@eudiplo/cli 7.2.0 → 7.3.0-main.b8ff00a

package/templates/demo-config/key-chains/access.json

@@ -1,17 +1,28 @@
 {
+  "apiVersion": "eudiplo.io/key-chain/v2",
+  "kind": "KeyChain",
+  "metadata": {
+    "id": "2f71c235-87e2-43c9-b572-739a3164ce95",
+    "generation": 1
+  },
+  "spec": {
     "id": "2f71c235-87e2-43c9-b572-739a3164ce95",
     "description": "Access Certificate",
     "usageType": "access",
-    "key": {
+    "keySource": {
+      "type": "private-jwk",
+      "jwk": {
         "kty": "EC",
         "x": "XhUejp-xQ_Dk0dRpg8PBFr0viFpdI_nmErMWjzOnOEg",
         "y": "TfvSjR63Ohj8HpiBkVm0FaieKmahFNJC4IfXZtL14PQ",
         "crv": "P-256",
         "d": "878XDi2iZi860bluRn4j1Ib3zlzYIaUN2q1qklhmA90",
         "kid": "2f71c235-87e2-43c9-b572-739a3164ce95-active"
+      }
     },
     "kmsProvider": "db",
     "crt": [
-        "-----BEGIN CERTIFICATE-----\nMIIBqDCCAU6gAwIBAgIRAKvmiMRB5R7lA5jLGSWb+t0wCgYIKoZIzj0EAwIwIzEL\nMAkGA1UEBhMCREUxFDASBgNVBAMTC0RlbW8gVGVuYW50MB4XDTI2MDMwOTExMDM1\nN1oXDTI3MDMwOTExMDM1N1owIzELMAkGA1UEBhMCREUxFDASBgNVBAMTC0RlbW8g\nVGVuYW50MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEXhUejp+xQ/Dk0dRpg8PB\nFr0viFpdI/nmErMWjzOnOEhN+9KNHrc6GPwemIGRWbQVqJ4qZqEU0kLgh9dm0vXg\n9KNjMGEwIgYDVR0RBBswGYIXc2VydmljZS5ldWRpLXdhbGxldC5kZXYwDAYDVR0T\nAQH/BAIwADAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0OBBYEFJ/qrJtPiM+jlZzxig8f\nVugUZLHYMAoGCCqGSM49BAMCA0gAMEUCIQDxZTfmEZ6XXETPk5iQHRqpPmhJYMpB\n3KZ/XzNBTbC8OAIgZwa4rpELbnfCweRNhC0JjZ/sVZl1TPgBd11N56l7r34=\n-----END CERTIFICATE-----"
+      "-----BEGIN CERTIFICATE-----\nMIIBqDCCAU6gAwIBAgIRAKvmiMRB5R7lA5jLGSWb+t0wCgYIKoZIzj0EAwIwIzEL\nMAkGA1UEBhMCREUxFDASBgNVBAMTC0RlbW8gVGVuYW50MB4XDTI2MDMwOTExMDM1\nN1oXDTI3MDMwOTExMDM1N1owIzELMAkGA1UEBhMCREUxFDASBgNVBAMTC0RlbW8g\nVGVuYW50MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEXhUejp+xQ/Dk0dRpg8PB\nFr0viFpdI/nmErMWjzOnOEhN+9KNHrc6GPwemIGRWbQVqJ4qZqEU0kLgh9dm0vXg\n9KNjMGEwIgYDVR0RBBswGYIXc2VydmljZS5ldWRpLXdhbGxldC5kZXYwDAYDVR0T\nAQH/BAIwADAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0OBBYEFJ/qrJtPiM+jlZzxig8f\nVugUZLHYMAoGCCqGSM49BAMCA0gAMEUCIQDxZTfmEZ6XXETPk5iQHRqpPmhJYMpB\n3KZ/XzNBTbC8OAIgZwa4rpELbnfCweRNhC0JjZ/sVZl1TPgBd11N56l7r34=\n-----END CERTIFICATE-----"
     ]
+  }
 }

