@eudiplo/cli 9.1.0-main.5e92016 → 9.1.0-main.60d236d

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. package/dist/index.js +1230 -3
  2. package/package.json +1 -1
  3. package/templates/docker-compose.yml +2 -2
  4. package/templates/schemas/KeyChainCreateDto.schema.json +9 -0
  5. package/templates/schemas/KmsConfigDto.schema.json +186 -0
  6. package/templates/schemas/KmsConfigFile.schema.json +1026 -1
  7. package/templates/schemas/UpdateStatusListConfigDto.schema.json +5 -5
package/dist/index.js CHANGED
@@ -14899,7 +14899,7 @@ function unzipSync(data, opts) {
14899
14899
  var CONFIG_FORMATS = {
14900
14900
  Tenant: { slug: "tenant", file: "TenantConfigFile", version: 1 },
14901
14901
  Client: { slug: "client", file: "ClientConfigFile", version: 2 },
14902
- KmsConfig: { slug: "kms-config", file: "KmsConfigFile", version: 1 },
14902
+ KmsConfig: { slug: "kms-config", file: "KmsConfigFile", version: 2 },
14903
14903
  KeyChain: { slug: "key-chain", file: "KeyChainConfigFile", version: 2 },
14904
14904
  RegistrarConfig: {
14905
14905
  slug: "registrar-config",
@@ -14959,7 +14959,13 @@ function resourceId(input) {
14959
14959
  return id;
14960
14960
  }
14961
14961
  function bareFileVersion(kind, spec) {
14962
- return kind === "KeyChain" && "type" in spec ? 2 : 1;
14962
+ if (kind === "KeyChain")
14963
+ return "type" in spec ? 2 : 1;
14964
+ if (kind === "KmsConfig") {
14965
+ const providers = Array.isArray(spec.providers) ? spec.providers : [];
14966
+ return providers.some((provider) => typeof provider === "object" && provider !== null && ("algorithms" in provider || "defaultAlgorithm" in provider)) ? 2 : 1;
14967
+ }
14968
+ return 1;
14963
14969
  }
14964
14970
  var presentationConfigV1ToV2 = {
14965
14971
  id: "presentation-config-v2-provides-attestations",
@@ -15013,6 +15019,16 @@ var CONFIG_MIGRATIONS = [
15013
15019
  // and keys:manage: a v1 spec is a valid v2 spec.
15014
15020
  migrate: (spec) => ({ spec })
15015
15021
  },
15022
+ {
15023
+ id: "kms-config-v2-algorithms",
15024
+ kind: "KmsConfig",
15025
+ from: 1,
15026
+ to: 2,
15027
+ // v2 only adds the optional provider fields algorithms and
15028
+ // defaultAlgorithm: a v1 spec is a valid v2 spec, whose providers keep
15029
+ // their default algorithms.
15030
+ migrate: (spec) => ({ spec })
15031
+ },
15016
15032
  {
15017
15033
  id: "key-chain-v2-type",
15018
15034
  kind: "KeyChain",
@@ -22085,6 +22101,1217 @@ var CONFIG_SCHEMAS = [
22085
22101
  ],
22086
22102
  "additionalProperties": false
22087
22103
  },
22104
+ {
22105
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
22106
+ "$id": "https://eudiplo.dev/schemas/v2/KmsConfigFile.schema.json",
22107
+ "title": "KmsConfigFile",
22108
+ "type": "object",
22109
+ "properties": {
22110
+ "$schema": {
22111
+ "type": "string",
22112
+ "const": "https://eudiplo.dev/schemas/v2/KmsConfigFile.schema.json"
22113
+ },
22114
+ "metadata": {
22115
+ "type": "object",
22116
+ "properties": {
22117
+ "generation": {
22118
+ "type": "integer",
22119
+ "minimum": 1,
22120
+ "description": "Monotonically increasing configuration generation."
22121
+ },
22122
+ "ownership": {
22123
+ "type": "string",
22124
+ "enum": [
22125
+ "unmanaged",
22126
+ "file-managed"
22127
+ ],
22128
+ "description": "Requested ownership recorded when the document is applied."
