW3Q",

+ "environment": "production",

+ "name": "Webhook",

+ "version": 2,

+ "fingerprint": "3fa9c1d0be72",

+ "grants": [

+ {

+ "service": "actor",

+ "purposes": [

+ "sign"

+ ],

+ "origins": [],

+ "created_at": "2026-10-15T05:00:00Z",

+ "created_by": "usr_01M3JCFXCJZ2NS0732AKPCVVHR",

+ "last_used_at": null

+ }

+ ],

+ "created_at": "2026-10-15T04:58:00Z",

+ "created_by": "usr_01M3JCFXCJZ2NS0732AKPCVVHR",

+ "updated_at": "2026-10-15T05:10:00Z",

+ "updated_by": "usr_01M3JCFXCJZ2NS0732AKPCVVHR"

diff --git a/fixtures/network.project-secret/invalid/with-value.json b/fixtures/network.project-secret/invalid/with-value.json

new file mode 100644

index 00000000..71440939

--- /dev/null

+++ b/fixtures/network.project-secret/invalid/with-value.json

@@ -0,0 +1,24 @@

+ "project_id": "prj_01M4XE52PGJDVR1KZ1AG9VYW3Q",

+ "environment": "production",

+ "name": "webhook-signing",

+ "version": 2,

+ "fingerprint": "3fa9c1d0be72",

+ "grants": [

+ {

+ "service": "actor",

+ "purposes": [

+ "sign"

+ ],

+ "origins": [],

+ "created_at": "2026-10-15T05:00:00Z",

+ "created_by": "usr_01M3JCFXCJZ2NS0732AKPCVVHR",

+ "last_used_at": null

+ }

+ ],

+ "created_at": "2026-10-15T04:58:00Z",

+ "created_by": "usr_01M3JCFXCJZ2NS0732AKPCVVHR",

+ "updated_at": "2026-10-15T05:10:00Z",

+ "updated_by": "usr_01M3JCFXCJZ2NS0732AKPCVVHR",

+ "value": "hunter2"

diff --git a/fixtures/network.project-secret/valid/reveal-grant.json b/fixtures/network.project-secret/valid/reveal-grant.json

new file mode 100644

index 00000000..4f920748

--- /dev/null

+++ b/fixtures/network.project-secret/valid/reveal-grant.json

@@ -0,0 +1,25 @@

+ "project_id": "prj_01M4XE52PGJDVR1KZ1AG9VYW3Q",

+ "environment": "production",

+ "name": "api_token",

+ "version": 1,

+ "fingerprint": "3fa9c1d0be72",

+ "grants": [

+ {

+ "service": "watch",

+ "purposes": [

+ "reveal"

+ ],

+ "origins": [

+ "https://api.example.com"

+ ],

+ "created_at": "2026-10-15T05:00:00Z",

+ "created_by": "usr_01M3JCFXCJZ2NS0732AKPCVVHR",

+ "last_used_at": "2026-10-15T05:30:00Z"

+ }

+ ],

+ "created_at": "2026-10-15T04:58:00Z",

+ "created_by": "usr_01M3JCFXCJZ2NS0732AKPCVVHR",

+ "updated_at": "2026-10-15T05:10:00Z",

+ "updated_by": "usr_01M3JCFXCJZ2NS0732AKPCVVHR"

diff --git a/fixtures/network.project-secret/valid/signing-key.json b/fixtures/network.project-secret/valid/signing-key.json

new file mode 100644

index 00000000..bfca322c

--- /dev/null

+++ b/fixtures/network.project-secret/valid/signing-key.json

@@ -0,0 +1,23 @@

+ "project_id": "prj_01M4XE52PGJDVR1KZ1AG9VYW3Q",

+ "environment": "production",

+ "name": "webhook-signing",

+ "version": 2,

+ "fingerprint": "3fa9c1d0be72",

+ "grants": [

+ {

+ "service": "actor",

+ "purposes": [

+ "sign"

+ ],

+ "origins": [],

+ "created_at": "2026-10-15T05:00:00Z",

+ "created_by": "usr_01M3JCFXCJZ2NS0732AKPCVVHR",

+ "last_used_at": null

+ }

+ ],

+ "created_at": "2026-10-15T04:58:00Z",

+ "created_by": "usr_01M3JCFXCJZ2NS0732AKPCVVHR",

+ "updated_at": "2026-10-15T05:10:00Z",

+ "updated_by": "usr_01M3JCFXCJZ2NS0732AKPCVVHR"

diff --git a/fixtures/network.secret-use-request/invalid/reveal-with-message.json b/fixtures/network.secret-use-request/invalid/reveal-with-message.json

new file mode 100644

index 00000000..9f4fd488

--- /dev/null

+++ b/fixtures/network.secret-use-request/invalid/reveal-with-message.json

@@ -0,0 +1,8 @@

+ "project_id": "prj_01M4XE52PGJDVR1KZ1AG9VYW3Q",

+ "environment": "production",

+ "name": "api_token",

+ "purpose": "reveal",

+ "origin": "https://api.example.com",

+ "message": "x"

diff --git a/fixtures/network.secret-use-request/invalid/reveal-without-origin.json b/fixtures/network.secret-use-request/invalid/reveal-without-origin.json

new file mode 100644

index 00000000..d10a3bcf

--- /dev/null

+++ b/fixtures/network.secret-use-request/invalid/reveal-without-origin.json

@@ -0,0 +1,6 @@

+ "project_id": "prj_01M4XE52PGJDVR1KZ1AG9VYW3Q",

+ "environment": "production",

+ "name": "api_token",

+ "purpose": "reveal"

diff --git a/fixtures/network.secret-use-request/invalid/sign-without-message.json b/fixtures/network.secret-use-request/invalid/sign-without-message.json

new file mode 100644

index 00000000..f35b67a3

--- /dev/null

+++ b/fixtures/network.secret-use-request/invalid/sign-without-message.json

@@ -0,0 +1,6 @@

+ "project_id": "prj_01M4XE52PGJDVR1KZ1AG9VYW3Q",

+ "environment": "production",

+ "name": "webhook-signing",

+ "purpose": "sign"