package/templates/demo-config/key-chains/attestation.json

@@ -1,18 +1,29 @@
 {
+  "apiVersion": "eudiplo.io/key-chain/v2",
+  "kind": "KeyChain",
+  "metadata": {
+    "id": "dbb65456-c358-46c1-bb5b-c777ef72c1d3",
+    "generation": 1
+  },
+  "spec": {
     "id": "dbb65456-c358-46c1-bb5b-c777ef72c1d3",
     "description": "key for signing",
     "usageType": "attestation",
-    "key": {
+    "keySource": {
+      "type": "private-jwk",
+      "jwk": {
         "crv": "P-256",
         "d": "oXPLTk02Mq9n8GfOTQ8hdoe3ENkNoN_Y2ymLnUmnbV0",
         "kty": "EC",
         "x": "HHkkbUgKSkkqXmL8utl-TLWIg8CYQS4WPJ8j_nO44Yw",
         "y": "1NJY0LT3mEuucLQCZJWNrA7fVW8ypR4Zf5cuu85NjSw",
         "alg": "ES256"
+      }
     },
     "kmsProvider": "db",
     "rotationPolicy": {
-        "certValidityDays": 30,
-        "enabled": true
+      "certValidityDays": 30,
+      "enabled": true
     }
+  }
 }

package/templates/demo-config/key-chains/status-list.json

@@ -1,18 +1,29 @@
 {
+  "apiVersion": "eudiplo.io/key-chain/v2",
+  "kind": "KeyChain",
+  "metadata": {
+    "id": "dbb65456-c358-46c1-bb5b-c777ef72c1d4",
+    "generation": 1
+  },
+  "spec": {
     "id": "dbb65456-c358-46c1-bb5b-c777ef72c1d4",
     "description": "key for status list signing",
     "usageType": "statusList",
-    "key": {
+    "keySource": {
+      "type": "private-jwk",
+      "jwk": {
         "crv": "P-256",
         "d": "oXPLTk02Mq9n8GfOTQ8hdoe3ENkNoN_Y2ymLnUmnbV0",
         "kty": "EC",
         "x": "HHkkbUgKSkkqXmL8utl-TLWIg8CYQS4WPJ8j_nO44Yw",
         "y": "1NJY0LT3mEuucLQCZJWNrA7fVW8ypR4Zf5cuu85NjSw",
         "alg": "ES256"
+      }
     },
     "kmsProvider": "db",
     "rotationPolicy": {
-        "certValidityDays": 30,
-        "enabled": true
+      "certValidityDays": 30,
+      "enabled": true
     }
-}
+  }
+}

package/templates/demo-config/key-chains/trust-list.json

@@ -1,14 +1,25 @@
 {
+  "apiVersion": "eudiplo.io/key-chain/v2",
+  "kind": "KeyChain",
+  "metadata": {
+    "id": "570852d7-7e7f-40af-a0e3-a6ebffd75ed0",
+    "generation": 1
+  },
+  "spec": {
     "id": "570852d7-7e7f-40af-a0e3-a6ebffd75ed0",
     "description": "used to sign trust lists",
     "usageType": "trustList",
-    "key": {
+    "keySource": {
+      "type": "private-jwk",
+      "jwk": {
         "crv": "P-256",
         "d": "_iZzAnnFH_HsBzDG_hk8qpTQmh_sCwhPpvebVNjhe2A",
         "kty": "EC",
         "x": "MhpvX9dEM8NsXM-c6474d2uHrPRWrVD4WZGtVvxfQhk",
         "y": "q_uS4tQZSKu22_YgTlEFjuNdz-e-uNHzW1-x_VLicco",
         "alg": "ES256"
+      }
     },
     "kmsProvider": "db"
-}
+  }
+}

