@openvtc/trust-tasks 0.24.1 → 0.25.0

package/src/keys/sign-csr/0.1/payload.ts

@@ -0,0 +1,646 @@
+/**
+ * Generated by scripts/build-ts-bindings.mjs — DO NOT EDIT BY HAND.
+ * Source: specs/keys/sign-csr/0.1/payload.schema.json
+ */
+
+import type { Ext } from "../../../_shared/components.js";
+
+
+/**
+ * A request for a PKCS#10 certificate signing request (RFC 2986) for a key the custodian holds. The producer names the subject as structured attributes and optionally the subject alternative names; the custodian builds the CertificationRequestInfo itself from those and the key's own public key, and signs it. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.
+ */
+export interface KeysSignCSRPayload {
+  /**
+   * Identifier of the key the request is for, as `keys/show` describes it. Its public half becomes the request's subjectPublicKeyInfo and its private half signs the request. The key MUST be `active`, and `p256` or `ed25519`.
+   */
+  keyId: string;
+  /**
+   * The subject distinguished name, one attribute per relative distinguished name, in the order of the encoded RDNSequence: element 0 is the first RDN in the DER, conventionally the country. That is the reverse of the RFC 4514 string form (`CN=…,O=…,C=…`). Never a raw DER or DN string.
+   *
+   * @minItems 1
+   * @maxItems 16
+   */
+  subject:
+    | [RdnAttribute]
+    | [RdnAttribute, RdnAttribute]
+    | [RdnAttribute, RdnAttribute, RdnAttribute]
+    | [RdnAttribute, RdnAttribute, RdnAttribute, RdnAttribute]
+    | [RdnAttribute, RdnAttribute, RdnAttribute, RdnAttribute, RdnAttribute]
+    | [RdnAttribute, RdnAttribute, RdnAttribute, RdnAttribute, RdnAttribute, RdnAttribute]
+    | [RdnAttribute, RdnAttribute, RdnAttribute, RdnAttribute, RdnAttribute, RdnAttribute, RdnAttribute]
+    | [RdnAttribute, RdnAttribute, RdnAttribute, RdnAttribute, RdnAttribute, RdnAttribute, RdnAttribute, RdnAttribute]
+    | [
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute
+      ]
+    | [
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute
+      ]
+    | [
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute
+      ]
+    | [
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute
+      ]
+    | [
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute
+      ]
+    | [
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute
+      ]
+    | [
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute
+      ]
+    | [
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute,
+        RdnAttribute
+      ];
+  /**
+   * Subject alternative names to request. When present, the custodian adds a non-critical subjectAltName extension to the request's extensionRequest attribute — the only extension this task ever requests.
+   */
+  subjectAltNames?: {
+    /**
+     * dNSName entries: host names in LDH form (an internationalised name as its A-label). No wildcards.
+     *
+     * @minItems 1
+     * @maxItems 16
+     */
+    dns?:
+      | [string]
+      | [string, string]
+      | [string, string, string]
+      | [string, string, string, string]
+      | [string, string, string, string, string]
+      | [string, string, string, string, string, string]
+      | [string, string, string, string, string, string, string]
+      | [string, string, string, string, string, string, string, string]
+      | [string, string, string, string, string, string, string, string, string]
+      | [string, string, string, string, string, string, string, string, string, string]
+      | [string, string, string, string, string, string, string, string, string, string, string]
+      | [string, string, string, string, string, string, string, string, string, string, string, string]
+      | [string, string, string, string, string, string, string, string, string, string, string, string, string]
+      | [string, string, string, string, string, string, string, string, string, string, string, string, string, string]
+      | [
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string
+        ]
+      | [
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string
+        ];
+    /**
+     * uniformResourceIdentifier entries: absolute URIs, printable ASCII without spaces.
+     *
+     * @minItems 1
+     * @maxItems 16
+     */
+    uri?:
+      | [string]
+      | [string, string]
+      | [string, string, string]
+      | [string, string, string, string]
+      | [string, string, string, string, string]
+      | [string, string, string, string, string, string]
+      | [string, string, string, string, string, string, string]
+      | [string, string, string, string, string, string, string, string]
+      | [string, string, string, string, string, string, string, string, string]
+      | [string, string, string, string, string, string, string, string, string, string]
+      | [string, string, string, string, string, string, string, string, string, string, string]
+      | [string, string, string, string, string, string, string, string, string, string, string, string]
+      | [string, string, string, string, string, string, string, string, string, string, string, string, string]
+      | [string, string, string, string, string, string, string, string, string, string, string, string, string, string]
+      | [
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string
+        ]
+      | [
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string
+        ];
+    /**
+     * rfc822Name entries: ASCII mailbox addresses.