diff --git a/fixtures/network.secret-use-request/valid/reveal.json b/fixtures/network.secret-use-request/valid/reveal.json

new file mode 100644

index 00000000..4f887753

--- /dev/null

+++ b/fixtures/network.secret-use-request/valid/reveal.json

@@ -0,0 +1,7 @@

+ "project_id": "prj_01M4XE52PGJDVR1KZ1AG9VYW3Q",

+ "environment": "sandbox",

+ "name": "api_token",

+ "purpose": "reveal",

+ "origin": "https://api.example.com"

diff --git a/fixtures/network.secret-use-request/valid/sign.json b/fixtures/network.secret-use-request/valid/sign.json

new file mode 100644

index 00000000..c49913f5

--- /dev/null

+++ b/fixtures/network.secret-use-request/valid/sign.json

@@ -0,0 +1,7 @@

+ "project_id": "prj_01M4XE52PGJDVR1KZ1AG9VYW3Q",

+ "environment": "production",

+ "name": "webhook-signing",

+ "purpose": "sign",

+ "message": "1760504400.{\"state\":\"succeeded\"}"

diff --git a/fixtures/network.secret-use-result/invalid/short-signature.json b/fixtures/network.secret-use-result/invalid/short-signature.json

new file mode 100644

index 00000000..2ec2892c

--- /dev/null

+++ b/fixtures/network.secret-use-result/invalid/short-signature.json

@@ -0,0 +1,6 @@

+ "name": "webhook-signing",

+ "version": 2,

+ "purpose": "sign",

+ "signature": "abc"

diff --git a/fixtures/network.secret-use-result/invalid/sign-with-value.json b/fixtures/network.secret-use-result/invalid/sign-with-value.json

new file mode 100644

index 00000000..185fe444

--- /dev/null

+++ b/fixtures/network.secret-use-result/invalid/sign-with-value.json

@@ -0,0 +1,7 @@

+ "name": "webhook-signing",

+ "version": 2,

+ "purpose": "sign",

+ "signature": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",

+ "value": "x"

diff --git a/fixtures/network.secret-use-result/valid/signature.json b/fixtures/network.secret-use-result/valid/signature.json

new file mode 100644

index 00000000..97a9d8b9

--- /dev/null

+++ b/fixtures/network.secret-use-result/valid/signature.json

@@ -0,0 +1,6 @@

+ "name": "webhook-signing",

+ "version": 2,

+ "purpose": "sign",

+ "signature": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"

diff --git a/fixtures/network.secret-use-result/valid/value.json b/fixtures/network.secret-use-result/valid/value.json

new file mode 100644

index 00000000..8063eb38

--- /dev/null

+++ b/fixtures/network.secret-use-result/valid/value.json

@@ -0,0 +1,6 @@

+ "name": "api_token",

+ "version": 1,

+ "purpose": "reveal",

+ "value": "kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk"

diff --git a/generated/json-schema/bundle.json b/generated/json-schema/bundle.json

index 2173136a..d01031af 100644

--- a/generated/json-schema/bundle.json

+++ b/generated/json-schema/bundle.json

@@ -29865,6 +29865,315 @@

}

+ "network.project-secret": {

+ "version": "1.0.0",

+ "owner": "network",

+ "status": "active",

+ "schema": {

+ "$schema": "https://json-schema.org/draft/2020-12/schema",

+ "$id": "https://openvibe.network/contracts/network/project-secret.v1.json",

+ "title": "ProjectSecret",

+ "type": "object",

+ "required": [

+ "project_id",

+ "environment",

+ "name",

+ "version",

+ "fingerprint",

+ "grants",

+ "created_at",

+ "created_by",

+ "updated_at",

+ "updated_by"

+ ],

+ "additionalProperties": false,

+ "$defs": {

+ "subject": {

+ "type": "string",

+ "pattern": "^usr_[0-9A-HJKMNP-TV-Z]{26}$"

+ },

+ "grant": {

+ "type": "object",

+ "required": [

+ "service",

+ "purposes",

+ "origins",

+ "created_at",

+ "created_by",

+ "last_used_at"

+ ],

+ "additionalProperties": false,

+ "properties": {

+ "service": {

+ "type": "string",

+ "pattern": "^[a-z][a-z0-9-]{1,39}$",

+ "description": "The service id the secret is granted to (its token's svc:<id>)."

+ },

+ "purposes": {

+ "type": "array",

+ "minItems": 1,

+ "maxItems": 2,

+ "uniqueItems": true,

+ "items": {

+ "enum": [

+ "sign",

+ "reveal"

+ ]

+ }

+ },

+ "origins": {

+ "type": "array",

+ "maxItems": 10,

+ "uniqueItems": true,

+ "items": {

+ "type": "string",

+ "pattern": "^https://[a-z0-9.-]+(:[0-9]{1,5})?$"

+ },

+ "description": "The https origins the value may be revealed for (reveal only; empty for sign)."

+ },

+ "created_at": {

+ "type": "string",

+ "format": "date-time"

+ },

+ "created_by": {

+ "$ref": "#/$defs/subject"

+ },

+ "last_used_at": {

+ "type": [

+ "string",

+ "null"

+ ],

+ "format": "date-time"

+ }

+ },

+ "properties": {

+ "project_id": {

+ "type": "string",

+ "pattern": "^prj_[0-9A-HJKMNP-TV-Z]{26}$"

+ },

+ "environment": {

+ "enum": [

+ "sandbox",

+ "production"

+ ]

+ },

+ "name": {

+ "type": "string",

+ "pattern": "^[a-z][a-z0-9_-]{0,63}$"

+ },

+ "version": {

+ "type": "integer",

+ "minimum": 1,

+ "description": "One more each time the value is set again."

+ },

+ "fingerprint": {

+ "type": "string",

+ "pattern": "^[0-9a-f]{12}$",

+ "description": "A keyed hash of the value: equal values have equal fingerprints, and it reveals nothing else."

