@eudiplo/cli 7.1.1 → 7.2.0-main.20c3901

package/templates/schemas/DCQL.schema.json

@@ -0,0 +1,401 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "properties": {
+    "credentials": {
+      "minItems": 1,
+      "type": "array",
+      "items": {
+        "oneOf": [
+          {
+            "type": "object",
+            "properties": {
+              "id": {
+                "type": "string",
+                "minLength": 1,
+                "pattern": "^[A-Za-z0-9_-]+$",
+                "description": "Credential query identifier."
+              },
+              "multiple": {
+                "description": "Allow multiple matching credentials.",
+                "type": "boolean"
+              },
+              "claim_sets": {
+                "description": "Optional claim set constraints.",
+                "type": "array",
+                "items": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  }
+                }
+              },
+              "trusted_authorities": {
+                "description": "Optional trusted authority constraints.",
+                "type": "array",
+                "items": {
+                  "oneOf": [
+                    {
+                      "type": "object",
+                      "properties": {
+                        "type": {
+                          "type": "string",
+                          "const": "etsi_tl",
+                          "description": "Trusted authority type discriminator for ETSI trust lists."
+                        },
+                        "values": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "trustListId": {
+                                "description": "Optional trust list id reference.",
+                                "type": "string"
+                              },
+                              "url": {
+                                "description": "Optional trust list URL reference.",
+                                "anyOf": [
+                                  {
+                                    "type": "string",
+                                    "format": "uri"
+                                  },
+                                  {
+                                    "type": "string",
+                                    "pattern": "^<TENANT_URL>(?:\\/.*)?$"
+                                  }
+                                ]
+                              },
+                              "verifierKey": {
+                                "description": "Optional verifier key material.",
+                                "type": "object",
+                                "propertyNames": {
+                                  "type": "string"
+                                },
+                                "additionalProperties": {}
+                              },
+                              "verifierX509Der": {
+                                "description": "Optional verifier certificate in DER/base64 form.",
+                                "type": "string"
+                              }
+                            },
+                            "additionalProperties": false
+                          },
+                          "description": "Trust list references for ETSI TL verification."
+                        }
+                      },
+                      "required": [
+                        "type",
+                        "values"
+                      ],
+                      "additionalProperties": false
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "type": {
+                          "type": "string",
+                          "const": "openid_federation",
+                          "description": "Trusted authority type discriminator for OpenID Federation."
+                        },
+                        "values": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "description": "OpenID Federation authority identifiers."
+                        }
+                      },
+                      "required": [
+                        "type",
+                        "values"
+                      ],
+                      "additionalProperties": false
+                    }
+                  ]
+                }
+              },
+              "format": {
+                "type": "string",
+                "const": "dc+sd-jwt",
+                "description": "Credential format discriminator."
+              },
+              "meta": {
+                "type": "object",
+                "properties": {
+                  "vct_values": {
+                    "minItems": 1,
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    },
+                    "description": "Accepted VCT values."
+                  }
+                },
+                "required": [
+                  "vct_values"
+                ],
+                "additionalProperties": false
+              },
+              "claims": {
+                "description": "Optional claim-level constraints.",
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "id": {
+                      "description": "Optional claim query id.",
+                      "type": "string"
+                    },
+                    "path": {
+                      "type": "array",
+                      "items": {
+                        "anyOf": [
+                          {
+                            "type": "string"
+                          },
+                          {
+                            "type": "number"
+                          }
+                        ]
+                      },
+                      "description": "Path to the claim value in presented credentials."
+                    },
+                    "values": {
+                      "description": "Optional allowed values for the claim.",
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      }
+                    }
+                  },
+                  "required": [
+                    "path"
+                  ],
+                  "additionalProperties": false
+                }
+              }
+            },
+            "required": [
+              "id",
+              "format",
+              "meta"
+            ],
+            "additionalProperties": false
+          },
+          {
+            "type": "object",
+            "properties": {
+              "id": {
+                "type": "string",
+                "minLength": 1,
+                "pattern": "^[A-Za-z0-9_-]+$",
+                "description": "Credential query identifier."
+              },
+              "multiple": {
+                "description": "Allow multiple matching credentials.",
+                "type": "boolean"
+              },
+              "claim_sets": {
+                "description": "Optional claim set constraints.",
+                "type": "array",
+                "items": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  }
+                }
+              },
+              "trusted_authorities": {
+                "description": "Optional trusted authority constraints.",
+                "type": "array",
+                "items": {
+                  "oneOf": [
+                    {
+                      "type": "object",
+                      "properties": {
+                        "type": {
+                          "type": "string",
+                          "const": "etsi_tl",
+                          "description": "Trusted authority type discriminator for ETSI trust lists."
+                        },
+                        "values": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "trustListId": {
+                                "description": "Optional trust list id reference.",
+                                "type": "string"
+                              },
+                              "url": {
+                                "description": "Optional trust list URL reference.",
+                                "anyOf": [
+                                  {
+                                    "type": "string",
+                                    "format": "uri"
+                                  },
+                                  {
+                                    "type": "string",
+                                    "pattern": "^<TENANT_URL>(?:\\/.*)?$"
+                                  }
+                                ]
+                              },
+                              "verifierKey": {
+                                "description": "Optional verifier key material.",
+                                "type": "object",
+                                "propertyNames": {
+                                  "type": "string"
+                                },
+                                "additionalProperties": {}
+                              },
+                              "verifierX509Der": {
+                                "description": "Optional verifier certificate in DER/base64 form.",
+                                "type": "string"
+                              }
+                            },
+                            "additionalProperties": false
+                          },
+                          "description": "Trust list references for ETSI TL verification."
+                        }
+                      },
+                      "required": [
+                        "type",
+                        "values"
+                      ],
+                      "additionalProperties": false
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "type": {
+                          "type": "string",
+                          "const": "openid_federation",
+                          "description": "Trusted authority type discriminator for OpenID Federation."
+                        },
+                        "values": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "description": "OpenID Federation authority identifiers."
+                        }
+                      },
+                      "required": [
+                        "type",
+                        "values"
+                      ],
+                      "additionalProperties": false
+                    }
+                  ]
+                }
+              },
+              "format": {
+                "type": "string",
+                "const": "mso_mdoc",
+                "description": "Credential format discriminator."
+              },
+              "meta": {
+                "type": "object",
+                "properties": {
+                  "doctype_value": {
+                    "type": "string",
+                    "minLength": 1,
+                    "description": "Expected mDoc doctype value."
+                  }
+                },
+                "required": [
+                  "doctype_value"
+                ],
+                "additionalProperties": false
+              },
+              "claims": {
+                "description": "Optional mDoc claim-level constraints.",
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "id": {
+                      "description": "Optional claim query id.",
+                      "type": "string"
+                    },
+                    "path": {
+                      "type": "array",
+                      "items": {
+                        "anyOf": [
+                          {
+                            "type": "string"
+                          },
+                          {
+                            "type": "number"
+                          }
+                        ]
+                      },
+                      "description": "Path to the claim value in presented credentials."
+                    },
+                    "values": {
+                      "description": "Optional allowed values for the claim.",
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      }
+                    },
+                    "intent_to_retain": {
+                      "description": "Whether relying party intends to retain the claim.",
+                      "type": "boolean"
+                    }
+                  },
+                  "required": [
+                    "path"
+                  ],
+                  "additionalProperties": false
+                }
+              }
+            },
+            "required": [
+              "id",
+              "format",
+              "meta"
+            ],
+            "additionalProperties": false
+          }
+        ]
+      },
+      "description": "Credential queries requested by the verifier."
+    },
+    "credential_sets": {
+      "description": "Optional higher-level credential set requirements.",
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "options": {
+            "minItems": 1,
+            "type": "array",
+            "items": {
+              "minItems": 1,
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            },
+            "description": "Alternative credential query id combinations."
+          },
+          "required": {
+            "description": "Whether this credential set is mandatory.",
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "options"
+        ],
+        "additionalProperties": false
+      }
+    }
+  },
+  "required": [
+    "credentials"
+  ],
+  "additionalProperties": false,
+  "$id": "./DCQL.schema.json",
+  "title": "DCQL"
+}