package/templates/demo-config/presentation/age-over-18.json

@@ -1,64 +1,57 @@
 {
+  "apiVersion": "eudiplo.io/presentation-config/v2",
+  "kind": "PresentationConfig",
+  "metadata": {
+    "id": "age-over-18",
+    "generation": 1
+  },
+  "spec": {
     "id": "age-over-18",
     "description": "Age Over 18 Verification - Proves user is 18+ without revealing exact birthdate",
     "dcql_query": {
-        "credentials": [
+      "credentials": [
+        {
+          "id": "pid-sd-jwt",
+          "format": "dc+sd-jwt",
+          "meta": {
+            "vct_values": ["urn:eudi:pid:de:1"]
+          },
+          "claims": [
             {
-                "id": "pid-sd-jwt",
-                "format": "dc+sd-jwt",
-                "meta": {
-                    "vct_values": [
-                        "urn:eudi:pid:de:1"
-                    ]
-                },
-                "claims": [
-                    {
-                        "path": [
-                            "age_equal_or_over",
-                            "18"
-                        ]
-                    }
-                ]
-            },
+              "path": ["age_equal_or_over", "18"]
+            }
+          ]
+        },
+        {
+          "id": "pid-mso-mdoc",
+          "format": "mso_mdoc",
+          "meta": {
+            "doctype_value": "eu.europa.ec.eudi.pid.1"
+          },
+          "claims": [
             {
-                "id": "pid-mso-mdoc",
-                "format": "mso_mdoc",
-                "meta": {
-                    "doctype_value": "eu.europa.ec.eudi.pid.1"
-                },
-                "claims": [
-                    {
-                        "path": [
-                            "eu.europa.ec.eudi.pid.1",
-                            "age_over_18"
-                        ],
-                        "intent_to_retain": false
-                    }
-                ],
-                "trusted_authorities": [
-                    {
-                        "type": "etsi_tl",
-                        "values": [
-                            {
-                                "trustListId": "580831bc-ef11-43f4-a3be-a2b6bf1b29a3"
-                            }
-                        ]
-                    }
-                ]
+              "path": ["eu.europa.ec.eudi.pid.1", "age_over_18"],
+              "intent_to_retain": false
             }
-        ],
-        "credential_sets": [
+          ],
+          "trusted_authorities": [
             {
-                "options": [
-                    [
-                        "pid-sd-jwt"
-                    ],
-                    [
-                        "pid-mso-mdoc"
-                    ]
-                ]
+              "type": "etsi_tl",
+              "values": [
+                {
+                  "trustListId": "580831bc-ef11-43f4-a3be-a2b6bf1b29a3"
+                }
+              ]
             }
-        ]
+          ]
+        }
+      ],
+      "credential_sets": [
+        {
+          "options": [["pid-sd-jwt"], ["pid-mso-mdoc"]]
+        }
+      ]
     },
     "lifeTime": 300
-}
+  }
+}

package/templates/demo-config/presentation/pid.json

@@ -0,0 +1,44 @@
+{
+  "apiVersion": "eudiplo.io/presentation-config/v2",
+  "kind": "PresentationConfig",
+  "metadata": {
+    "id": "pid",
+    "generation": 1
+  },
+  "spec": {
+    "id": "pid",
+    "description": "Presentation ID",
+    "dcql_query": {
+      "credentials": [
+        {
+          "id": "pid",
+          "format": "dc+sd-jwt",
+          "meta": {
+            "vct_values": [
+              "<TENANT_URL>/credentials-metadata/vct/pid"
+            ]
+          },
+          "claims": [
+            {
+              "path": [
+                "address",
+                "locality"
+              ]
+            }
+          ],
+          "trusted_authorities": [
+            {
+              "type": "etsi_tl",
+              "values": [
+                {
+                  "trustListId": "580831bc-ef11-43f4-a3be-a2b6bf1b29a3"
+                }
+              ]
+            }
+          ]
+        }
+      ]
+    },
+    "webhookEndpointId": "notification"
+  }
+}

package/templates/demo-config.manifest.json

@@ -18,6 +18,7 @@
   "key-chains/status-list.json",
   "key-chains/trust-list.json",
   "presentation/age-over-18.json",
+  "presentation/pid.json",
   "trust-lists/trustlist-580831bc-ef11-43f4-a3be-a2b6bf1b29a3-config.json",
   "webhook-endpoints/notification.json"
 ]

package/templates/schemas/AttributeProviderAuth.schema.json

@@ -0,0 +1,60 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "oneOf": [
+    {
+      "type": "object",
+      "properties": {
+        "type": {
+          "type": "string",
+          "const": "none",
+          "description": "Disable authentication for attribute provider calls."
+        }
+      },
+      "required": [
+        "type"
+      ],
+      "additionalProperties": false,
+      "description": "No authentication variant."
+    },
+    {
+      "type": "object",
+      "properties": {
+        "type": {
+          "type": "string",
+          "const": "apiKey",
+          "description": "Use API key authentication."
+        },
+        "config": {
+          "type": "object",
+          "properties": {
+            "headerName": {
+              "type": "string",
+              "minLength": 1,
+              "description": "HTTP header name carrying the API key."
+            },
+            "value": {
+              "type": "string",
+              "minLength": 1,
+              "description": "API key value."
+            }
+          },
+          "required": [
+            "headerName",
+            "value"
+          ],
+          "additionalProperties": false,
+          "description": "API key authentication settings."
+        }
+      },
+      "required": [
+        "type",
+        "config"
+      ],
+      "additionalProperties": false,
+      "description": "API key authentication variant."
+    }
+  ],
+  "description": "Authentication method used to call the attribute provider.",
+  "$id": "./AttributeProviderAuth.schema.json",
+  "title": "AttributeProviderAuth"
+}