+     *
+     * @minItems 1
+     * @maxItems 16
+     */
+    email?:
+      | [string]
+      | [string, string]
+      | [string, string, string]
+      | [string, string, string, string]
+      | [string, string, string, string, string]
+      | [string, string, string, string, string, string]
+      | [string, string, string, string, string, string, string]
+      | [string, string, string, string, string, string, string, string]
+      | [string, string, string, string, string, string, string, string, string]
+      | [string, string, string, string, string, string, string, string, string, string]
+      | [string, string, string, string, string, string, string, string, string, string, string]
+      | [string, string, string, string, string, string, string, string, string, string, string, string]
+      | [string, string, string, string, string, string, string, string, string, string, string, string, string]
+      | [string, string, string, string, string, string, string, string, string, string, string, string, string, string]
+      | [
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string
+        ]
+      | [
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string,
+          string
+        ];
+  };
+  /**
+   * Ecosystem-defined extension members per SPEC.md §4.5.1.
+   */
+  ext?: Ext;
+}
+/**
+ * One attribute of the subject distinguished name, encoded as a single-valued RDN.
+ */
+export interface RdnAttribute {
+  /**
+   * The attribute type, by its X.520 / PKCS #9 short name (externally owned, carried verbatim): `CN` commonName (2.5.4.3), `O` organizationName (2.5.4.10), `OU` organizationalUnitName (2.5.4.11), `C` countryName (2.5.4.6), `L` localityName (2.5.4.7), `ST` stateOrProvinceName (2.5.4.8), `organizationIdentifier` (2.5.4.97), `serialNumber` (2.5.4.5), `emailAddress` (1.2.840.113549.1.9.1). Closed: an attribute outside the set is refused, never passed through by OID.
+   */
+  type: "CN" | "O" | "OU" | "C" | "L" | "ST" | "organizationIdentifier" | "serialNumber" | "emailAddress";
+  /**
+   * The attribute value as text. The custodian encodes it without normalising, trimming or re-casing it, and checks the per-type rules of the specification (character set and length), refusing a value that breaks them with `keys/sign-csr:subjectInvalid`.
+   */
+  value: string;
+}
+/**
+ * The success response to a keys/sign-csr request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/sign-csr/0.1#response. Failures use trust-task-error, not this shape.
+ */
+export interface KeysSignCSRResponsePayload {
+  /**
+   * The key the request is for. Echoed so a response separated from its request is still attributable.
+   */
+  keyId: string;
+  /**
+   * The PKCS#10 CertificationRequest, DER-encoded and armoured as RFC 7468 `CERTIFICATE REQUEST` text: base64 in lines of 64 characters, LF line endings.
+   */
+  csr: string;
+  /**
+   * The key's public half, multibase-encoded exactly as `KeyRecord.publicKey` carries it, so the producer can confirm the request is for the key it meant without parsing the DER.
+   */
+  publicKey: string;
+  ext?: Ext;
+}
+
+/** Shared definitions this specification references, re-exported under the names it used to declare them with. */
+export type { Ext };
+
+/** Trust Task type URI. */
+export const TYPE_URI = "https://trusttasks.org/spec/keys/sign-csr/0.1" as const;
+
+/** Stable alias for this specification's request payload shape. */
+export type Payload = KeysSignCSRPayload;
+
+/** Trust Task response type URI (request type URI + "#response"). */
+export const RESPONSE_TYPE_URI = "https://trusttasks.org/spec/keys/sign-csr/0.1#response" as const;
+
+/** Stable alias for this specification's success-response payload shape. */
+export type Response = KeysSignCSRResponsePayload;
+
+/**
+ * This specification's payload schema, as a value.
+ *
+ * SPEC.md §7.2 item 2 is performed against this. It is shipped as data
+ * rather than only as a `.json` file because TypeScript types are erased
+ * at runtime: without a schema a consumer has nothing to validate, and
+ * every REQUIRED payload member is optional in practice. Cross-file
+ * `$ref`s are already inlined, so it needs no resolver.