22129
+ }
22130
+ },
22131
+ "additionalProperties": false
22132
+ },
22133
+ "spec": {
22134
+ "$ref": "#/$defs/KmsConfigDto"
22135
+ }
22136
+ },
22137
+ "required": [
22138
+ "$schema",
22139
+ "spec"
22140
+ ],
22141
+ "additionalProperties": false,
22142
+ "$defs": {
22143
+ "KmsConfigDto": {
22144
+ "type": "object",
22145
+ "properties": {
22146
+ "defaultProvider": {
22147
+ "description": 'ID of the default KMS provider. Defaults to "db" if not set.',
22148
+ "examples": [
22149
+ "main-vault"
22150
+ ],
22151
+ "anyOf": [
22152
+ {
22153
+ "type": "string",
22154
+ "minLength": 1
22155
+ },
22156
+ {
22157
+ "type": "string",
22158
+ "pattern": "^\\$\\{([A-Z0-9_]+)\\}$"
22159
+ }
22160
+ ]
22161
+ },
22162
+ "providers": {
22163
+ "type": "array",
22164
+ "items": {
22165
+ "oneOf": [
22166
+ {
22167
+ "type": "object",
22168
+ "properties": {
22169
+ "id": {
22170
+ "anyOf": [
22171
+ {
22172
+ "type": "string",
22173
+ "minLength": 1
22174
+ },
22175
+ {
22176
+ "type": "string",
22177
+ "pattern": "^\\$\\{([A-Z0-9_]+)\\}$"
22178
+ }
22179
+ ],
22180
+ "description": "Unique identifier for this provider instance. Used when generating keys to specify which provider to use.",
22181
+ "examples": [
22182
+ "main-vault"
22183
+ ]
22184
+ },
22185
+ "type": {
22186
+ "type": "string",
22187
+ "const": "db",
22188
+ "description": "Type of the KMS provider.",
22189
+ "examples": [
22190
+ "db"
22191
+ ]
22192
+ },
22193
+ "description": {
22194
+ "description": "Human-readable description of this provider instance.",
22195
+ "examples": [
22196
+ "Production HashiCorp Vault for signing keys"
22197
+ ],
22198
+ "anyOf": [
22199
+ {
22200
+ "type": "string",
22201
+ "minLength": 1
22202
+ },
22203
+ {
22204
+ "type": "string",
22205
+ "pattern": "^\\$\\{([A-Z0-9_]+)\\}$"
22206
+ }
22207
+ ]
22208
+ },
22209
+ "algorithms": {
22210
+ "description": "Signing algorithms new key chains of this provider may use: ES256 (P-256), ES384 (P-384), ES512 (P-521). Defaults to all three for db, vault and aws-kms. For pkcs11, http and csc, whose backends may not support every curve, it defaults to defaultAlgorithm (ES256 unless set). Existing keys keep signing with their own algorithm.",
22211
+ "examples": [
22212
+ [
22213
+ "ES256",
22214
+ "ES384"
22215
+ ]
22216
+ ],
22217
+ "minItems": 1,
22218
+ "type": "array",
22219
+ "items": {
22220
+ "type": "string",
22221
+ "enum": [
22222
+ "ES256",
22223
+ "ES384",
22224
+ "ES512"
22225
+ ]
22226
+ }
22227
+ },
22228
+ "defaultAlgorithm": {
22229
+ "description": "Algorithm used when a key chain is created without one. Must be in algorithms. Defaults to ES256 if allowed, otherwise the first entry of algorithms.",
22230
+ "examples": [
22231
+ "ES256"
22232
+ ],
22233
+ "type": "string",
22234
+ "enum": [
22235
+ "ES256",
22236
+ "ES384",
22237
+ "ES512"
22238
+ ]
22239
+ }
22240
+ },
22241
+ "required": [
22242
+ "id",
22243
+ "type"
22244
+ ],
22245
+ "additionalProperties": false
22246
+ },
22247
+ {
22248
+ "type": "object",
22249
+ "properties": {
22250
+ "id": {
22251
+ "anyOf": [
22252
+ {
22253
+ "type": "string",
22254
+ "minLength": 1
22255
+ },
22256
+ {
22257
+ "type": "string",
22258
+ "pattern": "^\\$\\{([A-Z0-9_]+)\\}$"
22259
+ }
22260
+ ],
22261