+ },

+ "grants": {

+ "type": "array",

+ "maxItems": 20,

+ "items": {

+ "$ref": "#/$defs/grant"

+ }

+ },

+ "created_at": {

+ "type": "string",

+ "format": "date-time"

+ },

+ "created_by": {

+ "$ref": "#/$defs/subject"

+ },

+ "updated_at": {

+ "type": "string",

+ "format": "date-time"

+ },

+ "updated_by": {

+ "$ref": "#/$defs/subject"

+ }

+ },

+ "network.secret-use-request": {

+ "version": "1.0.0",

+ "owner": "network",

+ "status": "active",

+ "schema": {

+ "$schema": "https://json-schema.org/draft/2020-12/schema",

+ "$id": "https://openvibe.network/contracts/network/secret-use-request.v1.json",

+ "title": "SecretUseRequest",

+ "type": "object",

+ "required": [

+ "project_id",

+ "environment",

+ "name",

+ "purpose"

+ ],

+ "additionalProperties": false,

+ "properties": {

+ "project_id": {

+ "type": "string",

+ "pattern": "^prj_[0-9A-HJKMNP-TV-Z]{26}$"

+ },

+ "environment": {

+ "enum": [

+ "sandbox",

+ "production"

+ ]

+ },

+ "name": {

+ "type": "string",

+ "pattern": "^[a-z][a-z0-9_-]{0,63}$"

+ },

+ "purpose": {

+ "enum": [

+ "sign",

+ "reveal"

+ ]

+ },

+ "message": {

+ "type": "string",

+ "maxLength": 1048576,

+ "description": "sign: the exact text to sign (for a webhook delivery, \"<timestamp>.<raw body>\"). Not allowed with reveal."

+ },

+ "origin": {

+ "type": "string",

+ "pattern": "^https://[a-z0-9.-]+(:[0-9]{1,5})?$",

+ "description": "reveal: the https origin the value will be sent to; the grant must list it. Not allowed with sign."

+ }

+ },

+ "allOf": [

+ {

+ "if": {

+ "properties": {

+ "purpose": {

+ "const": "sign"

+ }

+ },

+ "then": {

+ "required": [

+ "message"

+ ],

+ "not": {

+ "required": [

+ "origin"

+ ]

+ }

+ },

+ {

+ "if": {

+ "properties": {

+ "purpose": {

+ "const": "reveal"

+ }

+ },

+ "then": {

+ "required": [

+ "origin"

+ ],

+ "not": {

+ "required": [

+ "message"

+ ]

+ }

+ ]

+ }

+ },

+ "network.secret-use-result": {

+ "version": "1.0.0",

+ "owner": "network",

+ "status": "active",

+ "schema": {

+ "$schema": "https://json-schema.org/draft/2020-12/schema",

+ "$id": "https://openvibe.network/contracts/network/secret-use-result.v1.json",

+ "title": "SecretUseResult",

+ "type": "object",

+ "required": [

+ "name",

+ "version",

+ "purpose"

+ ],

+ "additionalProperties": false,

+ "properties": {

+ "name": {

+ "type": "string",

+ "pattern": "^[a-z][a-z0-9_-]{0,63}$"

+ },

+ "version": {

+ "type": "integer",

+ "minimum": 1

+ },

+ "purpose": {

+ "enum": [

+ "sign",

+ "reveal"

+ ]

+ },

+ "signature": {

+ "type": "string",

+ "pattern": "^[0-9a-f]{64}$",

+ "description": "sign: the lowercase hex HMAC-SHA256 of the message under the secret."

+ },

+ "value": {

+ "type": "string",

+ "minLength": 1,

+ "maxLength": 8192,

+ "description": "reveal: the value."

+ }

+ },

+ "allOf": [

+ {

+ "if": {

+ "properties": {

+ "purpose": {

+ "const": "sign"

+ }

+ },

+ "then": {

+ "required": [

+ "signature"

+ ],

+ "not": {

+ "required": [

+ "value"

+ ]

+ }

+ },

+ {

+ "if": {

+ "properties": {

+ "purpose": {

+ "const": "reveal"

+ }

+ },

+ "then": {

+ "required": [

+ "value"

+ ],

+ "not": {

+ "required": [

+ "signature"

+ ]

+ }

+ ]

+ }

+ },

"network.status-incident": {

"version": "1.0.0",

"owner": "network",

diff --git a/generated/openapi/actor.json b/generated/openapi/actor.json

index 33fb558c..2384ffbc 100644

--- a/generated/openapi/actor.json

+++ b/generated/openapi/actor.json

@@ -3,8 +3,8 @@

"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",

"info": {

"title": "OpenVibe.Actor API",

- "version": "0.176.1",

- "description": "Routes of OpenVibe.Actor as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

+ "version": "0.177.0",

+ "description": "Routes of OpenVibe.Actor as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

"license": {

"name": "MIT",

"identifier": "MIT"

diff --git a/generated/openapi/ai.json b/generated/openapi/ai.json

index c3b23323..e967b8a8 100644

--- a/generated/openapi/ai.json

+++ b/generated/openapi/ai.json

@@ -3,8 +3,8 @@

"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",

"info": {

"title": "OpenVibe.AI API",

- "version": "0.176.1",

- "description": "Routes of OpenVibe.AI as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

+ "version": "0.177.0",

+ "description": "Routes of OpenVibe.AI as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

"license": {

"name": "MIT",

"identifier": "MIT"

diff --git a/generated/openapi/billing.json b/generated/openapi/billing.json

index d4082f13..1b935da3 100644

--- a/generated/openapi/billing.json

+++ b/generated/openapi/billing.json

@@ -3,8 +3,8 @@

"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",

"info": {

"title": "OpenVibe.Billing API",

- "version": "0.176.1",

- "description": "Routes of OpenVibe.Billing as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

+ "version": "0.177.0",

+ "description": "Routes of OpenVibe.Billing as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

"license": {

"name": "MIT",

"identifier": "MIT"

diff --git a/generated/openapi/blog.json b/generated/openapi/blog.json

index ac89d479..e85f737e 100644

--- a/generated/openapi/blog.json

+++ b/generated/openapi/blog.json

@@ -3,8 +3,8 @@

"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",

"info": {

"title": "OpenVibe.Blog API",

- "version": "0.176.1",

- "description": "Routes of OpenVibe.Blog as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

