@eudiplo/cli 9.1.0-main.2d54936 → 9.1.0-main.3156bf0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (14) hide show
  1. package/dist/commands/config/portability/migrations.spec.js +3 -2
  2. package/dist/commands/config/portability/migrations.spec.js.map +1 -1
  3. package/dist/commands/config/validate/registry.json +10 -0
  4. package/dist/index.js +1945 -549
  5. package/package.json +2 -2
  6. package/templates/schemas/CreateFederationTrustAnchorDto.schema.json +82 -0
  7. package/templates/schemas/FederationTrustAnchorConfigFile.schema.json +60 -0
  8. package/templates/schemas/IssuanceConfig.schema.json +77 -2
  9. package/templates/schemas/IssuanceConfigFile.schema.json +739 -1
  10. package/templates/schemas/KeyChainConfigFile.schema.json +370 -1
  11. package/templates/schemas/KeyChainCreateDto.schema.json +1 -0
  12. package/templates/schemas/KeyChainImportDto.schema.json +1 -0
  13. package/templates/schemas/UpdateFederationTrustAnchorDto.schema.json +70 -0
  14. package/templates/schemas.manifest.json +3 -0
package/dist/index.js CHANGED
@@ -13749,6 +13749,16 @@ var registry_default = [
13749
13749
  "/apps/backend/test/fixtures/*/attribute-providers/*.json"
13750
13750
  ]
13751
13751
  },
13752
+ {
13753
+ kind: "directory",
13754
+ subfolder: "federation-trust-anchors",
13755
+ resourceType: "federation trust anchor",
13756
+ schemaFile: "FederationTrustAnchorConfigFile.schema.json",
13757
+ fileMatch: [
13758
+ "/assets/config/*/federation-trust-anchors/*.json",
13759
+ "/apps/backend/test/fixtures/*/federation-trust-anchors/*.json"
13760
+ ]
13761
+ },
13752
13762
  {
13753
13763
  kind: "directory",
13754
13764
  subfolder: "webhook-endpoints",
@@ -15084,7 +15094,7 @@ var CONFIG_FORMATS = {
15084
15094
  Tenant: { slug: "tenant", file: "TenantConfigFile", version: 1 },
15085
15095
  Client: { slug: "client", file: "ClientConfigFile", version: 2 },
15086
15096
  KmsConfig: { slug: "kms-config", file: "KmsConfigFile", version: 2 },
15087
- KeyChain: { slug: "key-chain", file: "KeyChainConfigFile", version: 2 },
15097
+ KeyChain: { slug: "key-chain", file: "KeyChainConfigFile", version: 3 },
15088
15098
  RegistrarConfig: {
15089
15099
  slug: "registrar-config",
15090
15100
  file: "RegistrarConfigFile",
@@ -15093,7 +15103,7 @@ var CONFIG_FORMATS = {
15093
15103
  IssuanceConfig: {
15094
15104
  slug: "issuance-config",
15095
15105
  file: "IssuanceConfigFile",
15096
- version: 4
15106
+ version: 5
15097
15107
  },
15098
15108
  CredentialConfig: {
15099
15109
  slug: "credential-config",
@@ -15116,6 +15126,11 @@ var CONFIG_FORMATS = {
15116
15126
  version: 1
15117
15127
  },
15118
15128
  TrustList: { slug: "trust-list", file: "TrustListConfigFile", version: 1 },
15129
+ FederationTrustAnchor: {
15130
+ slug: "federation-trust-anchor",
15131
+ file: "FederationTrustAnchorConfigFile",
15132
+ version: 1
15133
+ },
15119
15134
  StatusList: {
15120
15135
  slug: "status-list",
15121
15136
  file: "StatusListConfigFile",
@@ -15143,8 +15158,11 @@ function resourceId(input) {
15143
15158
  return id;
15144
15159
  }
15145
15160
  function bareFileVersion(kind, spec) {
15146
- if (kind === "KeyChain")
15161
+ if (kind === "KeyChain") {
15162
+ if (spec.usageType === "federation")
15163
+ return 3;
15147
15164
  return "type" in spec ? 2 : 1;
15165
+ }
15148
15166
  if (kind === "RegistrarConfig")
15149
15167
  return "relyingPartyContact" in spec ? 2 : 1;
15150
15168
  if (kind === "KmsConfig") {
@@ -15153,6 +15171,56 @@ function bareFileVersion(kind, spec) {
15153
15171
  }
15154
15172
  return 1;
15155
15173
  }
15174
+ var issuanceConfigV4ToV5 = {
15175
+ id: "issuance-config-v5-federation-entity",
15176
+ kind: "IssuanceConfig",
15177
+ from: 4,
15178
+ to: 5,
15179
+ migrate(spec) {
15180
+ const federation = spec.federation;
15181
+ const problem = object(federation) && typeof federation.entityId === "string" && federation.entityId !== "" ? federationEntityIdProblem(federation.entityId, {
15182
+ allowHttp: true
15183
+ }) : void 0;
15184
+ if (!problem)
15185
+ return { spec };
15186
+ return {
15187
+ spec,
15188
+ issues: [
15189
+ {
15190
+ severity: "required-input",
15191
+ code: "FEDERATION_ENTITY_ID_INVALID",
15192
+ path: "/spec/federation/entityId",
15193
+ message: `${problem}: set an https URL with a host and without query or fragment, usually <PUBLIC_URL>/issuers/<tenant>`
15194
+ }
15195
+ ]
15196
+ };
15197
+ }
15198
+ };
15199
+ function federationEntityIdProblem(entityId, options) {
15200
+ const value = `federation.entityId '${JSON.stringify(entityId).slice(1, -1)}'`;
15201
+ if (/[\s\u0000-\u001f\u007f]/.test(entityId)) {
15202
+ return `${value} must not contain whitespace or control characters`;
15203
+ }
15204
+ if (entityId.includes("?") || entityId.includes("#")) {
15205
+ return `${value} must not have a query or fragment`;
15206
+ }
15207
+ let url;
15208
+ try {
15209
+ url = new URL(entityId);
15210
+ } catch {
15211
+ return `${value} is not a URL`;
15212
+ }
15213
+ if (url.protocol !== "https:" && !(options.allowHttp && url.protocol === "http:")) {
15214
+ return options.allowHttp ? `${value} must be an https or http URL` : `${value} must be an https URL (http only with OUTBOUND_URL_ALLOW_HTTP=true)`;
15215
+ }
15216
+ if (url.href !== entityId && url.href !== `${entityId}/`) {
15217
+ return `${value} must be written as the URL it stands for: ${url.href}`;
15218
+ }
15219
+ if (url.username || url.password) {
15220
+ return `${value} must not contain credentials`;
15221
+ }
15222
+ return void 0;
15223
+ }
15156
15224
  var presentationConfigV1ToV2 = {
15157
15225
  id: "presentation-config-v2-provides-attestations",
15158
15226
  kind: "PresentationConfig",
@@ -15206,6 +15274,7 @@ var CONFIG_MIGRATIONS = [
15206
15274
  // a valid v4 spec.
15207
15275
  migrate: (spec) => ({ spec })
15208
15276
  },
15277
+ issuanceConfigV4ToV5,
15209
15278
  {
15210
15279
  id: "client-v2-read-and-status-roles",
15211
15280
  kind: "Client",
@@ -15244,6 +15313,15 @@ var CONFIG_MIGRATIONS = [
15244
15313
  // spec, imported as before.
15245
15314
  migrate: (spec) => ({ spec })
15246
15315
  },
15316
+ {
15317
+ id: "key-chain-v3-federation-usage",
15318
+ kind: "KeyChain",
15319
+ from: 2,
15320
+ to: 3,
15321
+ // v3 only adds the usage type `federation`: a v2 spec is a valid v3
15322
+ // spec.
15323
+ migrate: (spec) => ({ spec })
15324
+ },
15247
15325
  {
15248
15326
  id: "credential-config-v2-x509-trusted-authority",
15249
15327
  kind: "CredentialConfig",
@@ -16806,6 +16884,143 @@ var CONFIG_SCHEMAS = [
16806
16884
  }
16807
16885
  }
16808
16886
  },
16887
+ {
16888
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
16889
+ "$id": "https://eudiplo.dev/schemas/v1/FederationTrustAnchorConfigFile.schema.json",
16890
+ "title": "FederationTrustAnchorConfigFile",
16891
+ "type": "object",
16892
+ "properties": {
16893
+ "$schema": {
16894
+ "type": "string",
16895
+ "const": "https://eudiplo.dev/schemas/v1/FederationTrustAnchorConfigFile.schema.json"
16896
+ },
16897
+ "metadata": {
16898
+ "type": "object",
16899
+ "properties": {
16900
+ "generation": {
16901
+ "type": "integer",
16902
+ "minimum": 1,
16903
+ "description": "Monotonically increasing configuration generation."
16904
+ },
16905
+ "ownership": {
16906
+ "type": "string",
16907
+ "enum": [
16908
+ "unmanaged",
16909
+ "file-managed"
16910
+ ],
16911
+ "description": "Requested ownership recorded when the document is applied."
16912
+ }
16913
+ },
16914
+ "additionalProperties": false
16915
+ },
16916
+ "spec": {
16917
+ "allOf": [
16918
+ {
16919
+ "$ref": "#/$defs/CreateFederationTrustAnchorDto"
16920
+ },
16921
+ {
16922
+ "type": "object",
16923
+ "required": [
16924
+ "id"
16925
+ ],
16926
+ "properties": {
16927
+ "id": {
16928
+ "type": "string",
16929
+ "minLength": 1
16930
+ }
16931
+ }
16932
+ }
16933
+ ]
16934
+ }
16935
+ },
16936
+ "required": [
16937
+ "$schema",
16938
+ "spec"
16939
+ ],
16940
+ "additionalProperties": false,
16941
+ "$defs": {
16942
+ "CreateFederationTrustAnchorDto": {
16943
+ "type": "object",
16944
+ "properties": {
16945
+ "id": {
16946
+ "type": "string",
16947
+ "minLength": 1,
16948
+ "maxLength": 255,
16949
+ "pattern": "^[A-Za-z0-9._-]+$",
16950
+ "description": "Unique identifier of the trust anchor in the tenant."
16951
+ },
16952
+ "entityId": {
16953
+ "type": "string",
16954
+ "minLength": 1,
16955
+ "maxLength": 2048,
16956
+ "description": "Entity identifier of the trust anchor, exactly as configured in `federation.trustAnchors` and DCQL `openid_federation` values."
16957
+ },
16958
+ "description": {
16959
+ "anyOf": [
16960
+ {
16961
+ "type": "string",
16962
+ "minLength": 1,
16963
+ "maxLength": 1e3
16964
+ },
16965
+ {
16966
+ "type": "null"
16967
+ }
16968
+ ],
16969
+ "description": "Optional description of the trust anchor."
16970
+ },
16971
+ "jwks": {
16972
+ "type": "object",
16973
+ "properties": {
16974
+ "keys": {
16975
+ "minItems": 1,
16976
+ "maxItems": 20,
16977
+ "type": "array",
16978
+ "items": {
16979
+ "type": "object",
16980
+ "properties": {
16981
+ "kty": {
16982
+ "type": "string",
16983
+ "enum": [
16984
+ "EC",
16985
+ "RSA",
16986
+ "OKP"
16987
+ ],
16988
+ "description": "Key type of the public federation key."
