{
  "$type": "com.atproto.lexicon.schema",
  "defs": {
    "main": {
      "description": "Choose how names under a proven base obtain certificates. wildcard grants this service one wildcard certificate for the base, validated over DNS-01 through a challenge target of the base's own, and returns the record that delegates it; per-name ends that grant. The caller must be the base's registered identity, and the base must be verified or active. The base does not have to delegate names.",
      "errors": [
        {
          "description": "Not a syntactically valid domain.",
          "name": "InvalidDomain"
        },
        {
          "description": "No verified or active registration of that domain belongs to the caller.",
          "name": "NotBaseOwner"
        },
        {
          "description": "mode is wildcard and acknowledgeCertificateGrant is not true.",
          "name": "CertificateGrantNotAcknowledged"
        },
        {
          "description": "This service grants no wildcard certificate for the domain: it is a name delegated under another base, it is a name under a base this service offers to anyone without DNS proof, or the deployment has no zone to delegate challenges to. The message says which.",
          "name": "WildcardNotOffered"
        },
        {
          "description": "For wildcard, the base's CAA issuewild records, or its issue records where it has none, do not permit this deployment's certificate issuer, account, or DNS-01, or its issue records allow this deployment's issuer DNS-01 only, which the base's probe and its names' own certificates cannot use. For per-name, the base's issue records allow this deployment's issuer DNS-01 only, which no per-name certificate can use. The message names the record in the way.",
          "name": "CaaForbidsIssuance"
        },
        {
          "description": "A new wildcard grant within the deployment's cooldown after the base's last grant or ending, or while the wildcard of its last grant is still being retired. Ending a grant is never limited.",
          "name": "RateLimitExceeded"
        }
      ],
      "input": {
        "encoding": "application/json",
        "schema": {
          "properties": {
            "acknowledgeCertificateGrant": {
              "description": "Must be true for wildcard. While the base's _acme-challenge record points at the challenge target, this service can obtain a publicly trusted certificate for the base and for every name in its zone. Removing that record ends the grant.",
              "type": "boolean"
            },
            "domain": {
              "description": "The base: a domain registered to the caller.",
              "maxLength": 253,
              "type": "string"
            },
            "mode": {
              "description": "per-name to obtain one certificate per name, ending any wildcard grant; wildcard to grant this service a wildcard certificate for the base. A grant made after an ending names a new challenge target.",
              "knownValues": [
                "per-name",
                "wildcard"
              ],
              "type": "string"
            }
          },
          "required": [
            "domain",
            "mode"
          ],
          "type": "object"
        }
      },
      "output": {
        "encoding": "application/json",
        "schema": {
          "properties": {
            "domain": {
              "type": "string"
            },
            "mode": {
              "knownValues": [
                "per-name",
                "wildcard"
              ],
              "type": "string"
            },
            "records": {
              "description": "For wildcard, exactly one record: the base's _acme-challenge CNAME to its challenge target, purpose certificate. Empty for per-name.",
              "items": {
                "ref": "space.highport.defs#dnsInstruction",
                "type": "ref"
              },
              "type": "array"
            },
            "verified": {
              "description": "Whether the record this mode asks for is in place. For wildcard, false until the certificate check finds the base's _acme-challenge record pointing at its challenge target. Always true for per-name, which asks for no record.",
              "type": "boolean"
            }
          },
          "required": [
            "domain",
            "mode",
            "records",
            "verified"
          ],
          "type": "object"
        }
      },
      "type": "procedure"
    }
  },
  "id": "space.highport.manage.setCertificateMode",
  "lexicon": 1
}