+ */
+export const PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trusttasks.org/spec/keys/sign-csr/0.1",
+  "title": "Keys — Sign CSR — payload",
+  "description": "A request for a PKCS#10 certificate signing request (RFC 2986) for a key the custodian holds. The producer names the subject as structured attributes and optionally the subject alternative names; the custodian builds the CertificationRequestInfo itself from those and the key's own public key, and signs it. The outer document members (id, type, issuer, recipient, issuedAt, expiresAt, proof) are owned by the framework — SPEC §6.3.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "keyId",
+    "subject"
+  ],
+  "properties": {
+    "keyId": {
+      "type": "string",
+      "minLength": 1,
+      "description": "Identifier of the key the request is for, as `keys/show` describes it. Its public half becomes the request's subjectPublicKeyInfo and its private half signs the request. The key MUST be `active`, and `p256` or `ed25519`."
+    },
+    "subject": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 16,
+      "items": {
+        "$ref": "#/$defs/RdnAttribute"
+      },
+      "description": "The subject distinguished name, one attribute per relative distinguished name, in the order of the encoded RDNSequence: element 0 is the first RDN in the DER, conventionally the country. That is the reverse of the RFC 4514 string form (`CN=…,O=…,C=…`). Never a raw DER or DN string."
+    },
+    "subjectAltNames": {
+      "type": "object",
+      "additionalProperties": false,
+      "minProperties": 1,
+      "description": "Subject alternative names to request. When present, the custodian adds a non-critical subjectAltName extension to the request's extensionRequest attribute — the only extension this task ever requests.",
+      "properties": {
+        "dns": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 16,
+          "items": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 253,
+            "pattern": "^([A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?\\.)*[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?$"
+          },
+          "description": "dNSName entries: host names in LDH form (an internationalised name as its A-label). No wildcards."
+        },
+        "uri": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 16,
+          "items": {
+            "type": "string",
+            "minLength": 3,
+            "maxLength": 2048,
+            "pattern": "^[A-Za-z][A-Za-z0-9+.-]*:[!-~]+$"
+          },
+          "description": "uniformResourceIdentifier entries: absolute URIs, printable ASCII without spaces."
+        },
+        "email": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 16,
+          "items": {
+            "type": "string",
+            "minLength": 3,
+            "maxLength": 255,
+            "pattern": "^[!-?A-~]+@[A-Za-z0-9.-]+$"
+          },
+          "description": "rfc822Name entries: ASCII mailbox addresses."
+        }
+      }
+    },
+    "ext": {
+      "$ref": "#/$defs/Ext",
+      "description": "Ecosystem-defined extension members per SPEC.md §4.5.1."
+    }
+  },
+  "$defs": {
+    "RdnAttribute": {
+      "title": "RdnAttribute",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "type",
+        "value"
+      ],
+      "description": "One attribute of the subject distinguished name, encoded as a single-valued RDN.",
+      "properties": {
+        "type": {
+          "type": "string",
+          "enum": [
+            "CN",
+            "O",
+            "OU",
+            "C",
+            "L",
+            "ST",
+            "organizationIdentifier",
+            "serialNumber",
+            "emailAddress"
+          ],
+          "description": "The attribute type, by its X.520 / PKCS #9 short name (externally owned, carried verbatim): `CN` commonName (2.5.4.3), `O` organizationName (2.5.4.10), `OU` organizationalUnitName (2.5.4.11), `C` countryName (2.5.4.6), `L` localityName (2.5.4.7), `ST` stateOrProvinceName (2.5.4.8), `organizationIdentifier` (2.5.4.97), `serialNumber` (2.5.4.5), `emailAddress` (1.2.840.113549.1.9.1). Closed: an attribute outside the set is refused, never passed through by OID."
+        },
+        "value": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 255,
+          "description": "The attribute value as text. The custodian encodes it without normalising, trimming or re-casing it, and checks the per-type rules of the specification (character set and length), refusing a value that breaks them with `keys/sign-csr:subjectInvalid`."
+        }
+      }
+    },
+    "Response": {
+      "$anchor": "response",
+      "title": "Keys — Sign CSR — response payload",
+      "description": "The success response to a keys/sign-csr request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/sign-csr/0.1#response. Failures use trust-task-error, not this shape.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "keyId",
+        "csr",
+        "publicKey"
+      ],
+      "properties": {
+        "keyId": {
+          "type": "string",
+          "description": "The key the request is for. Echoed so a response separated from its request is still attributable."