package/templates/schemas/EmbeddedDisclosurePolicy.schema.json

@@ -0,0 +1,106 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "oneOf": [
+    {
+      "type": "object",
+      "properties": {
+        "policy": {
+          "type": "string",
+          "const": "attestationBased",
+          "description": "Attestation-based policy discriminator."
+        },
+        "values": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "claims": {
+                "description": "Claims constraints considered by policy evaluation.",
+                "type": "array",
+                "items": {}
+              },
+              "credentials": {
+                "type": "array",
+                "items": {},
+                "description": "Credential constraints considered by policy evaluation."
+              },
+              "credential_sets": {
+                "description": "Optional credential set constraints.",
+                "type": "array",
+                "items": {}
+              }
+            },
+            "required": [
+              "credentials"
+            ],
+            "additionalProperties": false
+          },
+          "description": "Attestation requirements used for policy enforcement."
+        }
+      },
+      "required": [
+        "policy",
+        "values"
+      ],
+      "additionalProperties": false
+    },
+    {
+      "type": "object",
+      "properties": {
+        "policy": {
+          "type": "string",
+          "const": "none",
+          "description": "No disclosure policy enforcement."
+        }
+      },
+      "required": [
+        "policy"
+      ],
+      "additionalProperties": false
+    },
+    {
+      "type": "object",
+      "properties": {
+        "policy": {
+          "type": "string",
+          "const": "allowList",
+          "description": "Allow-list based policy discriminator."
+        },
+        "values": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Allowed values for policy checks."
+        }
+      },
+      "required": [
+        "policy",
+        "values"
+      ],
+      "additionalProperties": false
+    },
+    {
+      "type": "object",
+      "properties": {
+        "policy": {
+          "type": "string",
+          "const": "rootOfTrust",
+          "description": "Root-of-trust policy discriminator."
+        },
+        "values": {
+          "type": "string",
+          "description": "Root-of-trust identifier or reference."
+        }
+      },
+      "required": [
+        "policy",
+        "values"
+      ],
+      "additionalProperties": false
+    }
+  ],
+  "description": "Embedded disclosure policy configuration.",
+  "$id": "./EmbeddedDisclosurePolicy.schema.json",
+  "title": "EmbeddedDisclosurePolicy"
+}

