@openvtc/trust-tasks 0.24.1 → 0.24.2

package/dist/keys/sign-csr/0.1/payload.d.ts

@@ -0,0 +1,729 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/keys/sign-csr/0.1/payload.schema.json
+ */
+import type { Ext } from "../../../_shared/components.js";
+/**
+ * A request for a PKCS#10 certificate signing request (RFC 2986) for a key the custodian holds. The producer names the subject as structured attributes and optionally the subject alternative names; the custodian builds the CertificationRequestInfo itself from those and the key's own public key, and signs it. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.
+ */
+export interface KeysSignCSRPayload {
+    /**
+     * Identifier of the key the request is for, as `keys/show` describes it. Its public half becomes the request's subjectPublicKeyInfo and its private half signs the request. The key MUST be `active`, and `p256` or `ed25519`.
+     */
+    keyId: string;
+    /**
+     * The subject distinguished name, one attribute per relative distinguished name, in the order of the encoded RDNSequence: element 0 is the first RDN in the DER, conventionally the country. That is the reverse of the RFC 4514 string form (`CN=…,O=…,C=…`). Never a raw DER or DN string.
+     *
+     * @minItems 1
+     * @maxItems 16
+     */
+    subject: [RdnAttribute] | [RdnAttribute, RdnAttribute] | [RdnAttribute, RdnAttribute, RdnAttribute] | [RdnAttribute, RdnAttribute, RdnAttribute, RdnAttribute] | [RdnAttribute, RdnAttribute, RdnAttribute, RdnAttribute, RdnAttribute] | [RdnAttribute, RdnAttribute, RdnAttribute, RdnAttribute, RdnAttribute, RdnAttribute] | [RdnAttribute, RdnAttribute, RdnAttribute, RdnAttribute, RdnAttribute, RdnAttribute, RdnAttribute] | [RdnAttribute, RdnAttribute, RdnAttribute, RdnAttribute, RdnAttribute, RdnAttribute, RdnAttribute, RdnAttribute] | [
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute
+    ] | [
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute
+    ] | [
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute
+    ] | [
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute
+    ] | [
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute
+    ] | [
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute
+    ] | [
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute
+    ] | [
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute
+    ];
+    /**
+     * Subject alternative names to request. When present, the custodian adds a non-critical subjectAltName extension to the request's extensionRequest attribute — the only extension this task ever requests.
+     */
+    subjectAltNames?: {
+        /**
+         * dNSName entries: host names in LDH form (an internationalised name as its A-label). No wildcards.
+         *
+         * @minItems 1
+         * @maxItems 16
+         */
+        dns?: [string] | [string, string] | [string, string, string] | [string, string, string, string] | [string, string, string, string, string] | [string, string, string, string, string, string] | [string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string] | [
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string
+        ] | [
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string
+        ];
+        /**
+         * uniformResourceIdentifier entries: absolute URIs, printable ASCII without spaces.
+         *
+         * @minItems 1
+         * @maxItems 16
+         */
+        uri?: [string] | [string, string] | [string, string, string] | [string, string, string, string] | [string, string, string, string, string] | [string, string, string, string, string, string] | [string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string] | [
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string
+        ] | [
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string
+        ];
+        /**
+         * rfc822Name entries: ASCII mailbox addresses.
+         *
+         * @minItems 1
+         * @maxItems 16
+         */
+        email?: [string] | [string, string] | [string, string, string] | [string, string, string, string] | [string, string, string, string, string] | [string, string, string, string, string, string] | [string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string, string, string, string, string] | [
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string
+        ] | [
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string,
+            string
+        ];
+    };
+    /**
+     * Ecosystem-defined extension members per SPEC.md §4.5.1.
+     */
+    ext?: Ext;
+}
+/**
+ * One attribute of the subject distinguished name, encoded as a single-valued RDN.