+ "version": "0.177.0",

+ "description": "Routes of OpenVibe.Blog as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

"license": {

"name": "MIT",

"identifier": "MIT"

diff --git a/generated/openapi/bot.json b/generated/openapi/bot.json

index 60896f3c..8fe51461 100644

--- a/generated/openapi/bot.json

+++ b/generated/openapi/bot.json

@@ -3,8 +3,8 @@

"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",

"info": {

"title": "OpenVibe.Bot API",

- "version": "0.176.1",

- "description": "Routes of OpenVibe.Bot as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

+ "version": "0.177.0",

+ "description": "Routes of OpenVibe.Bot as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

"license": {

"name": "MIT",

"identifier": "MIT"

diff --git a/generated/openapi/chat.json b/generated/openapi/chat.json

index c2ba3d1a..3e512a28 100644

--- a/generated/openapi/chat.json

+++ b/generated/openapi/chat.json

@@ -3,8 +3,8 @@

"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",

"info": {

"title": "OpenVibe.Chat API",

- "version": "0.176.1",

- "description": "Routes of OpenVibe.Chat as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

+ "version": "0.177.0",

+ "description": "Routes of OpenVibe.Chat as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

"license": {

"name": "MIT",

"identifier": "MIT"

diff --git a/generated/openapi/codes.json b/generated/openapi/codes.json

index 02c01808..8a2080bd 100644

--- a/generated/openapi/codes.json

+++ b/generated/openapi/codes.json

@@ -3,8 +3,8 @@

"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",

"info": {

"title": "OpenVibe.Codes API",

- "version": "0.176.1",

- "description": "Routes of OpenVibe.Codes as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

+ "version": "0.177.0",

+ "description": "Routes of OpenVibe.Codes as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

"license": {

"name": "MIT",

"identifier": "MIT"

diff --git a/generated/openapi/community.json b/generated/openapi/community.json

index 3c9d2e96..911d5af2 100644

--- a/generated/openapi/community.json

+++ b/generated/openapi/community.json

@@ -3,8 +3,8 @@

"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",

"info": {

"title": "OpenVibe.Community API",

- "version": "0.176.1",

- "description": "Routes of OpenVibe.Community as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

+ "version": "0.177.0",

+ "description": "Routes of OpenVibe.Community as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

"license": {

"name": "MIT",

"identifier": "MIT"

diff --git a/generated/openapi/coupons.json b/generated/openapi/coupons.json

index 5c6fe371..c7a51c11 100644

--- a/generated/openapi/coupons.json

+++ b/generated/openapi/coupons.json

@@ -3,8 +3,8 @@

"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",

"info": {

"title": "OpenVibe.Coupons API",

- "version": "0.176.1",

- "description": "Routes of OpenVibe.Coupons as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

+ "version": "0.177.0",

+ "description": "Routes of OpenVibe.Coupons as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

"license": {

"name": "MIT",

"identifier": "MIT"

diff --git a/generated/openapi/deals.json b/generated/openapi/deals.json

index e060ac58..35208db1 100644

--- a/generated/openapi/deals.json

+++ b/generated/openapi/deals.json

@@ -3,8 +3,8 @@

"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",

"info": {

"title": "OpenVibe.Deals API",

- "version": "0.176.1",

- "description": "Routes of OpenVibe.Deals as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

+ "version": "0.177.0",

+ "description": "Routes of OpenVibe.Deals as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

"license": {

"name": "MIT",

"identifier": "MIT"

diff --git a/generated/openapi/events.json b/generated/openapi/events.json

index 3fa92f18..42486092 100644

--- a/generated/openapi/events.json

+++ b/generated/openapi/events.json

@@ -3,8 +3,8 @@

"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",

"info": {

"title": "OpenVibe.Events API",

- "version": "0.176.1",

- "description": "Routes of OpenVibe.Events as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

+ "version": "0.177.0",

+ "description": "Routes of OpenVibe.Events as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

"license": {

"name": "MIT",

"identifier": "MIT"

diff --git a/generated/openapi/food.json b/generated/openapi/food.json

index 86ee3a65..f4cfbe46 100644

--- a/generated/openapi/food.json

+++ b/generated/openapi/food.json

@@ -3,8 +3,8 @@

"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",

"info": {

"title": "OpenVibe.Food API",

- "version": "0.176.1",

- "description": "Routes of OpenVibe.Food as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

+ "version": "0.177.0",

+ "description": "Routes of OpenVibe.Food as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

"license": {

"name": "MIT",

"identifier": "MIT"

diff --git a/generated/openapi/games.json b/generated/openapi/games.json

index c652c00d..757ab797 100644

--- a/generated/openapi/games.json

+++ b/generated/openapi/games.json

@@ -3,8 +3,8 @@

"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",

"info": {

"title": "OpenVibe.Games API",

- "version": "0.176.1",

- "description": "Routes of OpenVibe.Games as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

+ "version": "0.177.0",

+ "description": "Routes of OpenVibe.Games as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

"license": {

"name": "MIT",

"identifier": "MIT"

diff --git a/generated/openapi/host.json b/generated/openapi/host.json

index 6d9bf9f8..e4a705af 100644

--- a/generated/openapi/host.json

+++ b/generated/openapi/host.json

@@ -3,8 +3,8 @@

"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",

"info": {

"title": "OpenVibe.Host API",

- "version": "0.176.1",

- "description": "Routes of OpenVibe.Host as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

+ "version": "0.177.0",

+ "description": "Routes of OpenVibe.Host as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