package/templates/schemas/ImportTenantDto.schema.json

@@ -12,6 +12,75 @@
       "description": "Optional tenant description.",
       "type": "string",
       "minLength": 1
+    },
+    "sessionConfig": {
+      "description": "Optional tenant-specific session storage configuration.",
+      "type": "object",
+      "properties": {
+        "ttlSeconds": {
+          "description": "Session time-to-live in seconds.",
+          "type": "integer",
+          "minimum": 60,
+          "maximum": 9007199254740991
+        },
+        "cleanupMode": {
+          "description": "Whether to fully delete or anonymize expired sessions.",
+          "type": "string",
+          "enum": [
+            "full",
+            "anonymize"
+          ]
+        }
+      },
+      "additionalProperties": false
+    },
+    "statusListConfig": {
+      "description": "Optional tenant-specific status list defaults.",
+      "type": "object",
+      "properties": {
+        "capacity": {
+          "description": "Default status list capacity.",
+          "type": "integer",
+          "minimum": 100,
+          "maximum": 9007199254740991
+        },
+        "bits": {
+          "description": "Bits-per-status setting (1, 2, 4, or 8).",
+          "anyOf": [
+            {
+              "type": "number",
+              "const": 1
+            },
+            {
+              "type": "number",
+              "const": 2
+            },
+            {
+              "type": "number",
+              "const": 4
+            },
+            {
+              "type": "number",
+              "const": 8
+            }
+          ]
+        },
+        "ttl": {
+          "description": "JWT TTL for status list tokens in seconds.",
+          "type": "integer",
+          "minimum": 60,
+          "maximum": 9007199254740991
+        },
+        "immediateUpdate": {
+          "description": "Regenerate status list JWTs immediately after status updates.",
+          "type": "boolean"
+        },
+        "enableAggregation": {
+          "description": "Include aggregation_uri in generated status list JWTs.",
+          "type": "boolean"
+        }
+      },
+      "additionalProperties": false
     }
   },
   "required": [

package/templates/schemas/IssuanceConfig.schema.json

@@ -74,6 +74,27 @@
                 "format": "uri",
                 "description": "Issuer URL for the external authorization server."
               },
+              "sessionBinding": {
+                "description": "Explicit mapping from an external access-token claim to an existing issuance session.",
+                "type": "object",
+                "properties": {
+                  "method": {
+                    "type": "string",
+                    "const": "access_token_claim",
+                    "description": "Read the correlation value from a configured access-token claim."
+                  },
+                  "claim": {
+                    "type": "string",
+                    "minLength": 1,
+                    "description": "Claim name that contains the issuance-session correlation value."
+                  }
+                },
+                "required": [
+                  "method",
+                  "claim"
+                ],
+                "additionalProperties": false
+              },
               "label": {
                 "description": "Optional display label for UI selection.",
                 "type": "string"
@@ -461,6 +482,10 @@
         "additionalProperties": {}
       }
     },
+    "notificationEndpointEnabled": {
+      "description": "Whether the OID4VCI notification endpoint is exposed for this issuance configuration.",
+      "type": "boolean"
+    },
     "credentialResponseEncryption": {
       "description": "Enable encrypted credential responses.",
       "type": "boolean"
@@ -469,11 +494,6 @@
       "description": "Require encrypted credential requests.",
       "type": "boolean"
     },
-    "notificationEndpointEnabled": {
-      "description": "Whether the issuer notification endpoint is enabled and advertised in metadata.",
-      "type": "boolean",
-      "default": true
-    },
     "txCodeMaxAttempts": {
       "description": "Maximum verification attempts for transaction codes. Null resets to defaults.",
       "anyOf": [
@@ -494,4 +514,4 @@
   "additionalProperties": false,
   "$id": "./IssuanceConfig.schema.json",
   "title": "IssuanceConfig"
-}
+}

package/templates/schemas/IssuanceConfigFile.schema.json

@@ -0,0 +1,32 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "./IssuanceConfigFile.schema.json",
+  "title": "IssuanceConfigFile",
+  "description": "An issuance configuration file in legacy payload or versioned-envelope form.",
+  "oneOf": [
+    {
+      "$ref": "./IssuanceConfig.schema.json"
+    },
+    {
+      "type": "object",
+      "properties": {
+        "apiVersion": {
+          "type": "string",
+          "const": "eudiplo.io/issuance-config/v2"
+        },
+        "kind": {
+          "type": "string",
+          "const": "IssuanceConfig"
+        },
+        "metadata": {
+          "$ref": "./ConfigDocumentMetadata.schema.json"
+        },
+        "spec": {
+          "$ref": "./IssuanceConfig.schema.json"
+        }
+      },
+      "required": ["apiVersion", "kind", "metadata", "spec"],
+      "additionalProperties": false
+    }
+  ]
+}