+ */
+export interface RdnAttribute {
+    /**
+     * The attribute type, by its X.520 / PKCS #9 short name (externally owned, carried verbatim): `CN` commonName (2.5.4.3), `O` organizationName (2.5.4.10), `OU` organizationalUnitName (2.5.4.11), `C` countryName (2.5.4.6), `L` localityName (2.5.4.7), `ST` stateOrProvinceName (2.5.4.8), `organizationIdentifier` (2.5.4.97), `serialNumber` (2.5.4.5), `emailAddress` (1.2.840.113549.1.9.1). Closed: an attribute outside the set is refused, never passed through by OID.
+     */
+    type: "CN" | "O" | "OU" | "C" | "L" | "ST" | "organizationIdentifier" | "serialNumber" | "emailAddress";
+    /**
+     * The attribute value as text. The custodian encodes it without normalising, trimming or re-casing it, and checks the per-type rules of the specification (character set and length), refusing a value that breaks them with `keys/sign-csr:subjectInvalid`.
+     */
+    value: string;
+}
+/**
+ * The success response to a keys/sign-csr request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/sign-csr/0.1#response. Failures use trust-task-error, not this shape.
+ */
+export interface KeysSignCSRResponsePayload {
+    /**
+     * The key the request is for. Echoed so a response separated from its request is still attributable.
+     */
+    keyId: string;
+    /**
+     * The PKCS#10 CertificationRequest, DER-encoded and armoured as RFC 7468 `CERTIFICATE REQUEST` text: base64 in lines of 64 characters, LF line endings.
+     */
+    csr: string;
+    /**
+     * The key's public half, multibase-encoded exactly as `KeyRecord.publicKey` carries it, so the producer can confirm the request is for the key it meant without parsing the DER.
+     */
+    publicKey: string;
+    ext?: Ext;
+}
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+/** Trust Task type URI. */
+export declare const TYPE_URI: "https://trusttasks.org/spec/keys/sign-csr/0.1";
+/** Stable alias for this specification's request payload shape. */
+export type Payload = KeysSignCSRPayload;
+/** Trust Task response type URI (request type URI + "#response"). */
+export declare const RESPONSE_TYPE_URI: "https://trusttasks.org/spec/keys/sign-csr/0.1#response";
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = KeysSignCSRResponsePayload;
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export declare const PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://trusttasks.org/spec/keys/sign-csr/0.1";
+    readonly title: "Keys — Sign CSR — payload";
+    readonly description: "A request for a PKCS#10 certificate signing request (RFC 2986) for a key the custodian holds. The producer names the subject as structured attributes and optionally the subject alternative names; the custodian builds the CertificationRequestInfo itself from those and the key's own public key, and signs it. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["keyId", "subject"];
+    readonly properties: {
+        readonly keyId: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly description: "Identifier of the key the request is for, as `keys/show` describes it. Its public half becomes the request's subjectPublicKeyInfo and its private half signs the request. The key MUST be `active`, and `p256` or `ed25519`.";
+        };
+        readonly subject: {
+            readonly type: "array";
+            readonly minItems: 1;
+            readonly maxItems: 16;
+            readonly items: {
+                readonly $ref: "#/$defs/RdnAttribute";
+            };
+            readonly description: "The subject distinguished name, one attribute per relative distinguished name, in the order of the encoded RDNSequence: element 0 is the first RDN in the DER, conventionally the country. That is the reverse of the RFC 4514 string form (`CN=…,O=…,C=…`). Never a raw DER or DN string.";
+        };
+        readonly subjectAltNames: {
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly minProperties: 1;
+            readonly description: "Subject alternative names to request. When present, the custodian adds a non-critical subjectAltName extension to the request's extensionRequest attribute — the only extension this task ever requests.";
+            readonly properties: {
+                readonly dns: {
+                    readonly type: "array";
+                    readonly minItems: 1;
+                    readonly maxItems: 16;
+                    readonly items: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 253;
+                        readonly pattern: "^([A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?\\.)*[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?$";
+                    };
+                    readonly description: "dNSName entries: host names in LDH form (an internationalised name as its A-label). No wildcards.";
+                };
+                readonly uri: {
+                    readonly type: "array";
+                    readonly minItems: 1;