+ "description": "Unique identifier for this provider instance. Used when generating keys to specify which provider to use.",
22262
+ "examples": [
22263
+ "main-vault"
22264
+ ]
22265
+ },
22266
+ "type": {
22267
+ "type": "string",
22268
+ "const": "vault",
22269
+ "description": "Type of the KMS provider.",
22270
+ "examples": [
22271
+ "vault"
22272
+ ]
22273
+ },
22274
+ "description": {
22275
+ "description": "Human-readable description of this provider instance.",
22276
+ "examples": [
22277
+ "Production HashiCorp Vault for signing keys"
22278
+ ],
22279
+ "anyOf": [
22280
+ {
22281
+ "type": "string",
22282
+ "minLength": 1
22283
+ },
22284
+ {
22285
+ "type": "string",
22286
+ "pattern": "^\\$\\{([A-Z0-9_]+)\\}$"
22287
+ }
22288
+ ]
22289
+ },
22290
+ "algorithms": {
22291
+ "description": "Signing algorithms new key chains of this provider may use: ES256 (P-256), ES384 (P-384), ES512 (P-521). Defaults to all three for db, vault and aws-kms. For pkcs11, http and csc, whose backends may not support every curve, it defaults to defaultAlgorithm (ES256 unless set). Existing keys keep signing with their own algorithm.",
22292
+ "examples": [
22293
+ [
22294
+ "ES256",
22295
+ "ES384"
22296
+ ]
22297
+ ],
22298
+ "minItems": 1,
22299
+ "type": "array",
22300
+ "items": {
22301
+ "type": "string",
22302
+ "enum": [
22303
+ "ES256",
22304
+ "ES384",
22305
+ "ES512"
22306
+ ]
22307
+ }
22308
+ },
22309
+ "defaultAlgorithm": {
22310
+ "description": "Algorithm used when a key chain is created without one. Must be in algorithms. Defaults to ES256 if allowed, otherwise the first entry of algorithms.",
22311
+ "examples": [
22312
+ "ES256"
22313
+ ],
22314
+ "type": "string",
22315
+ "enum": [
22316
+ "ES256",
22317
+ "ES384",
22318
+ "ES512"
22319
+ ]
22320
+ },
22321
+ "vaultUrl": {
22322
+ "anyOf": [
22323
+ {
22324
+ "type": "string",
22325
+ "format": "uri"
22326
+ },
22327
+ {
22328
+ "type": "string",
22329
+ "pattern": "^\\$\\{([A-Z0-9_]+)\\}$"
22330
+ }
22331
+ ],
22332
+ "description": "URL of the HashiCorp Vault instance. Supports ${ENV_VAR} placeholders.",
22333
+ "examples": [
22334
+ "${VAULT_URL}"
22335
+ ]
22336
+ },
22337
+ "vaultToken": {
22338
+ "anyOf": [
22339
+ {
22340
+ "type": "string",
22341
+ "minLength": 1
22342
+ },
22343
+ {
22344
+ "type": "string",
22345
+ "pattern": "^\\$\\{([A-Z0-9_]+)\\}$"
22346
+ }
22347
+ ],
22348
+ "description": "Authentication token for HashiCorp Vault. Supports ${ENV_VAR} placeholders.",
22349
+ "examples": [
22350
+ "${VAULT_TOKEN}"
22351
+ ]
22352
+ }
22353
+ },
22354
+ "required": [
22355
+ "id",
22356
+ "type",
22357
+ "vaultUrl",
22358
+ "vaultToken"
22359
+ ],
22360
+ "additionalProperties": false
22361
+ },
22362
+ {
22363
+ "type": "object",
22364
+ "properties": {
22365
+ "id": {
22366
+ "anyOf": [
22367
+ {
22368
+ "type": "string",
22369
+ "minLength": 1
22370
+ },
22371
+ {
22372
+ "type": "string",
22373
+ "pattern": "^\\$\\{([A-Z0-9_]+)\\}$"
22374
+ }
22375
+ ],
22376
+ "description": "Unique identifier for this provider instance. Used when generating keys to specify which provider to use.",
22377
+ "examples": [
22378
+ "main-vault"
22379
+ ]
22380
+ },
22381
+ "type": {
22382
+ "type": "string",
22383
+ "const": "aws-kms",
22384
+ "description": "Type of the KMS provider.",
22385
+ "examples": [
22386
+ "aws-kms"
22387
+ ]