package/templates/schemas/AttributeProviderConfigFile.schema.json

@@ -0,0 +1,37 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "./AttributeProviderConfigFile.schema.json",
+  "title": "AttributeProviderConfigFile",
+  "description": "An attribute-provider configuration file in legacy payload or versioned-envelope form.",
+  "oneOf": [
+    {
+      "$ref": "./CreateAttributeProviderDto.schema.json"
+    },
+    {
+      "type": "object",
+      "properties": {
+        "apiVersion": {
+          "type": "string",
+          "const": "eudiplo.io/attribute-provider/v1"
+        },
+        "kind": {
+          "type": "string",
+          "const": "AttributeProvider"
+        },
+        "metadata": {
+          "$ref": "./ConfigDocumentMetadata.schema.json"
+        },
+        "spec": {
+          "$ref": "./CreateAttributeProviderDto.schema.json"
+        }
+      },
+      "required": [
+        "apiVersion",
+        "kind",
+        "metadata",
+        "spec"
+      ],
+      "additionalProperties": false
+    }
+  ]
+}

package/templates/schemas/CertImportDto.schema.json

@@ -0,0 +1,35 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "properties": {
+    "id": {
+      "description": "Optional certificate id. If omitted, one may be generated.",
+      "type": "string",
+      "minLength": 1
+    },
+    "keyId": {
+      "description": "Optional key chain id associated with this certificate chain.",
+      "type": "string",
+      "minLength": 1
+    },
+    "description": {
+      "description": "Optional certificate description.",
+      "type": "string"
+    },
+    "crt": {
+      "minItems": 1,
+      "type": "array",
+      "items": {
+        "type": "string",
+        "minLength": 1
+      },
+      "description": "Certificate chain entries, typically PEM-encoded certificates."
+    }
+  },
+  "required": [
+    "crt"
+  ],
+  "additionalProperties": false,
+  "$id": "./CertImportDto.schema.json",
+  "title": "CertImportDto"
+}

package/templates/schemas/ClientConfigFile.schema.json

@@ -0,0 +1,37 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "./ClientConfigFile.schema.json",
+  "title": "ClientConfigFile",
+  "description": "A client configuration file in legacy payload or versioned-envelope form.",
+  "oneOf": [
+    {
+      "$ref": "./CreateClientDto.schema.json"
+    },
+    {
+      "type": "object",
+      "properties": {
+        "apiVersion": {
+          "type": "string",
+          "const": "eudiplo.io/client/v1"
+        },
+        "kind": {
+          "type": "string",
+          "const": "Client"
+        },
+        "metadata": {
+          "$ref": "./ConfigDocumentMetadata.schema.json"
+        },
+        "spec": {
+          "$ref": "./CreateClientDto.schema.json"
+        }
+      },
+      "required": [
+        "apiVersion",
+        "kind",
+        "metadata",
+        "spec"
+      ],
+      "additionalProperties": false
+    }
+  ]
+}

package/templates/schemas/ConfigDocumentMetadata.schema.json

@@ -0,0 +1,25 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "./ConfigDocumentMetadata.schema.json",
+  "title": "ConfigDocumentMetadata",
+  "type": "object",
+  "properties": {
+    "id": {
+      "type": "string",
+      "minLength": 1,
+      "description": "Stable resource identifier."
+    },
+    "generation": {
+      "type": "integer",
+      "minimum": 1,
+      "description": "Monotonically increasing configuration generation."
+    },
+    "ownership": {
+      "type": "string",
+      "enum": ["unmanaged", "file-managed"],
+      "description": "Requested ownership recorded when the document is applied."
+    }
+  },
+  "required": ["id"],
+  "additionalProperties": false
+}