+                    readonly maxItems: 16;
+                    readonly items: {
+                        readonly type: "string";
+                        readonly minLength: 3;
+                        readonly maxLength: 2048;
+                        readonly pattern: "^[A-Za-z][A-Za-z0-9+.-]*:[!-~]+$";
+                    };
+                    readonly description: "uniformResourceIdentifier entries: absolute URIs, printable ASCII without spaces.";
+                };
+                readonly email: {
+                    readonly type: "array";
+                    readonly minItems: 1;
+                    readonly maxItems: 16;
+                    readonly items: {
+                        readonly type: "string";
+                        readonly minLength: 3;
+                        readonly maxLength: 255;
+                        readonly pattern: "^[!-?A-~]+@[A-Za-z0-9.-]+$";
+                    };
+                    readonly description: "rfc822Name entries: ASCII mailbox addresses.";
+                };
+            };
+        };
+        readonly ext: {
+            readonly $ref: "#/$defs/Ext";
+            readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+        };
+    };
+    readonly $defs: {
+        readonly RdnAttribute: {
+            readonly title: "RdnAttribute";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["type", "value"];
+            readonly description: "One attribute of the subject distinguished name, encoded as a single-valued RDN.";
+            readonly properties: {
+                readonly type: {
+                    readonly type: "string";
+                    readonly enum: readonly ["CN", "O", "OU", "C", "L", "ST", "organizationIdentifier", "serialNumber", "emailAddress"];
+                    readonly description: "The attribute type, by its X.520 / PKCS #9 short name (externally owned, carried verbatim): `CN` commonName (2.5.4.3), `O` organizationName (2.5.4.10), `OU` organizationalUnitName (2.5.4.11), `C` countryName (2.5.4.6), `L` localityName (2.5.4.7), `ST` stateOrProvinceName (2.5.4.8), `organizationIdentifier` (2.5.4.97), `serialNumber` (2.5.4.5), `emailAddress` (1.2.840.113549.1.9.1). Closed: an attribute outside the set is refused, never passed through by OID.";
+                };
+                readonly value: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 255;
+                    readonly description: "The attribute value as text. The custodian encodes it without normalising, trimming or re-casing it, and checks the per-type rules of the specification (character set and length), refusing a value that breaks them with `keys/sign-csr:subjectInvalid`.";
+                };
+            };
+        };
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Keys — Sign CSR — response payload";
+            readonly description: "The success response to a keys/sign-csr request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/sign-csr/0.1#response. Failures use trust-task-error, not this shape.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["keyId", "csr", "publicKey"];
+            readonly properties: {
+                readonly keyId: {
+                    readonly type: "string";
+                    readonly description: "The key the request is for. Echoed so a response separated from its request is still attributable.";
+                };
+                readonly csr: {
+                    readonly type: "string";
+                    readonly maxLength: 16384;
+                    readonly pattern: "^-----BEGIN CERTIFICATE REQUEST-----\\n[A-Za-z0-9+/=\\n]+-----END CERTIFICATE REQUEST-----\\n?$";
+                    readonly description: "The PKCS#10 CertificationRequest, DER-encoded and armoured as RFC 7468 `CERTIFICATE REQUEST` text: base64 in lines of 64 characters, LF line endings.";
+                };
+                readonly publicKey: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "The key's public half, multibase-encoded exactly as `KeyRecord.publicKey` carries it, so the producer can confirm the request is for the key it meant without parsing the DER.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+    };
+};
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export declare const RESPONSE_PAYLOAD_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $ref: "#/$defs/Response";
+    readonly $defs: {
+        readonly RdnAttribute: {
+            readonly title: "RdnAttribute";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["type", "value"];
+            readonly description: "One attribute of the subject distinguished name, encoded as a single-valued RDN.";
+            readonly properties: {
+                readonly type: {
+                    readonly type: "string";
+                    readonly enum: readonly ["CN", "O", "OU", "C", "L", "ST", "organizationIdentifier", "serialNumber", "emailAddress"];
