@eudiplo/cli 9.1.0-main.b91e24e → 9.1.0-main.c6ae22c

package/templates/schemas/KeyChainConfigFile.schema.json

@@ -1,12 +1,15 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "anyOf": [
+  "$id": "./KeyChainConfigFile.schema.json",
+  "title": "KeyChainConfigFile",
+  "description": "Configuration file identified by its $schema URL.",
+  "oneOf": [
     {
       "type": "object",
       "properties": {
         "$schema": {
           "type": "string",
-          "const": "https://eudiplo.dev/schemas/v1/KeyChainConfigFile.schema.json"
+          "const": "https://eudiplo.dev/schemas/v2/KeyChainConfigFile.schema.json"
         },
         "metadata": {
           "type": "object",
@@ -45,6 +48,14 @@
                 "encrypt"
               ]
             },
+            "type": {
+              "description": "Key chain type. For a `private-jwk` key source without `activeJwk`, `standalone` makes `jwk` the signing key and `crt` its chain, leaf first; `internalChain` makes `jwk` a CA key and the last `crt` entry its CA certificate (created if `crt` is omitted), and the import generates a new signing key with a certificate issued by it. Without `type`, `jwk` is a CA key only if `rotationPolicy.enabled` is true and `crt` is not a single self-signed certificate that is not a CA. For `regenerate`, it is the type of the new key chain and must equal `keySource.keyChainType` if both are set. For the other key sources, it must match the key chain they describe.",
+              "type": "string",
+              "enum": [
+                "standalone",
+                "internalChain"
+              ]
+            },
             "keySource": {
               "oneOf": [
                 {
@@ -358,123 +369,9 @@
       "additionalProperties": false
     },
     {
-      "type": "object",
-      "properties": {
-        "id": {
-          "description": "Optional key chain id. If omitted, one is generated.",
-          "type": "string"
-        },
-        "key": {
-          "description": "Private key material in JWK format.",
-          "type": "object",
-          "properties": {
-            "kty": {
-              "type": "string",
-              "description": "Key type (for example EC)."
-            },
-            "x": {
-              "type": "string",
-              "description": "Elliptic curve public x coordinate."
-            },
-            "y": {
-              "type": "string",
-              "description": "Elliptic curve public y coordinate."
-            },
-            "crv": {
-              "type": "string",
-              "description": "Elliptic curve name."
-            },
-            "d": {
-              "type": "string",
-              "description": "Private key value."
-            },
-            "alg": {
-              "description": "Optional algorithm hint.",
-              "type": "string"
-            },
-            "kid": {
-              "description": "Optional key identifier.",
-              "type": "string"
-            }
-          },
-          "required": [
-            "kty",
-            "x",
-            "y",
-            "crv",
-            "d"
-          ],
-          "additionalProperties": false
-        },
-        "keyPem": {
-          "description": "PKCS#8 PEM-encoded EC private key material.",
-          "type": "string",
-          "minLength": 1
-        },
-        "description": {
-          "description": "Optional key chain description.",
-          "type": "string"
-        },
-        "usageType": {
-          "type": "string",
-          "enum": [
-            "access",
-            "attestation",
-            "trustList",
-            "statusList",
-            "encrypt"
-          ],
-          "description": "Key usage category for the imported key chain."
-        },
-        "crt": {
-          "description": "Optional certificate chain values in PEM or base64 DER.",
-          "type": "array",
-          "items": {
-            "type": "string"
-          }
-        },
-        "kmsProvider": {
-          "description": "Optional KMS provider id.",
-          "type": "string"
-        },
-        "rotationPolicy": {
-          "description": "Optional rotation policy for imported key chains.",
-          "type": "object",
-          "properties": {
-            "enabled": {
-              "type": "boolean",
-              "description": "Enable automatic rotation for imported key chains."
-            },
-            "intervalDays": {
-              "description": "Rotation interval in days.",
-              "type": "number",
-              "minimum": 1,
-              "maximum": 3650
-            },
-            "certValidityDays": {