22388
+ },
22389
+ "description": {
22390
+ "description": "Human-readable description of this provider instance.",
22391
+ "examples": [
22392
+ "Production HashiCorp Vault for signing keys"
22393
+ ],
22394
+ "anyOf": [
22395
+ {
22396
+ "type": "string",
22397
+ "minLength": 1
22398
+ },
22399
+ {
22400
+ "type": "string",
22401
+ "pattern": "^\\$\\{([A-Z0-9_]+)\\}$"
22402
+ }
22403
+ ]
22404
+ },
22405
+ "algorithms": {
22406
+ "description": "Signing algorithms new key chains of this provider may use: ES256 (P-256), ES384 (P-384), ES512 (P-521). Defaults to all three for db, vault and aws-kms. For pkcs11, http and csc, whose backends may not support every curve, it defaults to defaultAlgorithm (ES256 unless set). Existing keys keep signing with their own algorithm.",
22407
+ "examples": [
22408
+ [
22409
+ "ES256",
22410
+ "ES384"
22411
+ ]
22412
+ ],
22413
+ "minItems": 1,
22414
+ "type": "array",
22415
+ "items": {
22416
+ "type": "string",
22417
+ "enum": [
22418
+ "ES256",
22419
+ "ES384",
22420
+ "ES512"
22421
+ ]
22422
+ }
22423
+ },
22424
+ "defaultAlgorithm": {
22425
+ "description": "Algorithm used when a key chain is created without one. Must be in algorithms. Defaults to ES256 if allowed, otherwise the first entry of algorithms.",
22426
+ "examples": [
22427
+ "ES256"
22428
+ ],
22429
+ "type": "string",
22430
+ "enum": [
22431
+ "ES256",
22432
+ "ES384",
22433
+ "ES512"
22434
+ ]
22435
+ },
22436
+ "region": {
22437
+ "anyOf": [
22438
+ {
22439
+ "type": "string",
22440
+ "minLength": 1
22441
+ },
22442
+ {
22443
+ "type": "string",
22444
+ "pattern": "^\\$\\{([A-Z0-9_]+)\\}$"
22445
+ }
22446
+ ],
22447
+ "description": "AWS region for KMS. Supports ${ENV_VAR} placeholders.",
22448
+ "examples": [
22449
+ "${AWS_REGION}"
22450
+ ]
22451
+ },
22452
+ "accessKeyId": {
22453
+ "description": "AWS access key ID. Optional \u2014 uses SDK credential chain if not provided. Supports ${ENV_VAR} placeholders.",
22454
+ "examples": [
22455
+ "${AWS_ACCESS_KEY_ID}"
22456
+ ],
22457
+ "anyOf": [
22458
+ {
22459
+ "type": "string",
22460
+ "minLength": 1
22461
+ },
22462
+ {
22463
+ "type": "string",
22464
+ "pattern": "^\\$\\{([A-Z0-9_]+)\\}$"
22465
+ }
22466
+ ]
22467
+ },
22468
+ "secretAccessKey": {
22469
+ "description": "AWS secret access key. Optional \u2014 uses SDK credential chain if not provided. Supports ${ENV_VAR} placeholders.",
22470
+ "examples": [
22471
+ "${AWS_SECRET_ACCESS_KEY}"
22472
+ ],
22473
+ "anyOf": [
22474
+ {
22475
+ "type": "string",
22476
+ "minLength": 1
22477
+ },
22478
+ {
22479
+ "type": "string",
22480
+ "pattern": "^\\$\\{([A-Z0-9_]+)\\}$"
22481
+ }
22482
+ ]
22483
+ }
22484
+ },
22485
+ "required": [
22486
+ "id",
22487
+ "type",
22488
+ "region"
22489
+ ],
22490
+ "additionalProperties": false
22491
+ },
22492
+ {
22493
+ "type": "object",
22494
+ "properties": {
22495
+ "id": {
22496
+ "anyOf": [
22497
+ {
22498
+ "type": "string",
22499
+ "minLength": 1
22500
+ },
22501
+ {
22502
+ "type": "string",
22503
+ "pattern": "^\\$\\{([A-Z0-9_]+)\\}$"
22504
+ }
22505
+ ],
22506
+ "description": "Unique identifier for this provider instance. Used when generating keys to specify which provider to use.",
22507
+ "examples": [
22508
+ "main-vault"
22509
+ ]
22510
+ },
22511
+ "type": {
22512
+ "type": "string",
22513