+                    readonly description: "The attribute type, by its X.520 / PKCS #9 short name (externally owned, carried verbatim): `CN` commonName (2.5.4.3), `O` organizationName (2.5.4.10), `OU` organizationalUnitName (2.5.4.11), `C` countryName (2.5.4.6), `L` localityName (2.5.4.7), `ST` stateOrProvinceName (2.5.4.8), `organizationIdentifier` (2.5.4.97), `serialNumber` (2.5.4.5), `emailAddress` (1.2.840.113549.1.9.1). Closed: an attribute outside the set is refused, never passed through by OID.";
+                };
+                readonly value: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 255;
+                    readonly description: "The attribute value as text. The custodian encodes it without normalising, trimming or re-casing it, and checks the per-type rules of the specification (character set and length), refusing a value that breaks them with `keys/sign-csr:subjectInvalid`.";
+                };
+            };
+        };
+        readonly Response: {
+            readonly $anchor: "response";
+            readonly title: "Keys — Sign CSR — response payload";
+            readonly description: "The success response to a keys/sign-csr request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/sign-csr/0.1#response. Failures use trust-task-error, not this shape.";
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["keyId", "csr", "publicKey"];
+            readonly properties: {
+                readonly keyId: {
+                    readonly type: "string";
+                    readonly description: "The key the request is for. Echoed so a response separated from its request is still attributable.";
+                };
+                readonly csr: {
+                    readonly type: "string";
+                    readonly maxLength: 16384;
+                    readonly pattern: "^-----BEGIN CERTIFICATE REQUEST-----\\n[A-Za-z0-9+/=\\n]+-----END CERTIFICATE REQUEST-----\\n?$";
+                    readonly description: "The PKCS#10 CertificationRequest, DER-encoded and armoured as RFC 7468 `CERTIFICATE REQUEST` text: base64 in lines of 64 characters, LF line endings.";
+                };
+                readonly publicKey: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly description: "The key's public half, multibase-encoded exactly as `KeyRecord.publicKey` carries it, so the producer can confirm the request is for the key it meant without parsing the DER.";
+                };
+                readonly ext: {
+                    readonly $ref: "#/$defs/Ext";
+                };
+            };
+        };
+        readonly Ext: {
+            readonly title: "Ext";
+            readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+            readonly type: "object";
+            readonly minProperties: 1;
+            readonly additionalProperties: true;
+            readonly propertyNames: {
+                readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export declare const SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/keys/sign-csr/0.1";
+    readonly isBearer: false;
+    readonly isProofRequired: true;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $id: "https://trusttasks.org/spec/keys/sign-csr/0.1";
+        readonly title: "Keys — Sign CSR — payload";
+        readonly description: "A request for a PKCS#10 certificate signing request (RFC 2986) for a key the custodian holds. The producer names the subject as structured attributes and optionally the subject alternative names; the custodian builds the CertificationRequestInfo itself from those and the key's own public key, and signs it. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.";
+        readonly type: "object";
+        readonly additionalProperties: false;
+        readonly required: readonly ["keyId", "subject"];
+        readonly properties: {
+            readonly keyId: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly description: "Identifier of the key the request is for, as `keys/show` describes it. Its public half becomes the request's subjectPublicKeyInfo and its private half signs the request. The key MUST be `active`, and `p256` or `ed25519`.";
+            };
+            readonly subject: {
+                readonly type: "array";
+                readonly minItems: 1;
+                readonly maxItems: 16;
+                readonly items: {
+                    readonly $ref: "#/$defs/RdnAttribute";
+                };
+                readonly description: "The subject distinguished name, one attribute per relative distinguished name, in the order of the encoded RDNSequence: element 0 is the first RDN in the DER, conventionally the country. That is the reverse of the RFC 4514 string form (`CN=…,O=…,C=…`). Never a raw DER or DN string.";
+            };
+            readonly subjectAltNames: {
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly minProperties: 1;