+        },
+        "csr": {
+          "type": "string",
+          "maxLength": 16384,
+          "pattern": "^-----BEGIN CERTIFICATE REQUEST-----\\n[A-Za-z0-9+/=\\n]+-----END CERTIFICATE REQUEST-----\\n?$",
+          "description": "The PKCS#10 CertificationRequest, DER-encoded and armoured as RFC 7468 `CERTIFICATE REQUEST` text: base64 in lines of 64 characters, LF line endings."
+        },
+        "publicKey": {
+          "type": "string",
+          "minLength": 1,
+          "description": "The key's public half, multibase-encoded exactly as `KeyRecord.publicKey` carries it, so the producer can confirm the request is for the key it meant without parsing the DER."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    }
+  }
+} as const;
+
+/** As {@link PAYLOAD_SCHEMA}, for the success-response variant. */
+export const RESPONSE_PAYLOAD_SCHEMA = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$ref": "#/$defs/Response",
+  "$defs": {
+    "RdnAttribute": {
+      "title": "RdnAttribute",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "type",
+        "value"
+      ],
+      "description": "One attribute of the subject distinguished name, encoded as a single-valued RDN.",
+      "properties": {
+        "type": {
+          "type": "string",
+          "enum": [
+            "CN",
+            "O",
+            "OU",
+            "C",
+            "L",
+            "ST",
+            "organizationIdentifier",
+            "serialNumber",
+            "emailAddress"
+          ],
+          "description": "The attribute type, by its X.520 / PKCS #9 short name (externally owned, carried verbatim): `CN` commonName (2.5.4.3), `O` organizationName (2.5.4.10), `OU` organizationalUnitName (2.5.4.11), `C` countryName (2.5.4.6), `L` localityName (2.5.4.7), `ST` stateOrProvinceName (2.5.4.8), `organizationIdentifier` (2.5.4.97), `serialNumber` (2.5.4.5), `emailAddress` (1.2.840.113549.1.9.1). Closed: an attribute outside the set is refused, never passed through by OID."
+        },
+        "value": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 255,
+          "description": "The attribute value as text. The custodian encodes it without normalising, trimming or re-casing it, and checks the per-type rules of the specification (character set and length), refusing a value that breaks them with `keys/sign-csr:subjectInvalid`."
+        }
+      }
+    },
+    "Response": {
+      "$anchor": "response",
+      "title": "Keys — Sign CSR — response payload",
+      "description": "The success response to a keys/sign-csr request. Carried in a Trust Task document whose type is https://trusttasks.org/spec/keys/sign-csr/0.1#response. Failures use trust-task-error, not this shape.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "keyId",
+        "csr",
+        "publicKey"
+      ],
+      "properties": {
+        "keyId": {
+          "type": "string",
+          "description": "The key the request is for. Echoed so a response separated from its request is still attributable."
+        },
+        "csr": {
+          "type": "string",
+          "maxLength": 16384,
+          "pattern": "^-----BEGIN CERTIFICATE REQUEST-----\\n[A-Za-z0-9+/=\\n]+-----END CERTIFICATE REQUEST-----\\n?$",
+          "description": "The PKCS#10 CertificationRequest, DER-encoded and armoured as RFC 7468 `CERTIFICATE REQUEST` text: base64 in lines of 64 characters, LF line endings."
+        },
+        "publicKey": {
+          "type": "string",
+          "minLength": 1,
+          "description": "The key's public half, multibase-encoded exactly as `KeyRecord.publicKey` carries it, so the producer can confirm the request is for the key it meant without parsing the DER."
+        },
+        "ext": {
+          "$ref": "#/$defs/Ext"
+        }
+      }
+    },
+    "Ext": {
+      "title": "Ext",
+      "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": true,
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
+      }
+    }
+  }
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the request variant, from this specification's
+ * front matter. Pass to `consumeInbound` — items 5b, 7 and 8 are
+ * per-specification and cannot be derived from the document alone, and
+ * item 2 needs the schema this carries.
+ */
+export const SPEC = {
+  typeUri: TYPE_URI,
+  isBearer: false,
+  isProofRequired: true,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: PAYLOAD_SCHEMA,
+} as const;
+
+/**
+ * SPEC.md §7.2 policy for the success-response variant. `isRecipientRequired`
+ * tracks the *issuer* party's requirement because a response swaps the
+ * parties (§7.3 item 5).
+ */
+export const RESPONSE_SPEC = {
+  typeUri: RESPONSE_TYPE_URI,
+  isBearer: false,
+  isProofRequired: false,
+  isRecipientRequired: true,
+  isIssuedAtRequired: true,
+  payloadSchema: RESPONSE_PAYLOAD_SCHEMA,
+} as const;