"license": {

"name": "MIT",

"identifier": "MIT"

diff --git a/generated/openapi/index.json b/generated/openapi/index.json

index cca58896..aa657368 100644

--- a/generated/openapi/index.json

+++ b/generated/openapi/index.json

@@ -131,8 +131,8 @@

"service": "network",

"name": "OpenVibe.Network",

"origin": "https://openvibe.network",

- "operations": 40,

- "capabilities": 28

+ "operations": 41,

+ "capabilities": 29

{

"service": "news",

diff --git a/generated/openapi/inventory.json b/generated/openapi/inventory.json

index 915b8690..1be602bd 100644

--- a/generated/openapi/inventory.json

+++ b/generated/openapi/inventory.json

@@ -3,8 +3,8 @@

"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",

"info": {

"title": "OpenVibe.Inventory API",

- "version": "0.176.1",

- "description": "Routes of OpenVibe.Inventory as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

+ "version": "0.177.0",

+ "description": "Routes of OpenVibe.Inventory as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

"license": {

"name": "MIT",

"identifier": "MIT"

diff --git a/generated/openapi/live.json b/generated/openapi/live.json

index af0c5918..3276d589 100644

--- a/generated/openapi/live.json

+++ b/generated/openapi/live.json

@@ -3,8 +3,8 @@

"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",

"info": {

"title": "OpenVibe.Live API",

- "version": "0.176.1",

- "description": "Routes of OpenVibe.Live as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

+ "version": "0.177.0",

+ "description": "Routes of OpenVibe.Live as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

"license": {

"name": "MIT",

"identifier": "MIT"

diff --git a/generated/openapi/media-hub.json b/generated/openapi/media-hub.json

index 863512a4..cacabcfc 100644

--- a/generated/openapi/media-hub.json

+++ b/generated/openapi/media-hub.json

@@ -3,8 +3,8 @@

"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",

"info": {

"title": "OpenVibe.MediaHub API",

- "version": "0.176.1",

- "description": "Routes of OpenVibe.MediaHub as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

+ "version": "0.177.0",

+ "description": "Routes of OpenVibe.MediaHub as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

"license": {

"name": "MIT",

"identifier": "MIT"

diff --git a/generated/openapi/media.json b/generated/openapi/media.json

index 59fb84b2..e2cc4c54 100644

--- a/generated/openapi/media.json

+++ b/generated/openapi/media.json

@@ -3,8 +3,8 @@

"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",

"info": {

"title": "OpenVibe.Media API",

- "version": "0.176.1",

- "description": "Routes of OpenVibe.Media as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

+ "version": "0.177.0",

+ "description": "Routes of OpenVibe.Media as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

"license": {

"name": "MIT",

"identifier": "MIT"

diff --git a/generated/openapi/network.json b/generated/openapi/network.json

index 05b4812c..f0d7f064 100644

--- a/generated/openapi/network.json

+++ b/generated/openapi/network.json

@@ -3,8 +3,8 @@

"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",

"info": {

"title": "OpenVibe.Network API",

- "version": "0.176.1",

- "description": "Routes of OpenVibe.Network as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

+ "version": "0.177.0",

+ "description": "Routes of OpenVibe.Network as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

"license": {

"name": "MIT",

"identifier": "MIT"

@@ -2217,6 +2217,62 @@

}

+ "/internal/secrets/use": {

+ "post": {

+ "operationId": "post_internal_secrets_use",

+ "summary": "Sign with, or reveal, a project secret the project granted to the calling service (ADR-056): sign answers HMAC-SHA256 of a message and never the value; reveal answers the value only for an origin the ",

+ "description": "**network.secret.use** (first-party): Sign with, or reveal, a project secret the project granted to the calling service (ADR-056): sign answers HMAC-SHA256 of a message and never the value; reveal answers the value only for an origin the grant lists.",

+ "tags": [

+ "network.secret"

+ ],

+ "x-openvibe-capabilities": [

+ "network.secret.use"

+ ],

+ "x-openvibe-visibility": [

+ "first-party"

+ ],

+ "x-openvibe-quota-class": "secrets-use",

+ "security": [

+ {

+ "openvibeToken": [

+ "network.secret.use"

+ ]

+ }

+ ],

+ "requestBody": {

+ "required": false,

+ "content": {

+ "application/json": {

+ "schema": {

+ "$ref": "#/components/schemas/network.secret-use-request.v1"

+ }

+ },

+ "responses": {

+ "2XX": {

+ "description": "Success",

+ "content": {

+ "application/json": {

+ "schema": {

+ "$ref": "#/components/schemas/network.secret-use-result.v1"

+ }

+ },

+ "default": {

+ "description": "An error (RFC 9457 problem details)",

+ "content": {

+ "application/problem+json": {

+ "schema": {

+ "$ref": "#/components/schemas/errors.problem.v1"

+ }

+ },

"/internal/url-registry/resolved": {

"get": {

"operationId": "get_internal_url_registry_resolved",

@@ -4540,6 +4596,168 @@

}

+ "network.secret-use-request.v1": {

+ "title": "SecretUseRequest",

+ "type": "object",

+ "required": [

+ "project_id",

+ "environment",

+ "name",

+ "purpose"

+ ],

+ "additionalProperties": false,

+ "properties": {

+ "project_id": {

+ "type": "string",

+ "pattern": "^prj_[0-9A-HJKMNP-TV-Z]{26}$"

+ },

+ "environment": {

+ "enum": [

+ "sandbox",

+ "production"

+ ]

+ },

+ "name": {

+ "type": "string",

+ "pattern": "^[a-z][a-z0-9_-]{0,63}$"

+ },

+ "purpose": {

+ "enum": [

+ "sign",

+ "reveal"

+ ]

+ },

+ "message": {

+ "type": "string",

+ "maxLength": 1048576,

+ "description": "sign: the exact text to sign (for a webhook delivery, \"<timestamp>.<raw body>\"). Not allowed with reveal."

+ },

+ "origin": {

+ "type": "string",

+ "pattern": "^https://[a-z0-9.-]+(:[0-9]{1,5})?$",

+ "description": "reveal: the https origin the value will be sent to; the grant must list it. Not allowed with sign."