+                readonly description: "Subject alternative names to request. When present, the custodian adds a non-critical subjectAltName extension to the request's extensionRequest attribute — the only extension this task ever requests.";
+                readonly properties: {
+                    readonly dns: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly maxItems: 16;
+                        readonly items: {
+                            readonly type: "string";
+                            readonly minLength: 1;
+                            readonly maxLength: 253;
+                            readonly pattern: "^([A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?\\.)*[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?$";
+                        };
+                        readonly description: "dNSName entries: host names in LDH form (an internationalised name as its A-label). No wildcards.";
+                    };
+                    readonly uri: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly maxItems: 16;
+                        readonly items: {
+                            readonly type: "string";
+                            readonly minLength: 3;
+                            readonly maxLength: 2048;
+                            readonly pattern: "^[A-Za-z][A-Za-z0-9+.-]*:[!-~]+$";
+                        };
+                        readonly description: "uniformResourceIdentifier entries: absolute URIs, printable ASCII without spaces.";
+                    };
+                    readonly email: {
+                        readonly type: "array";
+                        readonly minItems: 1;
+                        readonly maxItems: 16;
+                        readonly items: {
+                            readonly type: "string";
+                            readonly minLength: 3;
+                            readonly maxLength: 255;
+                            readonly pattern: "^[!-?A-~]+@[A-Za-z0-9.-]+$";
+                        };
+                        readonly description: "rfc822Name entries: ASCII mailbox addresses.";
+                    };
+                };
+            };
+            readonly ext: {
+                readonly $ref: "#/$defs/Ext";
+                readonly description: "Ecosystem-defined extension members per SPEC.md §4.5.1.";
+            };
+        };
+        readonly $defs: {
+            readonly RdnAttribute: {
+                readonly title: "RdnAttribute";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["type", "value"];
+                readonly description: "One attribute of the subject distinguished name, encoded as a single-valued RDN.";
+                readonly properties: {
+                    readonly type: {
+                        readonly type: "string";
+                        readonly enum: readonly ["CN", "O", "OU", "C", "L", "ST", "organizationIdentifier", "serialNumber", "emailAddress"];
+                        readonly description: "The attribute type, by its X.520 / PKCS #9 short name (externally owned, carried verbatim): `CN` commonName (2.5.4.3), `O` organizationName (2.5.4.10), `OU` organizationalUnitName (2.5.4.11), `C` countryName (2.5.4.6), `L` localityName (2.5.4.7), `ST` stateOrProvinceName (2.5.4.8), `organizationIdentifier` (2.5.4.97), `serialNumber` (2.5.4.5), `emailAddress` (1.2.840.113549.1.9.1). Closed: an attribute outside the set is refused, never passed through by OID.";
+                    };
+                    readonly value: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 255;
+                        readonly description: "The attribute value as text. The custodian encodes it without normalising, trimming or re-casing it, and checks the per-type rules of the specification (character set and length), refusing a value that breaks them with `keys/sign-csr:subjectInvalid`.";
+                    };
+                };
+            };
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Keys — Sign CSR — response payload";
+                readonly description: "The success response to a keys/sign-csr request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/sign-csr/0.1#response. Failures use trust-task-error, not this shape.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["keyId", "csr", "publicKey"];
+                readonly properties: {
+                    readonly keyId: {
+                        readonly type: "string";
+                        readonly description: "The key the request is for. Echoed so a response separated from its request is still attributable.";
+                    };
+                    readonly csr: {
+                        readonly type: "string";
+                        readonly maxLength: 16384;
+                        readonly pattern: "^-----BEGIN CERTIFICATE REQUEST-----\\n[A-Za-z0-9+/=\\n]+-----END CERTIFICATE REQUEST-----\\n?$";