+ "const": "pkcs11",
22514
+ "description": "Type of the KMS provider.",
22515
+ "examples": [
22516
+ "pkcs11"
22517
+ ]
22518
+ },
22519
+ "description": {
22520
+ "description": "Human-readable description of this provider instance.",
22521
+ "examples": [
22522
+ "Production HashiCorp Vault for signing keys"
22523
+ ],
22524
+ "anyOf": [
22525
+ {
22526
+ "type": "string",
22527
+ "minLength": 1
22528
+ },
22529
+ {
22530
+ "type": "string",
22531
+ "pattern": "^\\$\\{([A-Z0-9_]+)\\}$"
22532
+ }
22533
+ ]
22534
+ },
22535
+ "algorithms": {
22536
+ "description": "Signing algorithms new key chains of this provider may use: ES256 (P-256), ES384 (P-384), ES512 (P-521). Defaults to all three for db, vault and aws-kms. For pkcs11, http and csc, whose backends may not support every curve, it defaults to defaultAlgorithm (ES256 unless set). Existing keys keep signing with their own algorithm.",
22537
+ "examples": [
22538
+ [
22539
+ "ES256",
22540
+ "ES384"
22541
+ ]
22542
+ ],
22543
+ "minItems": 1,
22544
+ "type": "array",
22545
+ "items": {
22546
+ "type": "string",
22547
+ "enum": [
22548
+ "ES256",
22549
+ "ES384",
22550
+ "ES512"
22551
+ ]
22552
+ }
22553
+ },
22554
+ "defaultAlgorithm": {
22555
+ "description": "Algorithm used when a key chain is created without one. Must be in algorithms. Defaults to ES256 if allowed, otherwise the first entry of algorithms.",
22556
+ "examples": [
22557
+ "ES256"
22558
+ ],
22559
+ "type": "string",
22560
+ "enum": [
22561
+ "ES256",
22562
+ "ES384",
22563
+ "ES512"
22564
+ ]
22565
+ },
22566
+ "library": {
22567
+ "anyOf": [
22568
+ {
22569
+ "type": "string",
22570
+ "minLength": 1
22571
+ },
22572
+ {
22573
+ "type": "string",
22574
+ "pattern": "^\\$\\{([A-Z0-9_]+)\\}$"
22575
+ }
22576
+ ],
22577
+ "description": "Absolute path to the PKCS#11 module library (.so/.dll/.dylib). Supports ${ENV_VAR} placeholders.",
22578
+ "examples": [
22579
+ "${PKCS11_LIBRARY}"
22580
+ ]
22581
+ },
22582
+ "slot": {
22583
+ "description": "Slot selection. Either the numeric slot index (as a string for ENV interpolation, or a number) or the token label. Supports ${ENV_VAR} placeholders.",
22584
+ "examples": [
22585
+ "${PKCS11_SLOT}"
22586
+ ],
22587
+ "type": [
22588
+ "number",
22589
+ "string"
22590
+ ]
22591
+ },
22592
+ "pin": {
22593
+ "anyOf": [
22594
+ {
22595
+ "type": "string",
22596
+ "minLength": 1
22597
+ },
22598
+ {
22599
+ "type": "string",
22600
+ "pattern": "^\\$\\{([A-Z0-9_]+)\\}$"
22601
+ }
22602
+ ],
22603
+ "description": "User PIN used for C_Login. Supports ${ENV_VAR} placeholders.",
22604
+ "examples": [
22605
+ "${PKCS11_PIN}"
22606
+ ]
22607
+ },
22608
+ "readOnly": {
22609
+ "description": "Open the PKCS#11 session in read-only mode. Defaults to false.",
22610
+ "examples": [
22611
+ false
22612
+ ],
22613
+ "type": "boolean"
22614
+ }
22615
+ },
22616
+ "required": [
22617
+ "id",
22618
+ "type",
22619
+ "library",
22620
+ "slot",
22621
+ "pin"
22622
+ ],
22623
+ "additionalProperties": false
22624
+ },
22625
+ {
22626
+ "type": "object",
22627
+ "properties": {
22628
+ "id": {
22629
+ "anyOf": [
22630
+ {
22631
+ "type": "string",
22632
+ "minLength": 1
22633
+ },
22634
+ {
22635
+ "type": "string",
22636
+ "pattern": "^\\$\\{([A-Z0-9_]+)\\}$"
22637
+ }
22638
+ ],
22639