-              "description": "Certificate validity period in days.",
-              "type": "number",
-              "minimum": 1,
-              "maximum": 3650
-            }
-          },
-          "required": [
-            "enabled"
-          ],
-          "additionalProperties": false
-        }
-      },
-      "required": [
-        "usageType"
-      ],
-      "additionalProperties": false
-    }
-  ],
-  "$id": "./KeyChainConfigFile.schema.json",
-  "title": "KeyChainConfigFile",
-  "description": "Configuration file identified by its $schema URL.",
-  "oneOf": [
-    {
+      "$schema": "https://json-schema.org/draft/2020-12/schema",
+      "$id": "https://eudiplo.dev/schemas/v1/KeyChainConfigFile.schema.json",
+      "title": "KeyChainConfigFile",
       "type": "object",
       "properties": {
         "$schema": {
@@ -829,6 +726,126 @@
         "spec"
       ],
       "additionalProperties": false
+    },
+    {
+      "type": "object",
+      "properties": {
+        "id": {
+          "description": "Optional key chain id. If omitted, one is generated.",
+          "type": "string"
+        },
+        "key": {
+          "description": "Private key material in JWK format.",
+          "type": "object",
+          "properties": {
+            "kty": {
+              "type": "string",
+              "description": "Key type (for example EC)."
+            },
+            "x": {
+              "type": "string",
+              "description": "Elliptic curve public x coordinate."
+            },
+            "y": {
+              "type": "string",
+              "description": "Elliptic curve public y coordinate."
+            },
+            "crv": {
+              "type": "string",
+              "description": "Elliptic curve name."
+            },
+            "d": {
+              "type": "string",
+              "description": "Private key value."
+            },
+            "alg": {
+              "description": "Optional algorithm hint.",
+              "type": "string"
+            },
+            "kid": {
+              "description": "Optional key identifier.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "kty",
+            "x",
+            "y",
+            "crv",
+            "d"
+          ],
+          "additionalProperties": false
+        },
+        "keyPem": {
+          "description": "PKCS#8 PEM-encoded EC private key material.",
+          "type": "string",
+          "minLength": 1
+        },
+        "description": {
+          "description": "Optional key chain description.",
+          "type": "string"
+        },
+        "usageType": {
+          "type": "string",
+          "enum": [
+            "access",
+            "attestation",
+            "trustList",
+            "statusList",
+            "encrypt"
+          ],
+          "description": "Key usage category for the imported key chain."
+        },
+        "type": {
+          "description": "Key chain type. `standalone`: `key` is the signing key and `crt` its chain, leaf first. `internalChain`: `key` is a CA key and the last `crt` entry its CA certificate (created if `crt` is omitted); the import generates a new signing key with a certificate issued by it. Without `type`, `key` is a CA key only if `rotationPolicy.enabled` is true and `crt` is not a single self-signed certificate that is not a CA.",
+          "type": "string",
+          "enum": [
+            "standalone",
+            "internalChain"
+          ]
+        },
+        "crt": {
+          "description": "Optional certificate chain values in PEM or base64 DER.",
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "kmsProvider": {
+          "description": "Optional KMS provider id.",
+          "type": "string"
+        },
+        "rotationPolicy": {
+          "description": "Optional rotation policy for imported key chains.",
+          "type": "object",
+          "properties": {
+            "enabled": {
+              "type": "boolean",
+              "description": "Enable automatic rotation for imported key chains."
+            },
+            "intervalDays": {
+              "description": "Rotation interval in days.",
+              "type": "number",
+              "minimum": 1,
+              "maximum": 3650
+            },
+            "certValidityDays": {
+              "description": "Certificate validity period in days.",
+              "type": "number",
+              "minimum": 1,
+              "maximum": 3650
+            }
+          },
+          "required": [
+            "enabled"
+          ],
+          "additionalProperties": false
+        }
+      },
+      "required": [
+        "usageType"
+      ],
+      "additionalProperties": false
     }
   ]
 }