16989
+ },
16990
+ "kid": {
16991
+ "type": "string",
16992
+ "minLength": 1,
16993
+ "maxLength": 256,
16994
+ "description": "Key ID. Federation statements name their signing key with `kid`."
16995
+ }
16996
+ },
16997
+ "required": [
16998
+ "kty",
16999
+ "kid"
17000
+ ],
17001
+ "additionalProperties": {},
17002
+ "description": "Public federation key of the trust anchor as a JWK."
17003
+ },
17004
+ "description": "The trust anchor's federation keys."
17005
+ }
17006
+ },
17007
+ "required": [
17008
+ "keys"
17009
+ ],
17010
+ "additionalProperties": false,
17011
+ "description": "JWK set with the federation keys of the trust anchor, obtained out of band (OpenID Federation 1.0 Section 10.2)."
17012
+ }
17013
+ },
17014
+ "required": [
17015
+ "id",
17016
+ "entityId",
17017
+ "jwks"
17018
+ ],
17019
+ "additionalProperties": false,
17020
+ "title": "CreateFederationTrustAnchorDto"
17021
+ }
17022
+ }
17023
+ },
16809
17024
  {
16810
17025
  "$schema": "https://json-schema.org/draft/2020-12/schema",
16811
17026
  "$id": "https://eudiplo.dev/schemas/v1/IssuanceConfigFile.schema.json",
@@ -25063,13 +25278,13 @@ var CONFIG_SCHEMAS = [
25063
25278
  },
25064
25279
  {
25065
25280
  "$schema": "https://json-schema.org/draft/2020-12/schema",
25066
- "$id": "https://eudiplo.dev/schemas/v3/PresentationConfigFile.schema.json",
25067
- "title": "PresentationConfigFile",
25281
+ "$id": "https://eudiplo.dev/schemas/v3/KeyChainConfigFile.schema.json",
25282
+ "title": "KeyChainConfigFile",
25068
25283
  "type": "object",
25069
25284
  "properties": {
25070
25285
  "$schema": {
25071
25286
  "type": "string",
25072
- "const": "https://eudiplo.dev/schemas/v3/PresentationConfigFile.schema.json"
25287
+ "const": "https://eudiplo.dev/schemas/v3/KeyChainConfigFile.schema.json"
25073
25288
  },
25074
25289
  "metadata": {
25075
25290
  "type": "object",
@@ -25077,126 +25292,678 @@ var CONFIG_SCHEMAS = [
25077
25292
  "generation": {
25078
25293
  "type": "integer",
25079
25294
  "minimum": 1,
25080
- "description": "Monotonically increasing configuration generation."
25295
+ "maximum": 9007199254740991
25081
25296
  },
25082
25297
  "ownership": {
25083
25298
  "type": "string",
25084
25299
  "enum": [
25085
25300
  "unmanaged",
25086
25301
  "file-managed"
25087
- ],
25088
- "description": "Requested ownership recorded when the document is applied."
25302
+ ]
25089
25303
  }
25090
25304
  },
25091
25305
  "additionalProperties": false
25092
25306
  },
25093
25307
  "spec": {
25094
- "allOf": [
25095
- {
25096
- "$ref": "#/$defs/PresentationConfigCreateDto"
25097
- },
25098
- {
25099
- "type": "object",
25100
- "required": [
25101
- "id"
25102
- ],
25103
- "properties": {
25104
- "id": {
25105
- "type": "string",
25106
- "minLength": 1
25107
- }
25108
- }
25109
- }
25110
- ]
25111
- }
25112
- },
25113
- "required": [
25114
- "$schema",
25115
- "spec"
25116
- ],
25117
- "additionalProperties": false,
25118
- "$defs": {
25119
- "PresentationConfigCreateDto": {
25120
25308
  "type": "object",
25121
25309
  "properties": {
25122
25310
  "id": {
25123
- "type": "string",
25124
- "minLength": 1,
25125
- "description": "Presentation configuration identifier."
25311
+ "type": "string"
25126
25312
  },
25127
25313
  "description": {
25128
- "description": "Optional presentation configuration description.",
25129
- "type": [
25130
- "string",
25131
- "null"
25132
- ]
25133
- },
25134
- "lifeTime": {
25135
- "description": "Presentation request lifetime in seconds.",
25136
- "type": "integer",
25137
- "minimum": 1,
25138
- "maximum": 9007199254740991
25314
+ "type": "string"
25139
25315
  },
25140
- "skewSeconds": {
25141
- "description": "Clock skew tolerance in seconds.",
25142
- "type": "integer",
25143
- "minimum": 0,
25144
- "maximum": 9007199254740991
25316
+ "usageType": {
25317
+ "type": "string",
25318
+ "enum": [
25319
+ "access",
25320
+ "attestation",
25321
+ "trustList",
25322
+ "statusList",
25323
+ "federation",
25324
+ "encrypt"
25325
+ ]
25145
25326
  },
25146
- "statusCheckMode": {
25147
- "description": "Revocation/status check mode.",
25327
+ "type": {
25328
+ "description": "Key chain type. For a `private-jwk` key source without `activeJwk`, `standalone` makes `jwk` the signing key and `crt` its chain, leaf first; `internalChain` makes `jwk` a CA key and the last `crt` entry its CA certificate (created if `crt` is omitted), and the import generates a new signing key with a certificate issued by it. Without `type`, `jwk` is a CA key only if `rotationPolicy.enabled` is true and `crt` is not a single self-signed certificate that is not a CA. For `regenerate`, it is the type of the new key chain and must equal `keySource.keyChainType` if both are set. For the other key sources, it must match the key chain they describe.",
25148
25329
  "type": "string",
25149
25330
  "enum": [
25150
- "strict",
25151
- "best_effort",
25152
- "disabled"
25331
+ "standalone",
25332
+ "internalChain"
25153
25333
  ]
25154
25334
  },
25155
- "dcql_query": {
25156
- "type": "object",
25157
- "properties": {
25158
- "credentials": {
25159
- "minItems": 1,
25160
- "type": "array",
25161
- "items": {
25162
- "oneOf": [
25163
- {
25164
- "type": "object",
25165
- "properties": {
25166
- "id": {
25167
- "type": "string",
25168
- "minLength": 1,
25169
- "pattern": "^[A-Za-z0-9_-]+$",
25170
- "description": "Credential query identifier."
25171
- },
25172
- "multiple": {
25173
- "description": "Allow multiple matching credentials.",
25174
- "type": "boolean"
25175
- },
25176
- "claim_sets": {
25177
- "description": "Optional claim set constraints.",
25178
- "type": "array",
25179
- "items": {
25180
- "type": "array",
25181
- "items": {
25182
- "type": "string"
25183
- }
25184
- }
25185
- },
25186
- "trusted_authorities": {
25187
- "description": "Optional trusted authority constraints.",
25188
- "type": "array",
25189
- "items": {
25190
- "oneOf": [
25191
- {
25192
- "type": "object",
25193
- "properties": {
25194
- "type": {
25195
- "type": "string",
25196
- "const": "etsi_tl",
25197
- "description": "Trusted authority type discriminator for ETSI trust lists."
25198
- },
25199
- "values": {
25335
+ "keySource": {
25336
+ "oneOf": [
25337
+ {
25338
+ "type": "object",
25339
+ "properties": {
25340
+ "type": {
25341
+ "type": "string",
25342
+ "const": "private-jwk"
25343
+ },
25344
+ "jwk": {
25345
+ "type": "object",
25346
+ "properties": {
25347
+ "kty": {
25348
+ "type": "string",
25349
+ "description": "Key type (for example EC)."
25350
+ },
25351
+ "x": {
25352
+ "type": "string",
25353
+ "description": "Elliptic curve public x coordinate."
25354
+ },
25355
+ "y": {
25356
+ "type": "string",
25357
+ "description": "Elliptic curve public y coordinate."
25358
+ },
25359
+ "crv": {
25360
+ "type": "string",
25361
+ "description": "Elliptic curve name."
25362
+ },
25363
+ "d": {
25364
+ "type": "string",
25365
+ "description": "Private key value."
25366
+ },
25367
+ "alg": {
25368
+ "description": "Optional algorithm hint.",
25369
+ "type": "string"
25370
+ },
25371
+ "kid": {
25372
+ "description": "Optional key identifier.",
25373
+ "type": "string"
25374
+ }
25375
+ },
25376
+ "required": [
25377
+ "kty",
25378
+ "x",
25379
+ "y",
25380
+ "crv",
25381
+ "d"
25382
+ ],
25383
+ "additionalProperties": false
25384
+ },
25385
+ "activeJwk": {
25386
+ "type": "object",
25387
+ "properties": {
25388
+ "kty": {
25389
+ "type": "string",
25390
+ "description": "Key type (for example EC)."
25391
+ },
25392
+ "x": {
25393
+ "type": "string",
25394
+ "description": "Elliptic curve public x coordinate."
25395
+ },
25396
+ "y": {
25397
+ "type": "string",
25398
+ "description": "Elliptic curve public y coordinate."
25399
+ },
25400
+ "crv": {
25401
+ "type": "string",
25402
+ "description": "Elliptic curve name."
25403
+ },
25404
+ "d": {
25405
+ "type": "string",
25406
+ "description": "Private key value."