+ "description": "Unique identifier for this provider instance. Used when generating keys to specify which provider to use.",
22640
+ "examples": [
22641
+ "main-vault"
22642
+ ]
22643
+ },
22644
+ "type": {
22645
+ "type": "string",
22646
+ "const": "http",
22647
+ "description": "Type of the KMS provider.",
22648
+ "examples": [
22649
+ "http"
22650
+ ]
22651
+ },
22652
+ "description": {
22653
+ "description": "Human-readable description of this provider instance.",
22654
+ "examples": [
22655
+ "Production HashiCorp Vault for signing keys"
22656
+ ],
22657
+ "anyOf": [
22658
+ {
22659
+ "type": "string",
22660
+ "minLength": 1
22661
+ },
22662
+ {
22663
+ "type": "string",
22664
+ "pattern": "^\\$\\{([A-Z0-9_]+)\\}$"
22665
+ }
22666
+ ]
22667
+ },
22668
+ "algorithms": {
22669
+ "description": "Signing algorithms new key chains of this provider may use: ES256 (P-256), ES384 (P-384), ES512 (P-521). Defaults to all three for db, vault and aws-kms. For pkcs11, http and csc, whose backends may not support every curve, it defaults to defaultAlgorithm (ES256 unless set). Existing keys keep signing with their own algorithm.",
22670
+ "examples": [
22671
+ [
22672
+ "ES256",
22673
+ "ES384"
22674
+ ]
22675
+ ],
22676
+ "minItems": 1,
22677
+ "type": "array",
22678
+ "items": {
22679
+ "type": "string",
22680
+ "enum": [
22681
+ "ES256",
22682
+ "ES384",
22683
+ "ES512"
22684
+ ]
22685
+ }
22686
+ },
22687
+ "defaultAlgorithm": {
22688
+ "description": "Algorithm used when a key chain is created without one. Must be in algorithms. Defaults to ES256 if allowed, otherwise the first entry of algorithms.",
22689
+ "examples": [
22690
+ "ES256"
22691
+ ],
22692
+ "type": "string",
22693
+ "enum": [
22694
+ "ES256",
22695
+ "ES384",
22696
+ "ES512"
22697
+ ]
22698
+ },
22699
+ "baseUrl": {
22700
+ "anyOf": [
22701
+ {
22702
+ "type": "string",
22703
+ "format": "uri"
22704
+ },
22705
+ {
22706
+ "type": "string",
22707
+ "pattern": "^\\$\\{([A-Z0-9_]+)\\}$"
22708
+ }
22709
+ ],
22710
+ "description": "Base URL of the remote KMS microservice (no trailing slash). Supports ${ENV_VAR} placeholders.",
22711
+ "examples": [
22712
+ "${KMS_SERVICE_URL}"
22713
+ ]
22714
+ },
22715
+ "auth": {
22716
+ "description": 'Authentication method for the remote KMS service. Supports bearer token, OAuth 2.0 client credentials, and mutual TLS. Omit (or set type to "none") for unauthenticated services.',
22717
+ "oneOf": [
22718
+ {
22719
+ "type": "object",
22720
+ "properties": {
22721
+ "type": {
22722
+ "type": "string",
22723
+ "const": "none",
22724
+ "description": "No authentication \u2014 suitable for services on a trusted private network.",
22725
+ "examples": [
22726
+ "none"
22727
+ ]
22728
+ }
22729
+ },
22730
+ "required": [
22731
+ "type"
22732
+ ],
22733
+ "additionalProperties": false
22734
+ },
22735
+ {
22736
+ "type": "object",
22737
+ "properties": {
22738
+ "type": {
22739
+ "type": "string",
22740
+ "const": "bearer",
22741
+ "description": "Static Bearer token sent as Authorization: Bearer <token>.",
22742
+ "examples": [
22743
+ "bearer"
22744
+ ]
22745
+ },
22746
+ "token": {
22747
+ "anyOf": [
22748
+ {
22749
+ "type": "string",
22750
+ "minLength": 1
22751
+ },
22752
+ {
22753
+ "type": "string",
22754
+ "pattern": "^\\$\\{([A-Z0-9_]+)\\}$"
22755
+ }
22756
+ ],
22757