+ }

+ },

+ "allOf": [

+ {

+ "if": {

+ "properties": {

+ "purpose": {

+ "const": "sign"

+ }

+ },

+ "then": {

+ "required": [

+ "message"

+ ],

+ "not": {

+ "required": [

+ "origin"

+ ]

+ }

+ },

+ {

+ "if": {

+ "properties": {

+ "purpose": {

+ "const": "reveal"

+ }

+ },

+ "then": {

+ "required": [

+ "origin"

+ ],

+ "not": {

+ "required": [

+ "message"

+ ]

+ }

+ ]

+ },

+ "network.secret-use-result.v1": {

+ "title": "SecretUseResult",

+ "type": "object",

+ "required": [

+ "name",

+ "version",

+ "purpose"

+ ],

+ "additionalProperties": false,

+ "properties": {

+ "name": {

+ "type": "string",

+ "pattern": "^[a-z][a-z0-9_-]{0,63}$"

+ },

+ "version": {

+ "type": "integer",

+ "minimum": 1

+ },

+ "purpose": {

+ "enum": [

+ "sign",

+ "reveal"

+ ]

+ },

+ "signature": {

+ "type": "string",

+ "pattern": "^[0-9a-f]{64}$",

+ "description": "sign: the lowercase hex HMAC-SHA256 of the message under the secret."

+ },

+ "value": {

+ "type": "string",

+ "minLength": 1,

+ "maxLength": 8192,

+ "description": "reveal: the value."

+ }

+ },

+ "allOf": [

+ {

+ "if": {

+ "properties": {

+ "purpose": {

+ "const": "sign"

+ }

+ },

+ "then": {

+ "required": [

+ "signature"

+ ],

+ "not": {

+ "required": [

+ "value"

+ ]

+ }

+ },

+ {

+ "if": {

+ "properties": {

+ "purpose": {

+ "const": "reveal"

+ }

+ },

+ "then": {

+ "required": [

+ "value"

+ ],

+ "not": {

+ "required": [

+ "signature"

+ ]

+ }

+ ]

+ },

"network.staff-list-result.v1": {

"title": "NetworkStaffListResult",

"description": "network.staff-list-result@1: the answer of network.staff.read on OpenVibe.Network. GET /api/v1/staff/moderators[?service=chat|live|community|pastes|calls] (a service token holding network.staff.read, or a signed-in person holding staff.moderation.logs) → { service, staff }: the network's global moderators, admins and the owner who are not banned, with the staff capabilities their role holds in the contracts staff map; ?service keeps those holding the capability that moderates that service (another service name keeps those holding staff.content.moderate; an invalid value is ignored and answered as null). Answered with Cache-Control: private, no-store; a person without staff.moderation.logs gets 403 { error: forbidden }.",

diff --git a/generated/openapi/news.json b/generated/openapi/news.json

index 16b953f6..2db65733 100644

--- a/generated/openapi/news.json

+++ b/generated/openapi/news.json

@@ -3,8 +3,8 @@

"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",

"info": {

"title": "OpenVibe.News API",

- "version": "0.176.1",

- "description": "Routes of OpenVibe.News as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

+ "version": "0.177.0",

+ "description": "Routes of OpenVibe.News as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

"license": {

"name": "MIT",

"identifier": "MIT"

diff --git a/generated/openapi/openre.json b/generated/openapi/openre.json

index 3f3967ca..b8350085 100644

--- a/generated/openapi/openre.json

+++ b/generated/openapi/openre.json

@@ -3,8 +3,8 @@

"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",

"info": {

"title": "OpenRestream API",

- "version": "0.176.1",

- "description": "Routes of OpenRestream as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

+ "version": "0.177.0",

+ "description": "Routes of OpenRestream as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

"license": {

"name": "MIT",

"identifier": "MIT"

diff --git a/generated/openapi/play.json b/generated/openapi/play.json

index c8ecece3..29a6a809 100644

--- a/generated/openapi/play.json

+++ b/generated/openapi/play.json

@@ -3,8 +3,8 @@

"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",

"info": {

"title": "OpenVibe.Play API",

- "version": "0.176.1",

- "description": "Routes of OpenVibe.Play as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

+ "version": "0.177.0",

+ "description": "Routes of OpenVibe.Play as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

"license": {

"name": "MIT",

"identifier": "MIT"

diff --git a/generated/openapi/reviews.json b/generated/openapi/reviews.json

index 525ad3ad..cd26d9f2 100644

--- a/generated/openapi/reviews.json

+++ b/generated/openapi/reviews.json

@@ -3,8 +3,8 @@

"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",

"info": {

"title": "OpenVibe.Reviews API",

- "version": "0.176.1",

- "description": "Routes of OpenVibe.Reviews as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

+ "version": "0.177.0",

+ "description": "Routes of OpenVibe.Reviews as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

"license": {

"name": "MIT",

"identifier": "MIT"

diff --git a/generated/openapi/run.json b/generated/openapi/run.json

index a91f65e9..4e4896c4 100644

--- a/generated/openapi/run.json

+++ b/generated/openapi/run.json

@@ -3,8 +3,8 @@

"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",

"info": {

"title": "OpenVibe.Run API",

- "version": "0.176.1",

- "description": "Routes of OpenVibe.Run as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

+ "version": "0.177.0",

+ "description": "Routes of OpenVibe.Run as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

"license": {

"name": "MIT",

"identifier": "MIT"

diff --git a/generated/openapi/search.json b/generated/openapi/search.json

index 4667297c..a7baccfd 100644

--- a/generated/openapi/search.json

+++ b/generated/openapi/search.json

@@ -3,8 +3,8 @@

"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",

"info": {

"title": "OpenVibe.Search API",

- "version": "0.176.1",

- "description": "Routes of OpenVibe.Search as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

+ "version": "0.177.0",

+ "description": "Routes of OpenVibe.Search as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

"license": {

"name": "MIT",

"identifier": "MIT"

diff --git a/generated/openapi/services.json b/generated/openapi/services.json

index 31a17f83..628ec652 100644

--- a/generated/openapi/services.json

+++ b/generated/openapi/services.json

@@ -3,8 +3,8 @@

"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",

"info": {

"title": "OpenVibe.Services API",

- "version": "0.176.1",

- "description": "Routes of OpenVibe.Services as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