25407
+ },
25408
+ "alg": {
25409
+ "description": "Optional algorithm hint.",
25410
+ "type": "string"
25411
+ },
25412
+ "kid": {
25413
+ "description": "Optional key identifier.",
25414
+ "type": "string"
25415
+ }
25416
+ },
25417
+ "required": [
25418
+ "kty",
25419
+ "x",
25420
+ "y",
25421
+ "crv",
25422
+ "d"
25423
+ ],
25424
+ "additionalProperties": false
25425
+ }
25426
+ },
25427
+ "required": [
25428
+ "type",
25429
+ "jwk"
25430
+ ],
25431
+ "additionalProperties": false
25432
+ },
25433
+ {
25434
+ "type": "object",
25435
+ "properties": {
25436
+ "type": {
25437
+ "type": "string",
25438
+ "const": "external-reference"
25439
+ },
25440
+ "provider": {
25441
+ "type": "string"
25442
+ },
25443
+ "externalKeyId": {
25444
+ "type": "string"
25445
+ },
25446
+ "publicJwk": {
25447
+ "type": "object",
25448
+ "properties": {
25449
+ "kty": {
25450
+ "type": "string"
25451
+ },
25452
+ "x": {
25453
+ "type": "string"
25454
+ },
25455
+ "y": {
25456
+ "type": "string"
25457
+ },
25458
+ "crv": {
25459
+ "type": "string"
25460
+ },
25461
+ "alg": {
25462
+ "type": "string"
25463
+ },
25464
+ "kid": {
25465
+ "type": "string"
25466
+ }
25467
+ },
25468
+ "required": [
25469
+ "kty",
25470
+ "x",
25471
+ "y",
25472
+ "crv"
25473
+ ],
25474
+ "additionalProperties": false
25475
+ },
25476
+ "activeExternalKeyId": {
25477
+ "type": "string"
25478
+ },
25479
+ "activePublicJwk": {
25480
+ "type": "object",
25481
+ "properties": {
25482
+ "kty": {
25483
+ "type": "string"
25484
+ },
25485
+ "x": {
25486
+ "type": "string"
25487
+ },
25488
+ "y": {
25489
+ "type": "string"
25490
+ },
25491
+ "crv": {
25492
+ "type": "string"
25493
+ },
25494
+ "alg": {
25495
+ "type": "string"
25496
+ },
25497
+ "kid": {
25498
+ "type": "string"
25499
+ }
25500
+ },
25501
+ "required": [
25502
+ "kty",
25503
+ "x",
25504
+ "y",
25505
+ "crv"
25506
+ ],
25507
+ "additionalProperties": false
25508
+ }
25509
+ },
25510
+ "required": [
25511
+ "type",
25512
+ "provider",
25513
+ "externalKeyId",
25514
+ "publicJwk"
25515
+ ],
25516
+ "additionalProperties": false
25517
+ },
25518
+ {
25519
+ "type": "object",
25520
+ "properties": {
25521
+ "type": {
25522
+ "type": "string",
25523
+ "const": "required"
25524
+ },
25525
+ "publicJwk": {
25526
+ "type": "object",
25527
+ "properties": {
25528
+ "kty": {
25529
+ "type": "string"
25530
+ },
25531
+ "x": {
25532
+ "type": "string"
25533
+ },
25534
+ "y": {
25535
+ "type": "string"
25536
+ },
25537
+ "crv": {
25538
+ "type": "string"
25539
+ },
25540
+ "alg": {
25541
+ "type": "string"
25542
+ },
25543
+ "kid": {
25544
+ "type": "string"
25545
+ }
25546
+ },
25547
+ "required": [
25548
+ "kty",
25549
+ "x",
25550
+ "y",
25551
+ "crv"
25552
+ ],
25553
+ "additionalProperties": false
25554
+ }
25555
+ },
25556
+ "required": [
25557
+ "type"
25558
+ ],
25559
+ "additionalProperties": false
25560
+ },
25561
+ {
25562
+ "type": "object",
25563
+ "properties": {
25564
+ "type": {
25565
+ "type": "string",
25566
+ "const": "regenerate"
25567
+ },
25568
+ "keyChainType": {
25569
+ "type": "string",
25570
+ "enum": [
25571
+ "standalone",
25572
+ "internalChain"
25573
+ ]
25574
+ }
25575
+ },
25576
+ "required": [
25577
+ "type"
25578
+ ],
25579
+ "additionalProperties": false
25580
+ }
25581
+ ]
25582
+ },
25583
+ "crt": {
25584
+ "type": "array",
25585
+ "items": {
25586
+ "type": "string"
25587
+ }
25588
+ },
25589
+ "activeCertificate": {
25590
+ "description": "Active certificate for an internal key chain.",
25591
+ "type": "string"
25592
+ },
25593
+ "kmsProvider": {
25594
+ "type": "string"
25595
+ },
25596
+ "rotationPolicy": {
25597
+ "type": "object",
25598
+ "properties": {
25599
+ "enabled": {
25600
+ "type": "boolean"
25601
+ },
25602
+ "intervalDays": {
25603
+ "anyOf": [
25604
+ {
25605
+ "type": "number",
25606
+ "minimum": 1,
25607
+ "maximum": 3650
25608
+ },
25609
+ {
25610
+ "type": "null"
25611
+ }
25612
+ ]
25613
+ },
25614
+ "certValidityDays": {
25615
+ "anyOf": [
25616
+ {
25617
+ "type": "number",
25618
+ "minimum": 1,
25619
+ "maximum": 3650
25620
+ },
25621
+ {
25622
+ "type": "null"
25623
+ }
25624
+ ]
25625
+ }
25626
+ },
25627
+ "required": [
25628
+ "enabled"
25629
+ ],
25630
+ "additionalProperties": false
25631
+ }
25632
+ },
25633
+ "required": [
25634
+ "usageType",
25635
+ "keySource"
25636
+ ],
25637
+ "additionalProperties": false
25638
+ }
25639
+ },
25640
+ "required": [
25641
+ "$schema",
25642
+ "metadata",
25643
+ "spec"
25644
+ ],
25645
+ "additionalProperties": false
25646
+ },
25647
+ {
25648
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
25649
+ "$id": "https://eudiplo.dev/schemas/v3/PresentationConfigFile.schema.json",
25650
+ "title": "PresentationConfigFile",
25651
+ "type": "object",
25652
+ "properties": {
25653
+ "$schema": {
25654
+ "type": "string",
25655
+ "const": "https://eudiplo.dev/schemas/v3/PresentationConfigFile.schema.json"
25656
+ },
25657
+ "metadata": {
25658
+ "type": "object",
25659
+ "properties": {
25660
+ "generation": {
25661
+ "type": "integer",
25662
+ "minimum": 1,
25663
+ "description": "Monotonically increasing configuration generation."
25664
+ },
25665
+ "ownership": {
25666
+ "type": "string",
25667
+ "enum": [
25668
+ "unmanaged",
25669
+ "file-managed"
25670
+ ],
25671
+ "description": "Requested ownership recorded when the document is applied."
25672
+ }
25673
+ },
25674
+ "additionalProperties": false
25675
+ },
25676
+ "spec": {
25677
+ "allOf": [
25678
+ {
25679
+ "$ref": "#/$defs/PresentationConfigCreateDto"
25680
+ },
25681
+ {
25682
+ "type": "object",
25683
+ "required": [
25684
+ "id"
25685
+ ],
25686
+ "properties": {
25687
+ "id": {
25688
+ "type": "string",
25689
+ "minLength": 1
25690
+ }
25691
+ }
25692
+ }
25693
+ ]
25694
+ }
25695
+ },
25696
+ "required": [
25697
+ "$schema",
25698
+ "spec"
25699
+ ],
25700
+ "additionalProperties": false,
25701
+ "$defs": {
25702
+ "PresentationConfigCreateDto": {
25703
+ "type": "object",
25704
+ "properties": {
25705
+ "id": {
25706
+ "type": "string",
25707
+ "minLength": 1,
25708
+ "description": "Presentation configuration identifier."
25709
+ },
25710
+ "description": {
25711
+ "description": "Optional presentation configuration description.",
25712
+ "type": [
25713
+ "string",
25714
+ "null"
25715
+ ]
25716
+ },
25717
+ "lifeTime": {
25718
+ "description": "Presentation request lifetime in seconds.",
25719
+ "type": "integer",
25720
+ "minimum": 1,
25721
+ "maximum": 9007199254740991
25722
+ },
25723
+ "skewSeconds": {
25724
+ "description": "Clock skew tolerance in seconds.",
25725
+ "type": "integer",
25726
+ "minimum": 0,
25727
+ "maximum": 9007199254740991
25728
+ },
25729
+ "statusCheckMode": {
25730
+ "description": "Revocation/status check mode.",
25731
+ "type": "string",
25732
+ "enum": [
25733
+ "strict",
25734
+ "best_effort",
25735
+ "disabled"
25736
+ ]
25737
+ },
25738
+ "dcql_query": {
25739
+ "type": "object",
25740
+ "properties": {
25741
+ "credentials": {
25742
+ "minItems": 1,
25743
+ "type": "array",
25744
+ "items": {
25745
+ "oneOf": [
25746
+ {
25747
+ "type": "object",
25748
+ "properties": {
25749
+ "id": {
25750
+ "type": "string",
25751
+ "minLength": 1,
25752
+ "pattern": "^[A-Za-z0-9_-]+$",
25753
+ "description": "Credential query identifier."
25754
+ },
25755
+ "multiple": {
25756
+ "description": "Allow multiple matching credentials.",
25757
+ "type": "boolean"
25758
+ },
25759
+ "claim_sets": {
25760
+ "description": "Optional claim set constraints.",
25761
+ "type": "array",
25762
+ "items": {
25763
+ "type": "array",
25764
+ "items": {
25765
+ "type": "string"
25766
+ }
25767
+ }
25768
+ },
25769
+ "trusted_authorities": {
25770
+ "description": "Optional trusted authority constraints.",
25771
+ "type": "array",
25772
+ "items": {
25773
+ "oneOf": [
25774
+ {
25775
+ "type": "object",
25776
+ "properties": {
25777
+ "type": {
25778
+ "type": "string",
25779
+ "const": "etsi_tl",
25780
+ "description": "Trusted authority type discriminator for ETSI trust lists."
25781
+ },
25782
+ "values": {
25783
+ "type": "array",
25784
+ "items": {
25785
+ "type": "object",
25786
+ "properties": {
25787
+ "trustListId": {
25788
+ "description": "Optional trust list id reference.",
25789
+ "type": "string"
25790
+ },
25791
+ "url": {
25792
+ "description": "Optional trust list URL reference.",
25793
+ "anyOf": [
25794
+ {
25795
+ "type": "string",
25796
+ "format": "uri"
25797
+ },
25798
+ {
25799
+ "type": "string",
25800
+ "pattern": "^<TENANT_URL>(?:\\/.*)?$"
25801
+ }
25802
+ ]
25803
+ },
25804
+ "verifierKey": {
25805
+ "description": "Optional verifier key material.",
25806
+ "type": "object",
25807
+ "propertyNames": {
25808
+ "type": "string"
25809
+ },
25810
+ "additionalProperties": {}
25811
+ },
25812
+ "verifierX509Der": {
25813
+ "description": "Optional verifier certificate in DER/base64 form.",
25814
+ "type": "string"
25815
+ }
25816
+ },
25817
+ "additionalProperties": false
25818
+ },
25819
+ "description": "Trust list references for ETSI TL verification."
25820
+ }
25821
+ },
25822
+ "required": [
25823
+ "type",
25824
+ "values"
25825
+ ],
25826
+ "additionalProperties": false
25827
+ },
25828
+ {
25829
+ "type": "object",
25830
+ "properties": {
25831
+ "type": {
25832
+ "type": "string",
25833
+ "const": "openid_federation",
25834
+ "description": "Trusted authority type discriminator for OpenID Federation."
25835
+ },
25836
+ "values": {
25837
+ "type": "array",
25838
+ "items": {
25839
+ "type": "string"
25840
+ },
25841
+ "description": "OpenID Federation authority identifiers."
25842
+ }
25843
+ },
25844
+ "required": [
25845
+ "type",
25846
+ "values"
25847
+ ],
25848
+ "additionalProperties": false
25849
+ }
25850
+ ]
25851
+ }
25852
+ },
25853
+ "format": {
25854
+ "type": "string",
25855
+ "const": "dc+sd-jwt",
25856
+ "description": "Credential format discriminator."
25857
+ },
25858
+ "meta": {
25859
+ "type": "object",
25860
+ "properties": {
25861
+ "vct_values": {
25862
+ "minItems": 1,
25863
+ "type": "array",
25864
+ "items": {
25865
+ "type": "string"
25866
+ },
25867
+ "description": "Accepted VCT values."