+                        readonly description: "The PKCS#10 CertificationRequest, DER-encoded and armoured as RFC 7468 `CERTIFICATE REQUEST` text: base64 in lines of 64 characters, LF line endings.";
+                    };
+                    readonly publicKey: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "The key's public half, multibase-encoded exactly as `KeyRecord.publicKey` carries it, so the producer can confirm the request is for the key it meant without parsing the DER.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+        };
+    };
+};
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export declare const RESPONSE_SPEC: {
+    readonly typeUri: "https://trusttasks.org/spec/keys/sign-csr/0.1#response";
+    readonly isBearer: false;
+    readonly isProofRequired: false;
+    readonly isRecipientRequired: true;
+    readonly isIssuedAtRequired: true;
+    readonly payloadSchema: {
+        readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+        readonly $ref: "#/$defs/Response";
+        readonly $defs: {
+            readonly RdnAttribute: {
+                readonly title: "RdnAttribute";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["type", "value"];
+                readonly description: "One attribute of the subject distinguished name, encoded as a single-valued RDN.";
+                readonly properties: {
+                    readonly type: {
+                        readonly type: "string";
+                        readonly enum: readonly ["CN", "O", "OU", "C", "L", "ST", "organizationIdentifier", "serialNumber", "emailAddress"];
+                        readonly description: "The attribute type, by its X.520 / PKCS #9 short name (externally owned, carried verbatim): `CN` commonName (2.5.4.3), `O` organizationName (2.5.4.10), `OU` organizationalUnitName (2.5.4.11), `C` countryName (2.5.4.6), `L` localityName (2.5.4.7), `ST` stateOrProvinceName (2.5.4.8), `organizationIdentifier` (2.5.4.97), `serialNumber` (2.5.4.5), `emailAddress` (1.2.840.113549.1.9.1). Closed: an attribute outside the set is refused, never passed through by OID.";
+                    };
+                    readonly value: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly maxLength: 255;
+                        readonly description: "The attribute value as text. The custodian encodes it without normalising, trimming or re-casing it, and checks the per-type rules of the specification (character set and length), refusing a value that breaks them with `keys/sign-csr:subjectInvalid`.";
+                    };
+                };
+            };
+            readonly Response: {
+                readonly $anchor: "response";
+                readonly title: "Keys — Sign CSR — response payload";
+                readonly description: "The success response to a keys/sign-csr request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/sign-csr/0.1#response. Failures use trust-task-error, not this shape.";
+                readonly type: "object";
+                readonly additionalProperties: false;
+                readonly required: readonly ["keyId", "csr", "publicKey"];
+                readonly properties: {
+                    readonly keyId: {
+                        readonly type: "string";
+                        readonly description: "The key the request is for. Echoed so a response separated from its request is still attributable.";
+                    };
+                    readonly csr: {
+                        readonly type: "string";
+                        readonly maxLength: 16384;
+                        readonly pattern: "^-----BEGIN CERTIFICATE REQUEST-----\\n[A-Za-z0-9+/=\\n]+-----END CERTIFICATE REQUEST-----\\n?$";
+                        readonly description: "The PKCS#10 CertificationRequest, DER-encoded and armoured as RFC 7468 `CERTIFICATE REQUEST` text: base64 in lines of 64 characters, LF line endings.";
+                    };
+                    readonly publicKey: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                        readonly description: "The key's public half, multibase-encoded exactly as `KeyRecord.publicKey` carries it, so the producer can confirm the request is for the key it meant without parsing the DER.";
+                    };
+                    readonly ext: {
+                        readonly $ref: "#/$defs/Ext";
+                    };
+                };
+            };
+            readonly Ext: {
+                readonly title: "Ext";
+                readonly description: "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.";
+                readonly type: "object";
+                readonly minProperties: 1;
+                readonly additionalProperties: true;
+                readonly propertyNames: {
+                    readonly pattern: "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$";
+                };
+            };
+        };
+    };
+};
+//# sourceMappingURL=payload.d.ts.map