+ "description": "Bearer token value. Supports ${ENV_VAR} placeholders.",
22758
+ "examples": [
22759
+ "${KMS_API_KEY}"
22760
+ ]
22761
+ }
22762
+ },
22763
+ "required": [
22764
+ "type",
22765
+ "token"
22766
+ ],
22767
+ "additionalProperties": false
22768
+ },
22769
+ {
22770
+ "type": "object",
22771
+ "properties": {
22772
+ "type": {
22773
+ "type": "string",
22774
+ "const": "oauth2-client-credentials",
22775
+ "description": "OAuth 2.0 Client Credentials \u2014 EUDIPLO fetches and caches short-lived tokens.",
22776
+ "examples": [
22777
+ "oauth2-client-credentials"
22778
+ ]
22779
+ },
22780
+ "tokenUrl": {
22781
+ "anyOf": [
22782
+ {
22783
+ "type": "string",
22784
+ "format": "uri"
22785
+ },
22786
+ {
22787
+ "type": "string",
22788
+ "pattern": "^\\$\\{([A-Z0-9_]+)\\}$"
22789
+ }
22790
+ ],
22791
+ "description": "Token endpoint URL (e.g. Keycloak, Entra ID). Supports ${ENV_VAR} placeholders.",
22792
+ "examples": [
22793
+ "${IAM_TOKEN_URL}"
22794
+ ]
22795
+ },
22796
+ "clientId": {
22797
+ "anyOf": [
22798
+ {
22799
+ "type": "string",
22800
+ "minLength": 1
22801
+ },
22802
+ {
22803
+ "type": "string",
22804
+ "pattern": "^\\$\\{([A-Z0-9_]+)\\}$"
22805
+ }
22806
+ ],
22807
+ "description": "OAuth 2.0 client ID. Supports ${ENV_VAR} placeholders.",
22808
+ "examples": [
22809
+ "${KMS_CLIENT_ID}"
22810
+ ]
22811
+ },
22812
+ "clientSecret": {
22813
+ "anyOf": [
22814
+ {
22815
+ "type": "string",
22816
+ "minLength": 1
22817
+ },
22818
+ {
22819
+ "type": "string",
22820
+ "pattern": "^\\$\\{([A-Z0-9_]+)\\}$"
22821
+ }
22822
+ ],
22823
+ "description": "OAuth 2.0 client secret. Supports ${ENV_VAR} placeholders.",
22824
+ "examples": [
22825
+ "${KMS_CLIENT_SECRET}"
22826
+ ]
22827
+ },
22828
+ "scope": {
22829
+ "description": "Space-separated list of OAuth 2.0 scopes to request. Optional.",
22830
+ "examples": [
22831
+ "kms:sign kms:admin"
22832
+ ],
22833
+ "anyOf": [
22834
+ {
22835
+ "type": "string",
22836
+ "minLength": 1
22837
+ },
22838
+ {
22839
+ "type": "string",
22840
+ "pattern": "^\\$\\{([A-Z0-9_]+)\\}$"
22841
+ }
22842
+ ]
22843
+ }
22844
+ },
22845
+ "required": [
22846
+ "type",
22847
+ "tokenUrl",
22848
+ "clientId",
22849
+ "clientSecret"
22850
+ ],
22851
+ "additionalProperties": false
22852
+ },
22853
+ {
22854
+ "type": "object",
22855
+ "properties": {
22856
+ "type": {
22857
+ "type": "string",
22858
+ "const": "mtls",
22859
+ "description": "Mutual TLS \u2014 EUDIPLO presents a client certificate on every connection.",
22860
+ "examples": [
22861
+ "mtls"
22862
+ ]
22863
+ },
22864
+ "certFile": {
22865
+ "anyOf": [
22866
+ {
22867
+ "type": "string",
22868
+ "minLength": 1
22869
+ },
22870
+ {
22871
+ "type": "string",
22872
+ "pattern": "^\\$\\{([A-Z0-9_]+)\\}$"
22873
+ }
22874
+ ],
22875
+ "description": "Absolute path to the PEM-encoded client certificate file. Supports ${ENV_VAR} placeholders.",
22876
+ "examples": [
22877
+ "/etc/certs/eudiplo.crt"
22878
+ ]
22879
+ },
22880
+ "keyFile": {
22881
+ "anyOf": [
22882
+ {
22883
+ "type": "string",
22884
+ "minLength": 1
22885
+ },
22886
+ {
22887
+ "type": "string",
22888
+ "pattern": "^\\$\\{([A-Z0-9_]+)\\}$"
22889
+ }
22890
+ ],
22891
+ "description": "Absolute path to the PEM-encoded private key file for the client certificate. Supports ${ENV_VAR} placeholders.",