+ "version": "0.177.0",

+ "description": "Routes of OpenVibe.Services as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

"license": {

"name": "MIT",

"identifier": "MIT"

diff --git a/generated/openapi/sources.json b/generated/openapi/sources.json

index 36f1543b..9d0230a2 100644

--- a/generated/openapi/sources.json

+++ b/generated/openapi/sources.json

@@ -3,8 +3,8 @@

"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",

"info": {

"title": "OpenVibe.Sources API",

- "version": "0.176.1",

- "description": "Routes of OpenVibe.Sources as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

+ "version": "0.177.0",

+ "description": "Routes of OpenVibe.Sources as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

"license": {

"name": "MIT",

"identifier": "MIT"

diff --git a/generated/openapi/space.json b/generated/openapi/space.json

index 80575364..641d7302 100644

--- a/generated/openapi/space.json

+++ b/generated/openapi/space.json

@@ -3,8 +3,8 @@

"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",

"info": {

"title": "OpenVibe.Space API",

- "version": "0.176.1",

- "description": "Routes of OpenVibe.Space as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

+ "version": "0.177.0",

+ "description": "Routes of OpenVibe.Space as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

"license": {

"name": "MIT",

"identifier": "MIT"

diff --git a/generated/openapi/tips.json b/generated/openapi/tips.json

index 9b0cecb1..7e878c14 100644

--- a/generated/openapi/tips.json

+++ b/generated/openapi/tips.json

@@ -3,8 +3,8 @@

"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",

"info": {

"title": "OpenVibe.Tips API",

- "version": "0.176.1",

- "description": "Routes of OpenVibe.Tips as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

+ "version": "0.177.0",

+ "description": "Routes of OpenVibe.Tips as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

"license": {

"name": "MIT",

"identifier": "MIT"

diff --git a/generated/openapi/tools.json b/generated/openapi/tools.json

index 8c4a522e..5c48cd28 100644

--- a/generated/openapi/tools.json

+++ b/generated/openapi/tools.json

@@ -3,8 +3,8 @@

"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",

"info": {

"title": "OpenVibe.Tools API",

- "version": "0.176.1",

- "description": "Routes of OpenVibe.Tools as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

+ "version": "0.177.0",

+ "description": "Routes of OpenVibe.Tools as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

"license": {

"name": "MIT",

"identifier": "MIT"

diff --git a/generated/openapi/trade.json b/generated/openapi/trade.json

index c3fbec98..648ad507 100644

--- a/generated/openapi/trade.json

+++ b/generated/openapi/trade.json

@@ -3,8 +3,8 @@

"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",

"info": {

"title": "OpenVibe.Trade API",

- "version": "0.176.1",

- "description": "Routes of OpenVibe.Trade as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

+ "version": "0.177.0",

+ "description": "Routes of OpenVibe.Trade as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

"license": {

"name": "MIT",

"identifier": "MIT"

diff --git a/generated/openapi/vip.json b/generated/openapi/vip.json

index c18a6279..abc81db0 100644

--- a/generated/openapi/vip.json

+++ b/generated/openapi/vip.json

@@ -3,8 +3,8 @@

"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",

"info": {

"title": "OpenVibe.VIP API",

- "version": "0.176.1",

- "description": "Routes of OpenVibe.VIP as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

+ "version": "0.177.0",

+ "description": "Routes of OpenVibe.VIP as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

"license": {

"name": "MIT",

"identifier": "MIT"

diff --git a/generated/openapi/watch.json b/generated/openapi/watch.json

index f25ba4d0..d222b5ef 100644

--- a/generated/openapi/watch.json

+++ b/generated/openapi/watch.json

@@ -3,8 +3,8 @@

"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",

"info": {

"title": "OpenVibe.Watch API",

- "version": "0.176.1",

- "description": "Routes of OpenVibe.Watch as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

+ "version": "0.177.0",

+ "description": "Routes of OpenVibe.Watch as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

"license": {

"name": "MIT",

"identifier": "MIT"

diff --git a/generated/openapi/wiki.json b/generated/openapi/wiki.json

index 5e67d998..5fef2414 100644

--- a/generated/openapi/wiki.json

+++ b/generated/openapi/wiki.json

@@ -3,8 +3,8 @@

"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",

"info": {

"title": "OpenVibe.Wiki API",

- "version": "0.176.1",

- "description": "Routes of OpenVibe.Wiki as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

+ "version": "0.177.0",

+ "description": "Routes of OpenVibe.Wiki as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

"license": {

"name": "MIT",

"identifier": "MIT"

diff --git a/generated/openapi/work.json b/generated/openapi/work.json

index 53e82cd0..da13899d 100644

--- a/generated/openapi/work.json

+++ b/generated/openapi/work.json

@@ -3,8 +3,8 @@

"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",

"info": {

"title": "OpenVibe.Work API",

- "version": "0.176.1",

- "description": "Routes of OpenVibe.Work as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

+ "version": "0.177.0",

+ "description": "Routes of OpenVibe.Work as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

"license": {

"name": "MIT",

"identifier": "MIT"

diff --git a/generated/openapi/zone.json b/generated/openapi/zone.json

index c201a82f..e113a575 100644

--- a/generated/openapi/zone.json

+++ b/generated/openapi/zone.json

@@ -3,8 +3,8 @@

"jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",

"info": {

"title": "OpenVibe.Zone API",

- "version": "0.176.1",

- "description": "Routes of OpenVibe.Zone as the OpenVibe contracts describe them (openvibe-contracts 0.176.1): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

+ "version": "0.177.0",

+ "description": "Routes of OpenVibe.Zone as the OpenVibe contracts describe them (openvibe-contracts 0.177.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",

"license": {

"name": "MIT",

"identifier": "MIT"

diff --git a/generated/typescript/index.d.ts b/generated/typescript/index.d.ts

index 2e52a65f..a1d4ac73 100644

--- a/generated/typescript/index.d.ts

+++ b/generated/typescript/index.d.ts

@@ -149739,6 +149739,6624 @@ export interface ProjectUsageResult {

};

}

+/** [email protected] (owner: network) */

+/**

+ * network.project-secret@1 (ADR-056): one project secret as OpenVibe.Network shows it to the project's members and staff — its name, environment, version, a keyed fingerprint and its grants. Never the value: a secret is written once and used by name (sign or reveal through network.secret.use).