25868
+ }
25869
+ },
25870
+ "required": [
25871
+ "vct_values"
25872
+ ],
25873
+ "additionalProperties": false
25874
+ },
25875
+ "claims": {
25876
+ "description": "Optional claim-level constraints.",
25877
+ "type": "array",
25878
+ "items": {
25879
+ "type": "object",
25880
+ "properties": {
25881
+ "id": {
25882
+ "description": "Optional claim query id.",
25883
+ "type": "string"
25884
+ },
25885
+ "path": {
25886
+ "type": "array",
25887
+ "items": {
25888
+ "type": [
25889
+ "string",
25890
+ "number"
25891
+ ]
25892
+ },
25893
+ "description": "Path to the claim value in presented credentials."
25894
+ },
25895
+ "values": {
25896
+ "description": "Optional allowed values for the claim. A disclosed value must equal one of them in type and value.",
25897
+ "minItems": 1,
25898
+ "type": "array",
25899
+ "items": {
25900
+ "anyOf": [
25901
+ {
25902
+ "type": "string"
25903
+ },
25904
+ {
25905
+ "type": "integer",
25906
+ "minimum": -9007199254740991,
25907
+ "maximum": 9007199254740991
25908
+ },
25909
+ {
25910
+ "type": "boolean"
25911
+ }
25912
+ ]
25913
+ }
25914
+ }
25915
+ },
25916
+ "required": [
25917
+ "path"
25918
+ ],
25919
+ "additionalProperties": false
25920
+ }
25921
+ }
25922
+ },
25923
+ "required": [
25924
+ "id",
25925
+ "format",
25926
+ "meta"
25927
+ ],
25928
+ "additionalProperties": false
25929
+ },
25930
+ {
25931
+ "type": "object",
25932
+ "properties": {
25933
+ "id": {
25934
+ "type": "string",
25935
+ "minLength": 1,
25936
+ "pattern": "^[A-Za-z0-9_-]+$",
25937
+ "description": "Credential query identifier."
25938
+ },
25939
+ "multiple": {
25940
+ "description": "Allow multiple matching credentials.",
25941
+ "type": "boolean"
25942
+ },
25943
+ "claim_sets": {
25944
+ "description": "Optional claim set constraints.",
25945
+ "type": "array",
25946
+ "items": {
25947
+ "type": "array",
25948
+ "items": {
25949
+ "type": "string"
25950
+ }
25951
+ }
25952
+ },
25953
+ "trusted_authorities": {
25954
+ "description": "Optional trusted authority constraints.",
25955
+ "type": "array",
25956
+ "items": {
25957
+ "oneOf": [
25958
+ {
25959
+ "type": "object",
25960
+ "properties": {
25961
+ "type": {
25962
+ "type": "string",
25963
+ "const": "etsi_tl",
25964
+ "description": "Trusted authority type discriminator for ETSI trust lists."
25965
+ },
25966
+ "values": {
25200
25967
  "type": "array",
25201
25968
  "items": {
25202
25969
  "type": "object",
@@ -25269,405 +26036,968 @@ var CONFIG_SCHEMAS = [
25269
26036
  },
25270
26037
  "format": {
25271
26038
  "type": "string",
25272
- "const": "dc+sd-jwt",
25273
- "description": "Credential format discriminator."
25274
- },
25275
- "meta": {
25276
- "type": "object",
25277
- "properties": {
25278
- "vct_values": {
25279
- "minItems": 1,
25280
- "type": "array",
25281
- "items": {
25282
- "type": "string"
25283
- },
25284
- "description": "Accepted VCT values."
25285
- }
25286
- },
25287
- "required": [
25288
- "vct_values"
25289
- ],
25290
- "additionalProperties": false
26039
+ "const": "mso_mdoc",
26040
+ "description": "Credential format discriminator."
26041
+ },
26042
+ "meta": {
26043
+ "type": "object",
26044
+ "properties": {
26045
+ "doctype_value": {
26046
+ "type": "string",
26047
+ "minLength": 1,
26048
+ "description": "Expected mDoc doctype value."
26049
+ }
26050
+ },
26051
+ "required": [
26052
+ "doctype_value"
26053
+ ],
26054
+ "additionalProperties": false
26055
+ },
26056
+ "claims": {
26057
+ "description": "Optional mDoc claim-level constraints.",
26058
+ "type": "array",
26059
+ "items": {
26060
+ "type": "object",
26061
+ "properties": {
26062
+ "id": {
26063
+ "description": "Optional claim query id.",
26064
+ "type": "string"
26065
+ },
26066
+ "path": {
26067
+ "type": "array",
26068
+ "items": {
26069
+ "type": [
26070
+ "string",
26071
+ "number"
26072
+ ]
26073
+ },
26074
+ "description": "Path to the claim value in presented credentials."
26075
+ },
26076
+ "values": {
26077
+ "description": "Optional allowed values for the claim. A disclosed value must equal one of them in type and value.",
26078
+ "minItems": 1,
26079
+ "type": "array",
26080
+ "items": {
26081
+ "anyOf": [
26082
+ {
26083
+ "type": "string"
26084
+ },
26085
+ {
26086
+ "type": "integer",
26087
+ "minimum": -9007199254740991,
26088
+ "maximum": 9007199254740991
26089
+ },
26090
+ {
26091
+ "type": "boolean"
26092
+ }
26093
+ ]
26094
+ }
26095
+ },
26096
+ "intent_to_retain": {
26097
+ "description": "Whether relying party intends to retain the claim.",
26098
+ "type": "boolean"
26099
+ }
26100
+ },
26101
+ "required": [
26102
+ "path"
26103
+ ],
26104
+ "additionalProperties": false
26105
+ }
26106
+ }
26107
+ },
26108
+ "required": [
26109
+ "id",
26110
+ "format",
26111
+ "meta"
26112
+ ],
26113
+ "additionalProperties": false
26114
+ }
26115
+ ]
26116
+ },
26117
+ "description": "Credential queries requested by the verifier."
26118
+ },
26119
+ "credential_sets": {
26120
+ "description": "Optional higher-level credential set requirements.",
26121
+ "type": "array",
26122
+ "items": {
26123
+ "type": "object",
26124
+ "properties": {
26125
+ "options": {
26126
+ "minItems": 1,
26127
+ "type": "array",
26128
+ "items": {
26129
+ "minItems": 1,
26130
+ "type": "array",
26131
+ "items": {
26132
+ "type": "string"
26133
+ }
26134
+ },
26135
+ "description": "Alternative credential query id combinations."
26136
+ },
26137
+ "required": {
26138
+ "description": "Whether this credential set is mandatory.",
26139
+ "type": "boolean"
26140
+ }
26141
+ },
26142
+ "required": [
26143
+ "options"
26144
+ ],
26145
+ "additionalProperties": false
26146
+ }
26147
+ }
26148
+ },
26149
+ "required": [
26150
+ "credentials"
26151
+ ],
26152
+ "additionalProperties": false,
26153
+ "description": "DCQL query defining requested credentials and claims."
26154
+ },
26155
+ "transaction_data": {
26156
+ "description": "Optional transaction data descriptors.",
26157
+ "anyOf": [
26158
+ {
26159
+ "type": "array",
26160
+ "items": {
26161
+ "type": "object",
26162
+ "properties": {
26163
+ "type": {
26164
+ "type": "string",
26165
+ "description": "Transaction data type identifier."
26166
+ },
26167
+ "credential_ids": {
26168
+ "type": "array",
26169
+ "items": {
26170
+ "type": "string"
26171
+ },
26172
+ "description": "Credential query ids this transaction data applies to."
26173
+ },
26174
+ "payload": {
26175
+ "description": "Transaction details. Required for TS12 SCA transaction data."
26176
+ }
26177
+ },
26178
+ "required": [
26179
+ "type",
26180
+ "credential_ids"
26181
+ ],
26182
+ "additionalProperties": {}
26183
+ }
26184
+ },
26185
+ {
26186
+ "type": "null"
26187
+ }
26188
+ ]
26189
+ },
26190
+ "registration_cert": {
26191
+ "description": "Optional registration certificate request settings.",
26192
+ "anyOf": [
26193
+ {
26194
+ "type": "object",
26195
+ "properties": {
26196
+ "id": {
26197
+ "type": "string"
26198
+ },
26199
+ "body": {
26200
+ "type": "object",
26201
+ "properties": {
26202
+ "privacy_policy": {
26203
+ "type": "string"
26204
+ },
26205
+ "support_uri": {
26206
+ "type": "string"
26207
+ },
26208
+ "intermediary": {
26209
+ "type": "string"
26210
+ },
26211
+ "purpose": {
26212
+ "type": "array",
26213
+ "items": {
26214
+ "type": "object",
26215
+ "properties": {
26216
+ "lang": {
26217
+ "type": "string"
26218
+ },
26219
+ "content": {
26220
+ "type": "string"
26221
+ }
26222
+ },
26223
+ "required": [
26224
+ "lang",
26225
+ "content"
26226
+ ],
26227
+ "additionalProperties": false
26228
+ }
26229
+ },
26230
+ "credentials": {
26231
+ "type": "array",
26232
+ "items": {
26233
+ "type": "object",
26234
+ "propertyNames": {
26235
+ "type": "string"
26236
+ },
26237
+ "additionalProperties": {}
26238
+ }
26239
+ },
26240
+ "provides_attestations": {
26241
+ "type": "array",
26242
+ "items": {
26243
+ "type": "string",
26244
+ "minLength": 1
26245
+ }
26246
+ }
26247
+ },
26248
+ "additionalProperties": false
26249
+ },
26250
+ "jwt": {
26251
+ "type": "string"
26252
+ }
26253
+ },
26254
+ "additionalProperties": false
26255
+ },
26256
+ {
26257
+ "type": "null"
26258
+ }
26259
+ ]
26260
+ },
26261
+ "registrationCertImportJwt": {
26262
+ "description": "Optional imported registration certificate JWT.",
26263
+ "type": [
26264
+ "string",
26265
+ "null"
26266
+ ]
26267
+ },
26268
+ "registrationCertImportId": {
26269
+ "description": "Optional registrar-side registration certificate id.",
26270
+ "type": [
26271
+ "string",
26272
+ "null"
26273
+ ]
26274
+ },
26275
+ "registrationCertBodyPrivacyPolicy": {
26276
+ "description": "Optional registration certificate privacy policy URI.",
26277
+ "type": [
26278
+ "string",
26279
+ "null"
26280
+ ]
26281
+ },
26282
+ "registrationCertBodySupportUri": {
26283
+ "description": "Optional registration certificate support URI.",
26284
+ "type": [
26285
+ "string",
26286
+ "null"
26287
+ ]
26288
+ },
26289
+ "registrationCertBodyIntermediary": {
26290
+ "description": "Optional registration certificate intermediary.",
26291
+ "type": [
26292
+ "string",
26293
+ "null"
26294
+ ]
26295
+ },
26296
+ "registrationCertBodyPurpose": {
26297
+ "description": "Optional registration certificate purpose entries.",
26298
+ "anyOf": [
26299
+ {
26300
+ "type": "array",
26301
+ "items": {
26302
+ "type": "object",
26303
+ "properties": {
26304
+ "lang": {
26305
+ "type": "string"
26306
+ },
26307
+ "content": {
26308
+ "type": "string"
26309
+ }
26310
+ },
26311
+ "additionalProperties": false
26312
+ }
26313
+ },
26314
+ {
26315
+ "type": "null"
26316
+ }
26317
+ ]
26318
+ },
26319
+ "webhookEndpointId": {
26320
+ "description": "Optional webhook endpoint id for presentation callbacks.",
26321
+ "type": [
26322
+ "string",
26323
+ "null"
26324
+ ]
26325
+ },
26326
+ "attached": {
26327
+ "description": "Optional attachments included with presentation requests.",
26328
+ "anyOf": [
26329
+ {
26330
+ "type": "array",
26331
+ "items": {
26332
+ "type": "object",
26333
+ "properties": {
26334
+ "format": {
26335
+ "type": "string",
26336
+ "description": "Attachment format identifier."