package/templates/schemas/CreateClientDto.schema.json

@@ -31,6 +31,7 @@
           "clients:manage",
           "users:manage",
           "tenants:manage",
+          "tenant:admin",
           "registrar:manage"
         ]
       },

package/templates/schemas/CreateStatusListDto.schema.json

@@ -0,0 +1,46 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "properties": {
+    "credentialConfigurationId": {
+      "description": "Optional credential configuration binding.",
+      "type": "string",
+      "minLength": 1
+    },
+    "keyChainId": {
+      "description": "Optional key chain to sign the list with.",
+      "type": "string",
+      "minLength": 1
+    },
+    "bits": {
+      "description": "Optional bits-per-status value.",
+      "anyOf": [
+        {
+          "type": "number",
+          "const": 1
+        },
+        {
+          "type": "number",
+          "const": 2
+        },
+        {
+          "type": "number",
+          "const": 4
+        },
+        {
+          "type": "number",
+          "const": 8
+        }
+      ]
+    },
+    "capacity": {
+      "description": "Optional status list capacity.",
+      "type": "integer",
+      "minimum": 1000,
+      "maximum": 9007199254740991
+    }
+  },
+  "additionalProperties": false,
+  "$id": "./CreateStatusListDto.schema.json",
+  "title": "CreateStatusListDto"
+}

package/templates/schemas/CreateTenantDto.schema.json

@@ -0,0 +1,117 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "properties": {
+    "id": {
+      "type": "string",
+      "minLength": 1,
+      "description": "Unique tenant identifier."
+    },
+    "name": {
+      "default": "EUDIPLO",
+      "description": "Display name of the tenant.",
+      "type": "string",
+      "minLength": 1
+    },
+    "description": {
+      "description": "Optional tenant description.",
+      "type": "string",
+      "minLength": 1
+    },
+    "roles": {
+      "description": "Optional default role assignments for the tenant.",
+      "type": "array",
+      "items": {
+        "type": "string",
+        "enum": [
+          "tenants:manage",
+          "issuance:offer",
+          "issuance:manage",
+          "presentation:request",
+          "presentation:manage",
+          "clients:manage",
+          "users:manage",
+          "registrar:manage",
+          "tenant:admin"
+        ]
+      }
+    },
+    "sessionConfig": {
+      "description": "Optional tenant-specific session storage configuration.",
+      "type": "object",
+      "properties": {
+        "ttlSeconds": {
+          "description": "Session time-to-live in seconds.",
+          "type": "integer",
+          "minimum": 60,
+          "maximum": 9007199254740991
+        },
+        "cleanupMode": {
+          "description": "Whether to fully delete or anonymize expired sessions.",
+          "type": "string",
+          "enum": [
+            "full",
+            "anonymize"
+          ]
+        }
+      },
+      "additionalProperties": false
+    },
+    "statusListConfig": {
+      "description": "Optional tenant-specific status list defaults.",
+      "type": "object",
+      "properties": {
+        "capacity": {
+          "description": "Default status list capacity.",
+          "type": "integer",
+          "minimum": 100,
+          "maximum": 9007199254740991
+        },
+        "bits": {
+          "description": "Bits-per-status setting (1, 2, 4, or 8).",
+          "anyOf": [
+            {
+              "type": "number",
+              "const": 1
+            },
+            {
+              "type": "number",
+              "const": 2
+            },
+            {
+              "type": "number",
+              "const": 4
+            },
+            {
+              "type": "number",
+              "const": 8
+            }
+          ]
+        },
+        "ttl": {
+          "description": "JWT TTL for status list tokens in seconds.",
+          "type": "integer",
+          "minimum": 60,
+          "maximum": 9007199254740991
+        },
+        "immediateUpdate": {
+          "description": "Regenerate status list JWTs immediately after status updates.",
+          "type": "boolean"
+        },
+        "enableAggregation": {
+          "description": "Include aggregation_uri in generated status list JWTs.",
+          "type": "boolean"
+        }
+      },
+      "additionalProperties": false
+    }
+  },
+  "required": [
+    "id",
+    "name"
+  ],
+  "additionalProperties": false,
+  "description": "Payload for creating a tenant.",
+  "$id": "./CreateTenantDto.schema.json",
+  "title": "CreateTenantDto"
+}