+ */

+export interface ProjectSecret {

+ project_id: string;

+ environment: "sandbox" | "production";

+ name: string;

+ /**

+ * One more each time the value is set again.

+ */

+ version: number;

+ /**

+ * A keyed hash of the value: equal values have equal fingerprints, and it reveals nothing else.

+ */

+ fingerprint: string;

+ /**

+ * @maxItems 20

+ */

+ grants:

+ | []

+ | [

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ }

+ ]

+ | [

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ }

+ ]

+ | [

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ }

+ ]

+ | [

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ }

+ ]

+ | [

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ }

+ ]

+ | [

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ }

+ ]

+ | [

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ }

+ ]

+ | [

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ }

+ ]

+ | [

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ }

+ ]

+ | [

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ }

+ ]

+ | [

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ }

+ ]

+ | [

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ }

+ ]

+ | [

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ }

+ ]

+ | [

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ }

+ ]

+ | [

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ }

+ ]

+ | [

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ }

+ ]

+ | [

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ }

+ ]

+ | [

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ }

+ ]

+ | [

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ }

+ ]

+ | [

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ },

+ {

+ /**

+ * The service id the secret is granted to (its token's svc:<id>).

+ */

+ service: string;

+ /**

+ * @minItems 1

+ * @maxItems 2

+ */

+ purposes: ["sign" | "reveal"] | ["sign" | "reveal", "sign" | "reveal"];

+ /**

+ * The https origins the value may be revealed for (reveal only; empty for sign).

+ *

+ * @maxItems 10

+ */

+ origins:

+ | []

+ | [string]

+ | [string, string]

+ | [string, string, string]

+ | [string, string, string, string]

+ | [string, string, string, string, string]

+ | [string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string]

+ | [string, string, string, string, string, string, string, string, string, string];

+ created_at: string;

+ created_by: string;

+ last_used_at: string | null;

+ }

+ ];

+ created_at: string;

+ created_by: string;

+ updated_at: string;

+ updated_by: string;

+/** [email protected] (owner: network) */

+/**

+ * network.secret-use-request@1 (ADR-056): what a first-party service sends to POST /internal/secrets/use with network.secret.use. sign asks for HMAC-SHA256 of message under the secret (the value never leaves Network); reveal asks for the value, to send to origin. Either needs a grant of that secret to the calling service for that purpose (and origin).

+ */

+export type SecretUseRequest = {

+ [k: string]: unknown | undefined;

+} & {

+ project_id: string;

+ environment: "sandbox" | "production";

+ name: string;

+ purpose: "sign" | "reveal";

+ /**

+ * sign: the exact text to sign (for a webhook delivery, "<timestamp>.<raw body>"). Not allowed with reveal.

+ */

+ message?: string;

+ /**

+ * reveal: the https origin the value will be sent to; the grant must list it. Not allowed with sign.

+ */

+ origin?: string;

+};

+/** [email protected] (owner: network) */

+/**

+ * network.secret-use-result@1 (ADR-056): POST /internal/secrets/use's answer — the secret's name and version with the HMAC-SHA256 signature (sign) or the value (reveal). Sent with Cache-Control: no-store; a caller keeps a revealed value only as long as the request it is for.

+ */

+export type SecretUseResult = {

+ [k: string]: unknown | undefined;

+} & {

+ name: string;

+ version: number;

+ purpose: "sign" | "reveal";

+ /**

+ * sign: the lowercase hex HMAC-SHA256 of the message under the secret.

+ */

+ signature?: string;

+ /**

+ * reveal: the value.

+ */

+ value?: string;

+};

/** [email protected] (owner: network) */

/**

* network.status-incident@1 (roadmap WS-N task 12): one incident or maintenance window on openvibe.network/status, public. An incident moves investigating → identified → monitoring → resolved; a maintenance window scheduled → in_progress → completed. Each change adds an update with its message; the newest state is the incident's. Services are registry ids. Messages are plain text written for people (no internal hostnames, secrets or personal data).

diff --git a/manifests/capabilities/network.secret.use.json b/manifests/capabilities/network.secret.use.json

new file mode 100644

index 00000000..fb3a3ed1

--- /dev/null

+++ b/manifests/capabilities/network.secret.use.json

@@ -0,0 +1,21 @@

+ "id": "network.secret.use",

+ "version": "1.0",

+ "owner": "network",

+ "status": "active",

+ "visibility": "first-party",

+ "description": "Sign with, or reveal, a project secret the project granted to the calling service (ADR-056): sign answers HMAC-SHA256 of a message and never the value; reveal answers the value only for an origin the grant lists.",

+ "inputSchema": "network.secret-use-request@1",

+ "outputSchema": "network.secret-use-result@1",

+ "permissions": [

+ "secrets:use"

+ ],

+ "resourceConstraints": [

+ "project"

+ ],

+ "quotaClass": "secrets-use",

+ "events": [],

+ "implementedBy": [

+ "POST /internal/secrets/use"

+ ]

diff --git a/manifests/services/network.json b/manifests/services/network.json

index adc0b0bd..9a66bb52 100644

--- a/manifests/services/network.json

+++ b/manifests/services/network.json

@@ -60,6 +60,7 @@

"network.registry.read",

"network.resource.read",

"network.resource.report",

+ "network.secret.use",

"network.staff.read",

"network.status.incident"

diff --git a/package.json b/package.json

index 1cd6b7aa..6324a9dd 100644

--- a/package.json

+++ b/package.json

@@ -1,6 +1,6 @@

{

"name": "openvibe-contracts",

- "version": "0.176.1",

+ "version": "0.177.0",

"description": "Machine-readable contracts for the OpenVibe network: schemas, manifests, ids, error envelope, capability checks.",

"main": "index.js",

"types": "generated/typescript/index.d.ts",