26337
+ },
26338
+ "data": {
26339
+ "description": "Attachment payload."
26340
+ },
26341
+ "credential_ids": {
26342
+ "description": "Optional credential query ids bound to this attachment.",
26343
+ "type": "array",
26344
+ "items": {
26345
+ "type": "string"
26346
+ }
26347
+ }
26348
+ },
26349
+ "required": [
26350
+ "format",
26351
+ "data"
26352
+ ],
26353
+ "additionalProperties": false
26354
+ }
26355
+ },
26356
+ {
26357
+ "type": "null"
26358
+ }
26359
+ ]
26360
+ },
26361
+ "redirectUri": {
26362
+ "description": "Optional redirect URI after presentation completion.",
26363
+ "type": [
26364
+ "string",
26365
+ "null"
26366
+ ]
26367
+ },
26368
+ "accessKeyChainId": {
26369
+ "description": "Optional key chain id for access token/auth operations.",
26370
+ "type": [
26371
+ "string",
26372
+ "null"
26373
+ ]
26374
+ },
26375
+ "readerAuth": {
26376
+ "description": "Whether reader authentication is required for mDoc requests.",
26377
+ "type": [
26378
+ "boolean",
26379
+ "null"
26380
+ ]
26381
+ }
26382
+ },
26383
+ "required": [
26384
+ "id",
26385
+ "dcql_query"
26386
+ ],
26387
+ "additionalProperties": false,
26388
+ "title": "PresentationConfigCreateDto"
26389
+ }
26390
+ }
26391
+ },
26392
+ {
26393
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
26394
+ "$id": "https://eudiplo.dev/schemas/v4/IssuanceConfigFile.schema.json",
26395
+ "title": "IssuanceConfigFile",
26396
+ "type": "object",
26397
+ "properties": {
26398
+ "$schema": {
26399
+ "type": "string",
26400
+ "const": "https://eudiplo.dev/schemas/v4/IssuanceConfigFile.schema.json"
26401
+ },
26402
+ "metadata": {
26403
+ "type": "object",
26404
+ "properties": {
26405
+ "generation": {
26406
+ "type": "integer",
26407
+ "minimum": 1,
26408
+ "description": "Monotonically increasing configuration generation."
26409
+ },
26410
+ "ownership": {
26411
+ "type": "string",
26412
+ "enum": [
26413
+ "unmanaged",
26414
+ "file-managed"
26415
+ ],
26416
+ "description": "Requested ownership recorded when the document is applied."
26417
+ }
26418
+ },
26419
+ "additionalProperties": false
26420
+ },
26421
+ "spec": {
26422
+ "$ref": "#/$defs/IssuanceConfig"
26423
+ }
26424
+ },
26425
+ "required": [
26426
+ "$schema",
26427
+ "spec"
26428
+ ],
26429
+ "additionalProperties": false,
26430
+ "$defs": {
26431
+ "IssuanceConfig": {
26432
+ "type": "object",
26433
+ "properties": {
26434
+ "batchSize": {
26435
+ "description": "Optional issuance batch size.",
26436
+ "type": "integer",
26437
+ "minimum": 1,
26438
+ "maximum": 9007199254740991
26439
+ },
26440
+ "dPopRequired": {
26441
+ "description": "Require DPoP proofs for issuance endpoints.",
26442
+ "type": "boolean"
26443
+ },
26444
+ "walletAttestationRequired": {
26445
+ "description": "Default wallet attestation requirement for managed authorization servers.",
26446
+ "type": "boolean"
26447
+ },
26448
+ "walletProviderTrustLists": {
26449
+ "description": "Shared wallet provider trust lists for key attestations and default authorization server wallet authentication.",
26450
+ "type": "array",
26451
+ "items": {
26452
+ "type": "object",
26453
+ "properties": {
26454
+ "trustListId": {
26455
+ "type": "string",
26456
+ "minLength": 1
26457
+ },
26458
+ "url": {
26459
+ "description": "URL of the wallet provider trust list.",
26460
+ "type": "string",
26461
+ "format": "uri"
26462
+ },
26463
+ "verifierKey": {
26464
+ "description": "Optional verifier key material used for trust list verification.",
26465
+ "type": "object",
26466
+ "propertyNames": {
26467
+ "type": "string"
26468
+ },
26469
+ "additionalProperties": {}
26470
+ },
26471
+ "verifierKeyPem": {
26472
+ "description": "Optional verifier public key in SPKI PEM form (-----BEGIN PUBLIC KEY-----).",
26473
+ "type": "string",
26474
+ "pattern": "^\\s*-----BEGIN PUBLIC KEY-----[A-Za-z0-9+/=\\s]+-----END PUBLIC KEY-----\\s*$"
26475
+ },
26476
+ "verifierX509Der": {
26477
+ "description": "Optional verifier certificate in DER/base64 form.",
26478
+ "type": "string"
26479
+ }
26480
+ },
26481
+ "additionalProperties": false
26482
+ }
26483
+ },
26484
+ "walletAttestationStatusCheckMode": {
26485
+ "description": "Default status check mode for wallet attestations at managed authorization servers: strict, best_effort (default) or disabled.",
26486
+ "anyOf": [
26487
+ {
26488
+ "type": "string",
26489
+ "enum": [
26490
+ "strict",
26491
+ "best_effort",
26492
+ "disabled"
26493
+ ]
26494
+ },
26495
+ {
26496
+ "type": "null"
26497
+ }
26498
+ ]
26499
+ },
26500
+ "signingKeyId": {
26501
+ "description": "Default signing key chain id for credential issuance.",
26502
+ "type": "string",
26503
+ "minLength": 1
26504
+ },
26505
+ "authorizationServers": {
26506
+ "minItems": 1,
26507
+ "type": "array",
26508
+ "items": {
26509
+ "oneOf": [
26510
+ {
26511
+ "type": "object",
26512
+ "properties": {
26513
+ "type": {
26514
+ "type": "string",
26515
+ "const": "external",
26516
+ "description": "Use an externally managed authorization server."
26517
+ },
26518
+ "id": {
26519
+ "type": "string",
26520
+ "minLength": 1,
26521
+ "description": "Authorization server identifier."
26522
+ },
26523
+ "issuer": {
26524
+ "type": "string",
26525
+ "format": "uri",
26526
+ "description": "Issuer URL for the external authorization server."
26527
+ },
26528
+ "sessionBinding": {
26529
+ "description": "Explicit mapping from an external access-token claim to an existing issuance session.",
26530
+ "type": "object",
26531
+ "properties": {
26532
+ "method": {
26533
+ "type": "string",
26534
+ "const": "access_token_claim",
26535
+ "description": "Read the correlation value from a configured access-token claim."
25291
26536
  },
25292
- "claims": {
25293
- "description": "Optional claim-level constraints.",
25294
- "type": "array",
25295
- "items": {
25296
- "type": "object",
25297
- "properties": {
25298
- "id": {
25299
- "description": "Optional claim query id.",
25300
- "type": "string"
25301
- },
25302
- "path": {
25303
- "type": "array",
25304
- "items": {
25305
- "type": [
25306
- "string",
25307
- "number"
25308
- ]
25309
- },
25310
- "description": "Path to the claim value in presented credentials."
25311
- },
25312
- "values": {
25313
- "description": "Optional allowed values for the claim. A disclosed value must equal one of them in type and value.",
25314
- "minItems": 1,
25315
- "type": "array",
25316
- "items": {
25317
- "anyOf": [
25318
- {
25319
- "type": "string"
25320
- },
25321
- {
25322
- "type": "integer",
25323
- "minimum": -9007199254740991,
25324
- "maximum": 9007199254740991
25325
- },
25326
- {
25327
- "type": "boolean"
25328
- }
25329
- ]
25330
- }
25331
- }
25332
- },
25333
- "required": [
25334
- "path"
25335
- ],
25336
- "additionalProperties": false
25337
- }
26537
+ "claim": {
26538
+ "type": "string",
26539
+ "minLength": 1,
26540
+ "description": "Claim name that contains the issuance-session correlation value."
25338
26541
  }
25339
26542
  },
25340
26543
  "required": [
25341
- "id",
25342
- "format",
25343
- "meta"
26544
+ "method",
26545
+ "claim"
25344
26546
  ],
25345
26547
  "additionalProperties": false
25346
26548
  },
25347
- {
26549
+ "label": {
26550
+ "description": "Optional display label for UI selection.",
26551
+ "type": "string"
26552
+ },
26553
+ "enabled": {
26554
+ "description": "Whether this authorization server entry is enabled.",
26555
+ "type": "boolean"
26556
+ }
26557
+ },
26558
+ "required": [
26559
+ "type",
26560
+ "id",
26561
+ "issuer"
26562
+ ],
26563
+ "additionalProperties": false
26564
+ },
26565
+ {
26566
+ "type": "object",
26567
+ "properties": {
26568
+ "type": {
26569
+ "type": "string",
26570
+ "const": "oid4vp",
26571
+ "description": "Use OID4VP-based authorization server chaining."
26572
+ },
26573
+ "id": {
26574
+ "type": "string",
26575
+ "minLength": 1,
26576
+ "description": "Authorization server identifier."
26577
+ },
26578
+ "presentationConfigId": {
26579
+ "type": "string",
26580
+ "minLength": 1,
26581
+ "description": "Presentation configuration id used during authorization."