package/templates/schemas/KeyChainCreateDto.schema.json

@@ -29,6 +29,15 @@
       "description": "Optional KMS provider id for key storage operations.",
       "type": "string"
     },
+    "alg": {
+      "description": "Signing algorithm, which also selects the curve: ES256 (P-256), ES384 (P-384) or ES512 (P-521). Must be one of the KMS provider's supportedAlgs; defaults to its defaultAlg. Rotation keeps it.",
+      "type": "string",
+      "enum": [
+        "ES256",
+        "ES384",
+        "ES512"
+      ]
+    },
     "rotationPolicy": {
       "description": "Optional rotation policy.",
       "type": "object",
@@ -38,7 +47,7 @@
           "description": "Enable or disable automatic key rotation."
         },
         "intervalDays": {
-          "description": "Rotation interval in days.",
+          "description": "Rotation interval in days. Required when `enabled` is true.",
           "type": "number",
           "minimum": 1,
           "maximum": 3650

package/templates/schemas/KeyChainImportDto.schema.json

@@ -68,6 +68,14 @@
       ],
       "description": "Key usage category for the imported key chain."
     },
+    "type": {
+      "description": "Key chain type. `standalone`: `key` is the signing key and `crt` its chain, leaf first. `internalChain`: `key` is a CA key and the last `crt` entry its CA certificate (created if `crt` is omitted); the import generates a new signing key with a certificate issued by it. Without `type`, `key` is a CA key only if `rotationPolicy.enabled` is true and `crt` is not a single self-signed certificate that is not a CA.",
+      "type": "string",
+      "enum": [
+        "standalone",
+        "internalChain"
+      ]
+    },
     "crt": {
       "description": "Optional certificate chain values in PEM or base64 DER.",
       "type": "array",

