@eudiplo/cli 9.1.0-main.e4e29b5 → 9.1.0-main.e69fe20

package/templates/schemas/KeyChainImportDto.schema.json

@@ -64,10 +64,19 @@
         "attestation",
         "trustList",
         "statusList",
+        "federation",
         "encrypt"
       ],
       "description": "Key usage category for the imported key chain."
     },
+    "type": {
+      "description": "Key chain type. `standalone`: `key` is the signing key and `crt` its chain, leaf first. `internalChain`: `key` is a CA key and the last `crt` entry its CA certificate (created if `crt` is omitted); the import generates a new signing key with a certificate issued by it. Without `type`, `key` is a CA key only if `rotationPolicy.enabled` is true and `crt` is not a single self-signed certificate that is not a CA.",
+      "type": "string",
+      "enum": [
+        "standalone",
+        "internalChain"
+      ]
+    },
     "crt": {
       "description": "Optional certificate chain values in PEM or base64 DER.",
       "type": "array",

package/templates/schemas/KmsConfigDto.schema.json

@@ -64,6 +64,37 @@
                     "pattern": "^\\$\\{([A-Z0-9_]+)\\}$"
                   }
                 ]
+              },
+              "algorithms": {
+                "description": "Signing algorithms new key chains of this provider may use: ES256 (P-256), ES384 (P-384), ES512 (P-521). Defaults to all three for db, vault and aws-kms. For pkcs11, http and csc, whose backends may not support every curve, it defaults to defaultAlgorithm (ES256 unless set). Existing keys keep signing with their own algorithm.",
+                "examples": [
+                  [
+                    "ES256",
+                    "ES384"
+                  ]
+                ],
+                "minItems": 1,
+                "type": "array",
+                "items": {
+                  "type": "string",
+                  "enum": [
+                    "ES256",
+                    "ES384",
+                    "ES512"
+                  ]
+                }
+              },
+              "defaultAlgorithm": {
+                "description": "Algorithm used when a key chain is created without one. Must be in algorithms. Defaults to ES256 if allowed, otherwise the first entry of algorithms.",
+                "examples": [
+                  "ES256"
+                ],
+                "type": "string",
+                "enum": [
+                  "ES256",
+                  "ES384",
+                  "ES512"
+                ]
               }
             },
             "required": [
@@ -115,6 +146,37 @@
                   }
                 ]
               },
+              "algorithms": {
+                "description": "Signing algorithms new key chains of this provider may use: ES256 (P-256), ES384 (P-384), ES512 (P-521). Defaults to all three for db, vault and aws-kms. For pkcs11, http and csc, whose backends may not support every curve, it defaults to defaultAlgorithm (ES256 unless set). Existing keys keep signing with their own algorithm.",
+                "examples": [
+                  [
+                    "ES256",
+                    "ES384"
+                  ]
+                ],
+                "minItems": 1,
+                "type": "array",
+                "items": {
+                  "type": "string",
+                  "enum": [
+                    "ES256",
+                    "ES384",
+                    "ES512"
+                  ]
+                }
+              },
+              "defaultAlgorithm": {
+                "description": "Algorithm used when a key chain is created without one. Must be in algorithms. Defaults to ES256 if allowed, otherwise the first entry of algorithms.",
+                "examples": [
+                  "ES256"
+                ],
+                "type": "string",
+                "enum": [
+                  "ES256",
+                  "ES384",
+                  "ES512"
+                ]
+              },
               "vaultUrl": {
                 "anyOf": [
                   {
@@ -199,6 +261,37 @@
                   }
                 ]
               },
+              "algorithms": {
+                "description": "Signing algorithms new key chains of this provider may use: ES256 (P-256), ES384 (P-384), ES512 (P-521). Defaults to all three for db, vault and aws-kms. For pkcs11, http and csc, whose backends may not support every curve, it defaults to defaultAlgorithm (ES256 unless set). Existing keys keep signing with their own algorithm.",
+                "examples": [
+                  [
+                    "ES256",
+                    "ES384"
+                  ]
+                ],
+                "minItems": 1,
+                "type": "array",
+                "items": {
+                  "type": "string",
+                  "enum": [
+                    "ES256",
+                    "ES384",
+                    "ES512"
+                  ]
+                }
+              },