26582
+ },
26583
+ "immediateWalletRedirect": {
26584
+ "description": "Redirect wallets immediately after authorization response creation.",
26585
+ "type": "boolean"
26586
+ },
26587
+ "token": {
26588
+ "description": "Optional token issuance settings.",
26589
+ "type": "object",
26590
+ "properties": {
26591
+ "lifetimeSeconds": {
26592
+ "description": "Access token lifetime in seconds.",
26593
+ "type": "number",
26594
+ "minimum": 60
26595
+ },
26596
+ "signingKeyId": {
26597
+ "description": "Optional key chain id used to sign issued tokens.",
26598
+ "type": "string",
26599
+ "minLength": 1
26600
+ },
26601
+ "refreshTokenEnabled": {
26602
+ "description": "Enable issuing refresh tokens.",
26603
+ "type": "boolean"
26604
+ },
26605
+ "refreshTokenExpiresInSeconds": {
26606
+ "description": "Refresh token lifetime in seconds.",
26607
+ "type": "number",
26608
+ "minimum": 60
26609
+ }
26610
+ },
26611
+ "additionalProperties": false
26612
+ },
26613
+ "requireDPoP": {
26614
+ "description": "Require DPoP proofs for token/credential requests.",
26615
+ "type": "boolean"
26616
+ },
26617
+ "walletAttestationRequired": {
26618
+ "description": "Require wallet attestation for this authorization server.",
26619
+ "type": "boolean"
26620
+ },
26621
+ "walletProviderTrustLists": {
26622
+ "description": "Optional wallet provider trust list references for this authorization server.",
26623
+ "type": "array",
26624
+ "items": {
26625
+ "type": "object",
26626
+ "properties": {
26627
+ "trustListId": {
26628
+ "type": "string",
26629
+ "minLength": 1
26630
+ },
26631
+ "url": {
26632
+ "description": "URL of the wallet provider trust list.",
26633
+ "type": "string",
26634
+ "format": "uri"
26635
+ },
26636
+ "verifierKey": {
26637
+ "description": "Optional verifier key material used for trust list verification.",
26638
+ "type": "object",
26639
+ "propertyNames": {
26640
+ "type": "string"
26641
+ },
26642
+ "additionalProperties": {}
26643
+ },
26644
+ "verifierKeyPem": {
26645
+ "description": "Optional verifier public key in SPKI PEM form (-----BEGIN PUBLIC KEY-----).",
26646
+ "type": "string",
26647
+ "pattern": "^\\s*-----BEGIN PUBLIC KEY-----[A-Za-z0-9+/=\\s]+-----END PUBLIC KEY-----\\s*$"
26648
+ },
26649
+ "verifierX509Der": {
26650
+ "description": "Optional verifier certificate in DER/base64 form.",
26651
+ "type": "string"
26652
+ }
26653
+ },
26654
+ "additionalProperties": false
26655
+ }
26656
+ },
26657
+ "walletAttestationStatusCheckMode": {
26658
+ "description": "Status check mode for wallet attestations at this authorization server. Omit to inherit the issuance default.",
26659
+ "type": "string",
26660
+ "enum": [
26661
+ "strict",
26662
+ "best_effort",
26663
+ "disabled"
26664
+ ]
26665
+ },
26666
+ "label": {
26667
+ "description": "Optional display label for UI selection.",
26668
+ "type": "string"
26669
+ },
26670
+ "enabled": {
26671
+ "description": "Whether this authorization server entry is enabled.",
26672
+ "type": "boolean"
26673
+ }
26674
+ },
26675
+ "required": [
26676
+ "type",
26677
+ "id",
26678
+ "presentationConfigId"
26679
+ ],
26680
+ "additionalProperties": false
26681
+ },
26682
+ {
26683
+ "type": "object",
26684
+ "properties": {
26685
+ "type": {
26686
+ "type": "string",
26687
+ "const": "chained",
26688
+ "description": "Use upstream OIDC as authorization source."
26689
+ },
26690
+ "id": {
26691
+ "type": "string",
26692
+ "minLength": 1,
26693
+ "description": "Authorization server identifier."
26694
+ },
26695
+ "upstream": {
25348
26696
  "type": "object",
25349
26697
  "properties": {
25350
- "id": {
26698
+ "issuer": {
25351
26699
  "type": "string",
25352
- "minLength": 1,
25353
- "pattern": "^[A-Za-z0-9_-]+$",
25354
- "description": "Credential query identifier."
26700
+ "format": "uri",
26701
+ "description": "Upstream OIDC issuer URL."
25355
26702
  },
25356
- "multiple": {
25357
- "description": "Allow multiple matching credentials.",
25358
- "type": "boolean"
26703
+ "clientId": {
26704
+ "type": "string",
26705
+ "minLength": 1,
26706
+ "description": "Client id for upstream OIDC authentication."
25359
26707
  },
25360
- "claim_sets": {
25361
- "description": "Optional claim set constraints.",
25362
- "type": "array",
25363
- "items": {
25364
- "type": "array",
25365
- "items": {
25366
- "type": "string"
25367
- }
25368
- }
26708
+ "clientSecret": {
26709
+ "description": "Optional client secret for upstream OIDC authentication.",
26710
+ "type": "string",
26711
+ "minLength": 1
25369
26712
  },
25370
- "trusted_authorities": {
25371
- "description": "Optional trusted authority constraints.",
26713
+ "scopes": {
26714
+ "description": "Optional scopes requested from the upstream issuer.",
25372
26715
  "type": "array",
25373
26716
  "items": {
25374
- "oneOf": [
25375
- {
25376
- "type": "object",
25377
- "properties": {
25378
- "type": {
25379
- "type": "string",
25380
- "const": "etsi_tl",
25381
- "description": "Trusted authority type discriminator for ETSI trust lists."
25382
- },
25383
- "values": {
25384
- "type": "array",
25385
- "items": {
25386
- "type": "object",
25387
- "properties": {
25388
- "trustListId": {
25389
- "description": "Optional trust list id reference.",
25390
- "type": "string"
25391
- },
25392
- "url": {
25393
- "description": "Optional trust list URL reference.",
25394
- "anyOf": [
25395
- {
25396
- "type": "string",
25397
- "format": "uri"
25398
- },
25399
- {
25400
- "type": "string",
25401
- "pattern": "^<TENANT_URL>(?:\\/.*)?$"
25402
- }
25403
- ]
25404
- },
25405
- "verifierKey": {
25406
- "description": "Optional verifier key material.",
25407
- "type": "object",
25408
- "propertyNames": {
25409
- "type": "string"
25410
- },
25411
- "additionalProperties": {}
25412
- },
25413
- "verifierX509Der": {
25414
- "description": "Optional verifier certificate in DER/base64 form.",
25415
- "type": "string"
25416
- }
25417
- },
25418
- "additionalProperties": false
25419
- },
25420
- "description": "Trust list references for ETSI TL verification."
25421
- }
25422
- },
25423
- "required": [
25424
- "type",
25425
- "values"
25426
- ],
25427
- "additionalProperties": false
25428
- },
25429
- {
25430
- "type": "object",
25431
- "properties": {
25432
- "type": {
25433
- "type": "string",
25434
- "const": "openid_federation",
25435
- "description": "Trusted authority type discriminator for OpenID Federation."
25436
- },
25437
- "values": {
25438
- "type": "array",
25439
- "items": {
25440
- "type": "string"
25441
- },
25442
- "description": "OpenID Federation authority identifiers."
25443
- }
25444
- },
25445
- "required": [
25446
- "type",
25447
- "values"
25448
- ],
25449
- "additionalProperties": false
25450
- }
25451
- ]
26717
+ "type": "string",
26718
+ "minLength": 1
25452
26719
  }
26720
+ }
26721
+ },
26722
+ "required": [
26723
+ "issuer",
26724
+ "clientId"
26725
+ ],
26726
+ "additionalProperties": false,
26727
+ "description": "Upstream OIDC connection settings."
26728
+ },
26729
+ "token": {
26730
+ "description": "Optional token issuance settings.",
26731
+ "type": "object",
26732
+ "properties": {
26733
+ "lifetimeSeconds": {
26734
+ "description": "Access token lifetime in seconds.",
26735
+ "type": "number",
26736
+ "minimum": 60
25453
26737
  },
25454
- "format": {
26738
+ "signingKeyId": {
26739
+ "description": "Optional key chain id used to sign issued tokens.",
25455
26740
  "type": "string",
25456
- "const": "mso_mdoc",
25457
- "description": "Credential format discriminator."
26741
+ "minLength": 1
25458
26742
  },
25459
- "meta": {
25460
- "type": "object",
25461
- "properties": {
25462
- "doctype_value": {
25463
- "type": "string",
25464
- "minLength": 1,
25465
- "description": "Expected mDoc doctype value."
25466
- }
25467
- },
25468
- "required": [
25469
- "doctype_value"
25470
- ],
25471
- "additionalProperties": false
26743
+ "refreshTokenEnabled": {
26744
+ "description": "Enable issuing refresh tokens.",
26745
+ "type": "boolean"
25472
26746
  },
25473
- "claims": {
25474
- "description": "Optional mDoc claim-level constraints.",
25475
- "type": "array",
25476
- "items": {
25477
- "type": "object",
25478
- "properties": {
25479
- "id": {
25480
- "description": "Optional claim query id.",
25481
- "type": "string"
25482
- },
25483
- "path": {
25484
- "type": "array",
25485
- "items": {
25486
- "type": [
25487
- "string",
25488
- "number"
25489
- ]
25490
- },
25491
- "description": "Path to the claim value in presented credentials."
25492
- },
25493
- "values": {
25494
- "description": "Optional allowed values for the claim. A disclosed value must equal one of them in type and value.",
25495
- "minItems": 1,
25496
- "type": "array",
25497
- "items": {
25498
- "anyOf": [
25499
- {
25500
- "type": "string"
25501
- },
25502
- {
25503
- "type": "integer",
25504
- "minimum": -9007199254740991,
25505
- "maximum": 9007199254740991
25506
- },
25507
- {
25508
- "type": "boolean"
25509
- }
25510
- ]
25511
- }
25512
- },
25513
- "intent_to_retain": {
25514
- "description": "Whether relying party intends to retain the claim.",
25515
- "type": "boolean"
25516
- }
25517
- },
25518
- "required": [
25519
- "path"
25520
- ],
25521
- "additionalProperties": false
25522
- }
26747
+ "refreshTokenExpiresInSeconds": {
26748
+ "description": "Refresh token lifetime in seconds.",
26749
+ "type": "number",
26750
+ "minimum": 60
25523
26751
  }
25524
26752
  },
25525
- "required": [
25526
- "id",
25527
- "format",
25528
- "meta"
25529
- ],
25530
26753
  "additionalProperties": false
25531
- }
25532
- ]
25533
- },
25534
- "description": "Credential queries requested by the verifier."
25535
- },
25536
- "credential_sets": {
25537
- "description": "Optional higher-level credential set requirements.",
25538
- "type": "array",
25539
- "items": {
25540
- "type": "object",
25541
- "properties": {
25542
- "options": {
25543
- "minItems": 1,
26754
+ },
26755
+ "requireDPoP": {
26756
+ "description": "Require DPoP proofs for token/credential requests.",
26757
+ "type": "boolean"
26758
+ },
26759
+ "walletAttestationRequired": {
26760
+ "description": "Require wallet attestation for this authorization server.",
26761
+ "type": "boolean"
26762
+ },
26763
+ "walletProviderTrustLists": {
26764
+ "description": "Optional wallet provider trust list references for this authorization server.",
25544
26765
  "type": "array",
25545
26766
  "items": {
25546
- "minItems": 1,
25547
- "type": "array",
25548
- "items": {
25549
- "type": "string"
25550
- }
25551
- },
25552
- "description": "Alternative credential query id combinations."