package/templates/schemas/KmsConfigDto.schema.json

@@ -64,6 +64,37 @@
                     "pattern": "^\\$\\{([A-Z0-9_]+)\\}$"
                   }
                 ]
+              },
+              "algorithms": {
+                "description": "Signing algorithms new key chains of this provider may use: ES256 (P-256), ES384 (P-384), ES512 (P-521). Defaults to all three for db, vault and aws-kms. For pkcs11, http and csc, whose backends may not support every curve, it defaults to defaultAlgorithm (ES256 unless set). Existing keys keep signing with their own algorithm.",
+                "examples": [
+                  [
+                    "ES256",
+                    "ES384"
+                  ]
+                ],
+                "minItems": 1,
+                "type": "array",
+                "items": {
+                  "type": "string",
+                  "enum": [
+                    "ES256",
+                    "ES384",
+                    "ES512"
+                  ]
+                }
+              },
+              "defaultAlgorithm": {
+                "description": "Algorithm used when a key chain is created without one. Must be in algorithms. Defaults to ES256 if allowed, otherwise the first entry of algorithms.",
+                "examples": [
+                  "ES256"
+                ],
+                "type": "string",
+                "enum": [
+                  "ES256",
+                  "ES384",
+                  "ES512"
+                ]
               }
             },
             "required": [
@@ -115,6 +146,37 @@
                   }
                 ]
               },
+              "algorithms": {
+                "description": "Signing algorithms new key chains of this provider may use: ES256 (P-256), ES384 (P-384), ES512 (P-521). Defaults to all three for db, vault and aws-kms. For pkcs11, http and csc, whose backends may not support every curve, it defaults to defaultAlgorithm (ES256 unless set). Existing keys keep signing with their own algorithm.",
+                "examples": [
+                  [
+                    "ES256",
+                    "ES384"
+                  ]
+                ],
+                "minItems": 1,
+                "type": "array",
+                "items": {
+                  "type": "string",
+                  "enum": [
+                    "ES256",
+                    "ES384",
+                    "ES512"
+                  ]
+                }
+              },
+              "defaultAlgorithm": {
+                "description": "Algorithm used when a key chain is created without one. Must be in algorithms. Defaults to ES256 if allowed, otherwise the first entry of algorithms.",
+                "examples": [
+                  "ES256"
+                ],
+                "type": "string",
+                "enum": [
+                  "ES256",
+                  "ES384",
+                  "ES512"
+                ]
+              },
               "vaultUrl": {
                 "anyOf": [
                   {
@@ -199,6 +261,37 @@
                   }
                 ]
               },
+              "algorithms": {
+                "description": "Signing algorithms new key chains of this provider may use: ES256 (P-256), ES384 (P-384), ES512 (P-521). Defaults to all three for db, vault and aws-kms. For pkcs11, http and csc, whose backends may not support every curve, it defaults to defaultAlgorithm (ES256 unless set). Existing keys keep signing with their own algorithm.",
+                "examples": [
+                  [
+                    "ES256",
+                    "ES384"
+                  ]
+                ],
+                "minItems": 1,
+                "type": "array",
+                "items": {
+                  "type": "string",
+                  "enum": [
+                    "ES256",
+                    "ES384",
+                    "ES512"
+                  ]
+                }
+              },
+              "defaultAlgorithm": {
+                "description": "Algorithm used when a key chain is created without one. Must be in algorithms. Defaults to ES256 if allowed, otherwise the first entry of algorithms.",
+                "examples": [
+                  "ES256"
+                ],
+                "type": "string",
+                "enum": [
+                  "ES256",
+                  "ES384",
+                  "ES512"
+                ]
+              },
               "region": {
                 "anyOf": [
                   {
@@ -298,6 +391,37 @@
                   }
                 ]
               },
+              "algorithms": {
+                "description": "Signing algorithms new key chains of this provider may use: ES256 (P-256), ES384 (P-384), ES512 (P-521). Defaults to all three for db, vault and aws-kms. For pkcs11, http and csc, whose backends may not support every curve, it defaults to defaultAlgorithm (ES256 unless set). Existing keys keep signing with their own algorithm.",
+                "examples": [
+                  [
+                    "ES256",
+                    "ES384"
+                  ]
+                ],
+                "minItems": 1,
+                "type": "array",
+                "items": {
+                  "type": "string",
+                  "enum": [
+                    "ES256",
+                    "ES384",
+                    "ES512"
+                  ]
+                }
+              },
+              "defaultAlgorithm": {
+                "description": "Algorithm used when a key chain is created without one. Must be in algorithms. Defaults to ES256 if allowed, otherwise the first entry of algorithms.",
+                "examples": [
+                  "ES256"
+                ],
+                "type": "string",
+                "enum": [
+                  "ES256",
+                  "ES384",
+                  "ES512"
+                ]
+              },
               "library": {
                 "anyOf": [
                   {
@@ -400,6 +524,37 @@
                   }
                 ]
               },
+              "algorithms": {
+                "description": "Signing algorithms new key chains of this provider may use: ES256 (P-256), ES384 (P-384), ES512 (P-521). Defaults to all three for db, vault and aws-kms. For pkcs11, http and csc, whose backends may not support every curve, it defaults to defaultAlgorithm (ES256 unless set). Existing keys keep signing with their own algorithm.",
+                "examples": [
+                  [
+                    "ES256",
+                    "ES384"
+                  ]
+                ],
+                "minItems": 1,
+                "type": "array",
+                "items": {
+                  "type": "string",
+                  "enum": [
+                    "ES256",
+                    "ES384",
+                    "ES512"
+                  ]
+                }
+              },
+              "defaultAlgorithm": {
+                "description": "Algorithm used when a key chain is created without one. Must be in algorithms. Defaults to ES256 if allowed, otherwise the first entry of algorithms.",
+                "examples": [
+                  "ES256"
+                ],
+                "type": "string",
+                "enum": [
+                  "ES256",
+                  "ES384",
+                  "ES512"
+                ]
+              },
               "baseUrl": {
                 "anyOf": [
                   {
@@ -713,6 +868,37 @@
                   }
                 ]
               },
+              "algorithms": {
+                "description": "Signing algorithms new key chains of this provider may use: ES256 (P-256), ES384 (P-384), ES512 (P-521). Defaults to all three for db, vault and aws-kms. For pkcs11, http and csc, whose backends may not support every curve, it defaults to defaultAlgorithm (ES256 unless set). Existing keys keep signing with their own algorithm.",
+                "examples": [
+                  [
+                    "ES256",
+                    "ES384"
+                  ]
+                ],
+                "minItems": 1,
+                "type": "array",
+                "items": {
+                  "type": "string",
+                  "enum": [
+                    "ES256",
+                    "ES384",
+                    "ES512"
+                  ]
+                }
+              },
+              "defaultAlgorithm": {
+                "description": "Algorithm used when a key chain is created without one. Must be in algorithms. Defaults to ES256 if allowed, otherwise the first entry of algorithms.",
+                "examples": [
+                  "ES256"
+                ],
+                "type": "string",
+                "enum": [
+                  "ES256",
+                  "ES384",
+                  "ES512"
+                ]
+              },
               "baseUrl": {
                 "anyOf": [
                   {