+              "defaultAlgorithm": {
+                "description": "Algorithm used when a key chain is created without one. Must be in algorithms. Defaults to ES256 if allowed, otherwise the first entry of algorithms.",
+                "examples": [
+                  "ES256"
+                ],
+                "type": "string",
+                "enum": [
+                  "ES256",
+                  "ES384",
+                  "ES512"
+                ]
+              },
               "region": {
                 "anyOf": [
                   {
@@ -298,6 +391,37 @@
                   }
                 ]
               },
+              "algorithms": {
+                "description": "Signing algorithms new key chains of this provider may use: ES256 (P-256), ES384 (P-384), ES512 (P-521). Defaults to all three for db, vault and aws-kms. For pkcs11, http and csc, whose backends may not support every curve, it defaults to defaultAlgorithm (ES256 unless set). Existing keys keep signing with their own algorithm.",
+                "examples": [
+                  [
+                    "ES256",
+                    "ES384"
+                  ]
+                ],
+                "minItems": 1,
+                "type": "array",
+                "items": {
+                  "type": "string",
+                  "enum": [
+                    "ES256",
+                    "ES384",
+                    "ES512"
+                  ]
+                }
+              },
+              "defaultAlgorithm": {
+                "description": "Algorithm used when a key chain is created without one. Must be in algorithms. Defaults to ES256 if allowed, otherwise the first entry of algorithms.",
+                "examples": [
+                  "ES256"
+                ],
+                "type": "string",
+                "enum": [
+                  "ES256",
+                  "ES384",
+                  "ES512"
+                ]
+              },
               "library": {
                 "anyOf": [
                   {
@@ -400,6 +524,37 @@
                   }
                 ]
               },
+              "algorithms": {
+                "description": "Signing algorithms new key chains of this provider may use: ES256 (P-256), ES384 (P-384), ES512 (P-521). Defaults to all three for db, vault and aws-kms. For pkcs11, http and csc, whose backends may not support every curve, it defaults to defaultAlgorithm (ES256 unless set). Existing keys keep signing with their own algorithm.",
+                "examples": [
+                  [
+                    "ES256",
+                    "ES384"
+                  ]
+                ],
+                "minItems": 1,
+                "type": "array",
+                "items": {
+                  "type": "string",
+                  "enum": [
+                    "ES256",
+                    "ES384",
+                    "ES512"
+                  ]
+                }
+              },
+              "defaultAlgorithm": {
+                "description": "Algorithm used when a key chain is created without one. Must be in algorithms. Defaults to ES256 if allowed, otherwise the first entry of algorithms.",
+                "examples": [
+                  "ES256"
+                ],
+                "type": "string",
+                "enum": [
+                  "ES256",
+                  "ES384",
+                  "ES512"
+                ]
+              },
               "baseUrl": {
                 "anyOf": [
                   {
@@ -713,6 +868,37 @@
                   }
                 ]
               },
+              "algorithms": {
+                "description": "Signing algorithms new key chains of this provider may use: ES256 (P-256), ES384 (P-384), ES512 (P-521). Defaults to all three for db, vault and aws-kms. For pkcs11, http and csc, whose backends may not support every curve, it defaults to defaultAlgorithm (ES256 unless set). Existing keys keep signing with their own algorithm.",
+                "examples": [
+                  [
+                    "ES256",
+                    "ES384"
+                  ]
+                ],
+                "minItems": 1,
+                "type": "array",
+                "items": {
+                  "type": "string",
+                  "enum": [
+                    "ES256",
+                    "ES384",
+                    "ES512"
+                  ]
+                }
+              },
+              "defaultAlgorithm": {
+                "description": "Algorithm used when a key chain is created without one. Must be in algorithms. Defaults to ES256 if allowed, otherwise the first entry of algorithms.",
+                "examples": [
+                  "ES256"
+                ],
+                "type": "string",
+                "enum": [
+                  "ES256",
+                  "ES384",
+                  "ES512"
+                ]
+              },
               "baseUrl": {
                 "anyOf": [
                   {