26767
+ "type": "object",
26768
+ "properties": {
26769
+ "trustListId": {
26770
+ "type": "string",
26771
+ "minLength": 1
26772
+ },
26773
+ "url": {
26774
+ "description": "URL of the wallet provider trust list.",
26775
+ "type": "string",
26776
+ "format": "uri"
26777
+ },
26778
+ "verifierKey": {
26779
+ "description": "Optional verifier key material used for trust list verification.",
26780
+ "type": "object",
26781
+ "propertyNames": {
26782
+ "type": "string"
26783
+ },
26784
+ "additionalProperties": {}
26785
+ },
26786
+ "verifierKeyPem": {
26787
+ "description": "Optional verifier public key in SPKI PEM form (-----BEGIN PUBLIC KEY-----).",
26788
+ "type": "string",
26789
+ "pattern": "^\\s*-----BEGIN PUBLIC KEY-----[A-Za-z0-9+/=\\s]+-----END PUBLIC KEY-----\\s*$"
26790
+ },
26791
+ "verifierX509Der": {
26792
+ "description": "Optional verifier certificate in DER/base64 form.",
26793
+ "type": "string"
26794
+ }
26795
+ },
26796
+ "additionalProperties": false
26797
+ }
25553
26798
  },
25554
- "required": {
25555
- "description": "Whether this credential set is mandatory.",
26799
+ "walletAttestationStatusCheckMode": {
26800
+ "description": "Status check mode for wallet attestations at this authorization server. Omit to inherit the issuance default.",
26801
+ "type": "string",
26802
+ "enum": [
26803
+ "strict",
26804
+ "best_effort",
26805
+ "disabled"
26806
+ ]
26807
+ },
26808
+ "label": {
26809
+ "description": "Optional display label for UI selection.",
26810
+ "type": "string"
26811
+ },
26812
+ "enabled": {
26813
+ "description": "Whether this authorization server entry is enabled.",
25556
26814
  "type": "boolean"
25557
26815
  }
25558
26816
  },
25559
26817
  "required": [
25560
- "options"
26818
+ "type",
26819
+ "id",
26820
+ "upstream"
25561
26821
  ],
25562
26822
  "additionalProperties": false
25563
- }
25564
- }
25565
- },
25566
- "required": [
25567
- "credentials"
25568
- ],
25569
- "additionalProperties": false,
25570
- "description": "DCQL query defining requested credentials and claims."
25571
- },
25572
- "transaction_data": {
25573
- "description": "Optional transaction data descriptors.",
25574
- "anyOf": [
25575
- {
25576
- "type": "array",
25577
- "items": {
26823
+ },
26824
+ {
25578
26825
  "type": "object",
25579
26826
  "properties": {
25580
26827
  "type": {
25581
26828
  "type": "string",
25582
- "description": "Transaction data type identifier."
26829
+ "const": "built-in",
26830
+ "description": "Use EUDIPLO built-in authorization server."
25583
26831
  },
25584
- "credential_ids": {
26832
+ "id": {
26833
+ "type": "string",
26834
+ "minLength": 1,
26835
+ "description": "Authorization server identifier."
26836
+ },
26837
+ "token": {
26838
+ "description": "Optional token issuance settings.",
26839
+ "type": "object",
26840
+ "properties": {
26841
+ "lifetimeSeconds": {
26842
+ "description": "Access token lifetime in seconds.",
26843
+ "type": "number",
26844
+ "minimum": 60
26845
+ },
26846
+ "signingKeyId": {
26847
+ "description": "Optional key chain id used to sign issued tokens.",
26848
+ "type": "string",
26849
+ "minLength": 1
26850
+ },
26851
+ "refreshTokenEnabled": {
26852
+ "description": "Enable issuing refresh tokens.",
26853
+ "type": "boolean"
26854
+ },
26855
+ "refreshTokenExpiresInSeconds": {
26856
+ "description": "Refresh token lifetime in seconds.",
26857
+ "type": "number",
26858
+ "minimum": 60
26859
+ }
26860
+ },
26861
+ "additionalProperties": false
26862
+ },
26863
+ "requireDPoP": {
26864
+ "description": "Require DPoP proofs for token/credential requests.",
26865
+ "type": "boolean"
26866
+ },
26867
+ "walletAttestationRequired": {
26868
+ "description": "Require wallet attestation for this authorization server.",
26869
+ "type": "boolean"
26870
+ },
26871
+ "walletProviderTrustLists": {
26872
+ "description": "Optional wallet provider trust list references for this authorization server.",
25585
26873
  "type": "array",
25586
26874
  "items": {
25587
- "type": "string"
25588
- },
25589
- "description": "Credential query ids this transaction data applies to."
26875
+ "type": "object",
26876
+ "properties": {
26877
+ "trustListId": {
26878
+ "type": "string",
26879
+ "minLength": 1
26880
+ },
26881
+ "url": {
26882
+ "description": "URL of the wallet provider trust list.",
26883
+ "type": "string",
26884
+ "format": "uri"
26885
+ },
26886
+ "verifierKey": {
26887
+ "description": "Optional verifier key material used for trust list verification.",
26888
+ "type": "object",
26889
+ "propertyNames": {
26890
+ "type": "string"
26891
+ },
26892
+ "additionalProperties": {}
26893
+ },
26894
+ "verifierKeyPem": {
26895
+ "description": "Optional verifier public key in SPKI PEM form (-----BEGIN PUBLIC KEY-----).",
26896
+ "type": "string",
26897
+ "pattern": "^\\s*-----BEGIN PUBLIC KEY-----[A-Za-z0-9+/=\\s]+-----END PUBLIC KEY-----\\s*$"
26898
+ },
26899
+ "verifierX509Der": {
26900
+ "description": "Optional verifier certificate in DER/base64 form.",
26901
+ "type": "string"
26902
+ }
26903
+ },
26904
+ "additionalProperties": false
26905
+ }
25590
26906
  },
25591
- "payload": {
25592
- "description": "Transaction details. Required for TS12 SCA transaction data."
26907
+ "walletAttestationStatusCheckMode": {
26908
+ "description": "Status check mode for wallet attestations at this authorization server. Omit to inherit the issuance default.",
26909
+ "type": "string",
26910
+ "enum": [
26911
+ "strict",
26912
+ "best_effort",
26913
+ "disabled"
26914
+ ]
26915
+ },
26916
+ "label": {
26917
+ "description": "Optional display label for UI selection.",
26918
+ "type": "string"
26919
+ },
26920
+ "enabled": {
26921
+ "description": "Whether this authorization server entry is enabled.",
26922
+ "type": "boolean"
25593
26923
  }
25594
26924
  },
25595
26925
  "required": [
25596
26926
  "type",
25597
- "credential_ids"
26927
+ "id"
25598
26928
  ],
25599
- "additionalProperties": {}
26929
+ "additionalProperties": false
25600
26930
  }
25601
- },
25602
- {
25603
- "type": "null"
25604
- }
25605
- ]
26931
+ ],
26932
+ "description": "Supported authorization server configurations."
26933
+ },
26934
+ "description": "Configured authorization server entries."
25606
26935
  },
25607
- "registration_cert": {
25608
- "description": "Optional registration certificate request settings.",
26936
+ "federation": {
26937
+ "description": "Optional OpenID Federation settings.",
25609
26938
  "anyOf": [
25610
26939
  {
25611
26940
  "type": "object",
25612
26941
  "properties": {
25613
- "id": {
26942
+ "role": {
26943
+ "description": "Federation role for this issuer.",
26944
+ "type": "string",
26945
+ "enum": [
26946
+ "trust_anchor",
26947
+ "intermediate",
26948
+ "leaf"
26949
+ ]
26950
+ },
26951
+ "mode": {
26952
+ "description": "Federation operation mode.",
26953
+ "type": "string",
26954
+ "enum": [
26955
+ "federation-only",
26956
+ "hybrid"
26957
+ ]
26958
+ },
26959
+ "entityId": {
26960
+ "description": "Optional local federation entity id.",
25614
26961
  "type": "string"
25615
26962
  },
25616
- "body": {
25617
- "type": "object",
25618
- "properties": {
25619
- "privacy_policy": {
25620
- "type": "string"
25621
- },
25622
- "support_uri": {
25623
- "type": "string"
25624
- },
25625
- "intermediary": {
25626
- "type": "string"
25627
- },
25628
- "purpose": {
25629
- "type": "array",
25630
- "items": {
25631
- "type": "object",
25632
- "properties": {
25633
- "lang": {
25634
- "type": "string"
25635
- },
25636
- "content": {
25637
- "type": "string"
25638
- }
25639
- },
25640
- "required": [
25641
- "lang",
25642
- "content"
25643
- ],
25644
- "additionalProperties": false
25645
- }
25646
- },
25647
- "credentials": {
25648
- "type": "array",
25649
- "items": {
25650
- "type": "object",
25651
- "propertyNames": {
25652
- "type": "string"
25653
- },
25654
- "additionalProperties": {}
25655
- }
25656
- },
25657
- "provides_attestations": {
25658
- "type": "array",
25659
- "items": {
26963
+ "enforceSigningPolicy": {
26964
+ "description": "Enforce strict signing policy checks.",
26965
+ "type": "boolean"
26966
+ },
26967
+ "cacheTtlSeconds": {
26968
+ "description": "Cache time-to-live for federation metadata in seconds.",
26969
+ "type": "integer",
26970
+ "minimum": 1,
26971
+ "maximum": 9007199254740991
26972
+ },
26973
+ "trustAnchors": {
26974
+ "type": "array",
26975
+ "items": {
26976
+ "type": "object",
26977
+ "properties": {
26978
+ "entityId": {
26979
+ "type": "string",
26980
+ "minLength": 1,
26981
+ "description": "Federation trust anchor entity id."
26982
+ },
26983
+ "entityConfigurationUri": {
25660
26984
  "type": "string",
25661
- "minLength": 1
26985
+ "format": "uri",
26986
+ "description": "Entity configuration URI for the trust anchor."
25662
26987
  }
25663
- }
26988
+ },
26989
+ "required": [
26990
+ "entityId",
26991
+ "entityConfigurationUri"
26992
+ ],
26993
+ "additionalProperties": false
25664
26994
  },
25665
- "additionalProperties": false
25666
- },
25667
- "jwt": {
25668
- "type": "string"
26995
+ "description": "Federation trust anchors."
25669
26996
  }
25670
26997
  },
26998
+ "required": [
26999
+ "trustAnchors"
27000
+ ],
25671
27001
  "additionalProperties": false
25672
27002
  },
25673
27003
  {
@@ -25675,146 +27005,137 @@ var CONFIG_SCHEMAS = [
25675
27005
  }
25676
27006
  ]
25677
27007
  },
25678
- "registrationCertImportJwt": {
25679
- "description": "Optional imported registration certificate JWT.",
25680
- "type": [
25681
- "string",
25682
- "null"
25683
- ]
25684
- },
25685
- "registrationCertImportId": {
25686
- "description": "Optional registrar-side registration certificate id.",
25687
- "type": [
25688
- "string",
25689
- "null"
25690
- ]
25691
- },
25692
- "registrationCertBodyPrivacyPolicy": {
25693
- "description": "Optional registration certificate privacy policy URI.",
25694
- "type": [
25695
- "string",
25696
- "null"
25697
- ]
25698
- },
25699
- "registrationCertBodySupportUri": {
25700
- "description": "Optional registration certificate support URI.",
25701
- "type": [
25702
- "string",
25703
- "null"
25704
- ]
25705
- },
25706
- "registrationCertBodyIntermediary": {
25707
- "description": "Optional registration certificate intermediary.",
25708
- "type": [
25709
- "string",
25710
- "null"
25711
- ]
25712
- },
25713
- "registrationCertBodyPurpose": {
25714
- "description": "Optional registration certificate purpose entries.",
27008
+ "registrationCertificate": {
27009
+ "description": "Optional registration certificate settings.",
25715
27010
  "anyOf": [
25716
27011
  {
25717
- "type": "array",
25718
- "items": {
25719
- "type": "object",
25720
- "properties": {
25721
- "lang": {
25722
- "type": "string"
25723
- },
25724
- "content": {
25725
- "type": "string"
25726
- }
27012
+ "type": "object",
27013
+ "properties": {
27014
+ "enabled": {
27015
+ "description": "Enable issuer registration certificate support.",
27016
+ "type": "boolean"
25727
27017
  },
25728
- "additionalProperties": false
25729
- }
27018
+ "mode": {
27019
+ "description": "How registration certificate data is provided.",
27020
+ "type": "string",
27021
+ "enum": [
27022
+ "import",
27023
+ "generate"
27024
+ ]
27025
+ },
27026
+ "jwt": {
27027
+ "description": "Optional registration certificate JWT when using import mode.",
27028
+ "type": "string"
27029
+ },
27030
+ "privacyPolicy": {
27031
+ "description": "Optional privacy policy URI.",
27032
+ "type": "string"
27033
+ },
27034
+ "supportUri": {
27035
+ "description": "Optional support URI.",
27036
+ "type": "string"
27037
+ }
27038
+ },
27039
+ "additionalProperties": false
25730
27040
  },
25731
27041
  {
25732
27042
  "type": "null"
25733
27043
  }
25734
27044
  ]
25735
27045
  },
25736
- "webhookEndpointId": {
25737
- "description": "Optional webhook endpoint id for presentation callbacks.",
25738
- "type": [
25739
- "string",
25740
- "null"
25741
- ]
25742
- },
25743
- "attached": {
25744
- "description": "Optional attachments included with presentation requests.",
25745
- "anyOf": [
25746
- {
25747
- "type": "array",
25748
- "items": {
27046
+ "display": {
27047
+ "description": "Localized issuer metadata shown to wallets.",
27048
+ "type": "array",
27049
+ "items": {
27050
+ "type": "object",
27051
+ "properties": {
27052
+ "name": {
27053
+ "description": "Issuer display name.",
27054
+ "type": "string"
27055
+ },
27056
+ "locale": {
27057
+ "description": "Locale tag for this display entry.",
27058
+ "type": "string"
27059
+ },
27060
+ "logo": {
27061
+ "description": "Optional issuer logo metadata.",
25749
27062
  "type": "object",
25750
27063
  "properties": {
25751
- "format": {
27064
+ "uri": {
25752
27065
  "type": "string",
25753
- "description": "Attachment format identifier."
25754
- },
25755
- "data": {
25756
- "description": "Attachment payload."
27066
+ "minLength": 1,
27067
+ "description": "Logo URI."
25757
27068
  },
25758
- "credential_ids": {
25759
- "description": "Optional credential query ids bound to this attachment.",
25760
- "type": "array",
25761
- "items": {
25762
- "type": "string"
25763
- }
27069
+ "alt_text": {
27070
+ "description": "Optional localized alternative text.",
27071
+ "type": "string"
25764
27072
  }
25765
27073
  },
25766
27074
  "required": [
25767
- "format",
25768
- "data"
27075
+ "uri"
25769
27076
  ],
25770
- "additionalProperties": false
27077
+ "additionalProperties": {}
25771
27078
  }
25772
27079
  },
27080
+ "additionalProperties": {}
27081
+ }
27082
+ },
27083
+ "notificationEndpointEnabled": {
27084
+ "description": "Whether the OID4VCI notification endpoint is exposed for this issuance configuration.",
27085
+ "type": "boolean"
27086
+ },
27087
+ "credentialResponseEncryption": {
27088
+ "description": "Enable encrypted credential responses.",
27089
+ "type": "boolean"
27090
+ },
27091
+ "credentialRequestEncryption": {
27092
+ "description": "Require encrypted credential requests.",
27093
+ "type": "boolean"
27094
+ },
27095
+ "txCodeMaxAttempts": {
27096
+ "description": "Maximum verification attempts for transaction codes. Null resets to defaults.",
27097
+ "anyOf": [
27098
+ {
27099
+ "type": "integer",
27100
+ "minimum": 1,
27101
+ "maximum": 9007199254740991
27102
+ },
25773
27103
  {
25774
27104
  "type": "null"
25775
27105
  }
25776
27106
  ]
25777
27107
  },
25778
- "redirectUri": {
25779
- "description": "Optional redirect URI after presentation completion.",
25780
- "type": [
25781
- "string",
25782
- "null"
25783
- ]
25784
- },
25785
- "accessKeyChainId": {
25786
- "description": "Optional key chain id for access token/auth operations.",
25787
- "type": [
25788
- "string",
25789
- "null"
25790
- ]
25791
- },
25792
- "readerAuth": {
25793
- "description": "Whether reader authentication is required for mDoc requests.",
25794
- "type": [
25795
- "boolean",
25796
- "null"
27108
+ "offerLifetimeSeconds": {
27109
+ "description": "Default lifetime of credential offers in seconds. Can be overridden per offer request. Null or unset: offers do not expire.",
27110
+ "anyOf": [
27111
+ {
27112
+ "type": "integer",
27113
+ "minimum": 1,
27114
+ "maximum": 9007199254740991
27115
+ },
27116
+ {
27117
+ "type": "null"
27118
+ }
25797
27119
  ]
25798
27120
  }
25799
27121
  },
25800
27122
  "required": [
25801
- "id",
25802
- "dcql_query"
27123
+ "authorizationServers"
25803
27124
  ],
25804
27125
  "additionalProperties": false,
25805
- "title": "PresentationConfigCreateDto"
27126
+ "title": "IssuanceConfig"
25806
27127
  }
25807
27128
  }
25808
27129
  },
25809
27130
  {
25810
27131
  "$schema": "https://json-schema.org/draft/2020-12/schema",
25811
- "$id": "https://eudiplo.dev/schemas/v4/IssuanceConfigFile.schema.json",
27132
+ "$id": "https://eudiplo.dev/schemas/v5/IssuanceConfigFile.schema.json",
25812
27133
  "title": "IssuanceConfigFile",
25813
27134
  "type": "object",
25814
27135
  "properties": {
25815
27136
  "$schema": {
25816
27137
  "type": "string",
25817
- "const": "https://eudiplo.dev/schemas/v4/IssuanceConfigFile.schema.json"
27138
+ "const": "https://eudiplo.dev/schemas/v5/IssuanceConfigFile.schema.json"
25818
27139
  },
25819
27140
  "metadata": {
25820
27141
  "type": "object",
@@ -26374,8 +27695,9 @@ var CONFIG_SCHEMAS = [
26374
27695
  ]
26375
27696
  },
26376
27697
  "entityId": {
26377
- "description": "Optional local federation entity id.",
26378
- "type": "string"
27698
+ "description": "Entity Identifier of the tenant's federation entity, usually {PUBLIC_URL}/issuers/{tenantId}: an https URL with a host and without query or fragment (OpenID Federation 1.0 Section 1.2). http is accepted only when OUTBOUND_URL_ALLOW_HTTP is true.",
27699
+ "type": "string",
27700
+ "pattern": "^(https?:\\/\\/[^\\s?#]+)?$"
26379
27701
  },
26380
27702
  "enforceSigningPolicy": {
26381
27703
  "description": "Enforce strict signing policy checks.",
@@ -26410,6 +27732,80 @@ var CONFIG_SCHEMAS = [
26410
27732
  "additionalProperties": false
26411
27733
  },
26412
27734
  "description": "Federation trust anchors."
27735
+ },
27736
+ "entityTypes": {
27737
+ "description": "Roles the entity configuration publishes metadata for. Defaults to openid_credential_issuer.",
27738
+ "minItems": 1,
27739
+ "type": "array",
27740
+ "items": {
27741
+ "type": "string",
27742
+ "enum": [
27743
+ "openid_credential_issuer",
27744
+ "openid_credential_verifier"
27745
+ ]
27746
+ }
27747
+ },
27748
+ "authorityHints": {
27749
+ "description": "authority_hints of the entity configuration: the superiors that issue a subordinate statement about this entity. Defaults to the trust anchor entity ids.",
27750
+ "type": "array",
27751
+ "items": {
27752
+ "type": "string",
27753
+ "format": "uri"
27754
+ }
27755
+ },
27756
+ "entityKeyChainId": {
27757
+ "description": "Key chain with usage type 'federation' that signs the entity configuration. Without it, a federation key chain of the tenant is used; set it when the tenant has several.",
27758
+ "type": "string",
27759
+ "minLength": 1
27760
+ },
27761
+ "entityConfigurationLifetimeSeconds": {
27762
+ "description": "Lifetime (exp - iat) of the entity configuration in seconds. Defaults to 86400.",
27763
+ "type": "integer",
27764
+ "minimum": 60,
27765
+ "maximum": 31536e3
27766
+ },
27767
+ "trustMarks": {
27768
+ "description": "Trust mark JWTs issued to this entity, published in the entity configuration.",
27769
+ "type": "array",
27770
+ "items": {
27771
+ "type": "string",
27772
+ "minLength": 1
27773
+ }
27774
+ },
27775
+ "entityMetadata": {
27776
+ "description": "Informational federation_entity metadata of the entity configuration.",
27777
+ "type": "object",
27778
+ "properties": {
27779
+ "organization_name": {
27780
+ "type": "string",
27781
+ "minLength": 1
27782
+ },
27783
+ "contacts": {
27784
+ "minItems": 1,
27785
+ "type": "array",
27786
+ "items": {
27787
+ "type": "string",
27788
+ "minLength": 1
27789
+ }
27790
+ },
27791
+ "logo_uri": {
27792
+ "type": "string",
27793
+ "format": "uri"
27794
+ },
27795
+ "policy_uri": {
27796
+ "type": "string",
27797
+ "format": "uri"
27798
+ },
27799
+ "homepage_uri": {
27800
+ "type": "string",
27801
+ "format": "uri"
27802
+ }
27803
+ },
27804
+ "additionalProperties": false
27805
+ },
27806
+ "includeTrustChain": {
27807
+ "description": "Add the trust chain of this entity as trust_chain header to federation SD-JWT VCs and OID4VP request objects.",
27808
+ "type": "boolean"
26413
27809
  }
26414
27810
  },
26415
27811
  "required": [
@@ -29324,7 +30720,7 @@ function createDeploymentCommands(context, setExitCode) {
29324
30720
  // package.json
29325
30721
  var package_default = {
29326
30722
  name: "@eudiplo/cli",
29327
- version: "9.1.0-main.2d54936",
30723
+ version: "9.1.0-main.3156bf0",
29328
30724
  description: "Deployment-aware command line tools for EUDIPLO",
29329
30725
  private: false,
29330
30726
  type: "module",
@@ -29390,7 +30786,7 @@ var package_default = {
29390
30786
  esbuild: "^0.28.2",
29391
30787
  tsx: "^4.23.15",
29392
30788
  typescript: "^7.0.2",
29393
- vitest: "5.0.3"
30789
+ vitest: "5.0.4"
29394
30790
  }
29395
30791
  };
29396
30792