22892
+ "examples": [
22893
+ "/etc/certs/eudiplo.key"
22894
+ ]
22895
+ },
22896
+ "caFile": {
22897
+ "description": "Absolute path to the PEM-encoded CA bundle to trust for the remote server's certificate. Omit to use the system CA store.",
22898
+ "examples": [
22899
+ "/etc/certs/ca.crt"
22900
+ ],
22901
+ "anyOf": [
22902
+ {
22903
+ "type": "string",
22904
+ "minLength": 1
22905
+ },
22906
+ {
22907
+ "type": "string",
22908
+ "pattern": "^\\$\\{([A-Z0-9_]+)\\}$"
22909
+ }
22910
+ ]
22911
+ }
22912
+ },
22913
+ "required": [
22914
+ "type",
22915
+ "certFile",
22916
+ "keyFile"
22917
+ ],
22918
+ "additionalProperties": false
22919
+ }
22920
+ ]
22921
+ },
22922
+ "keysPath": {
22923
+ "description": "Path prefix for key endpoints on the remote service. Defaults to /keys.",
22924
+ "examples": [
22925
+ "/v1/keys"
22926
+ ],
22927
+ "anyOf": [
22928
+ {
22929
+ "type": "string",
22930
+ "minLength": 1
22931
+ },
22932
+ {
22933
+ "type": "string",
22934
+ "pattern": "^\\$\\{([A-Z0-9_]+)\\}$"
22935
+ }
22936
+ ]
22937
+ },
22938
+ "healthPath": {
22939
+ "description": "Path for the health check endpoint on the remote service. Defaults to /health.",
22940
+ "examples": [
22941
+ "/health"
22942
+ ],
22943
+ "anyOf": [
22944
+ {
22945
+ "type": "string",
22946
+ "minLength": 1
22947
+ },
22948
+ {
22949
+ "type": "string",
22950
+ "pattern": "^\\$\\{([A-Z0-9_]+)\\}$"
22951
+ }
22952
+ ]
22953
+ },
22954
+ "canImport": {
22955
+ "description": "Whether the remote service supports key import via POST {keysPath}/{kid}/import. Defaults to false.",
22956
+ "examples": [
22957
+ false
22958
+ ],
22959
+ "type": "boolean"
22960
+ }
22961
+ },
22962
+ "required": [
22963
+ "id",
22964
+ "type",
22965
+ "baseUrl"
22966
+ ],
22967
+ "additionalProperties": false
22968
+ },
22969
+ {
22970
+ "type": "object",
22971
+ "properties": {
22972
+ "id": {
22973
+ "anyOf": [
22974
+ {
22975
+ "type": "string",
22976
+ "minLength": 1
22977
+ },
22978
+ {
22979
+ "type": "string",
22980
+ "pattern": "^\\$\\{([A-Z0-9_]+)\\}$"
22981
+ }
22982
+ ],
22983
+ "description": "Unique identifier for this provider instance. Used when generating keys to specify which provider to use.",
22984
+ "examples": [
22985
+ "main-vault"
22986
+ ]
22987
+ },
22988
+ "type": {
22989
+ "type": "string",
22990
+ "const": "csc",
22991
+ "description": "Type of the KMS provider.",
22992
+ "examples": [
22993
+ "csc"
22994
+ ]
22995
+ },
22996
+ "description": {
22997
+ "description": "Human-readable description of this provider instance.",
22998
+ "examples": [
22999
+ "Production HashiCorp Vault for signing keys"
23000
+ ],
23001
+ "anyOf": [
23002
+ {
23003
+ "type": "string",
23004
+ "minLength": 1
23005
+ },
23006
+ {
23007
+ "type": "string",
23008
+ "pattern": "^\\$\\{([A-Z0-9_]+)\\}$"
23009
+ }
23010
+ ]
23011
+ },
23012
+ "algorithms": {
23013
+ "description": "Signing algorithms new key chains of this provider may use: ES256 (P-256), ES384 (P-384), ES512 (P-521). Defaults to all three for db, vault and aws-kms. For pkcs11, http and csc, whose backends may not support every curve, it defaults to defaultAlgorithm (ES256 unless set). Existing keys keep signing with their own algorithm.",
23014
+ "examples": [
23015
+ [
23016
+ "ES256",
23017
+ "ES384"
23018
+ ]
23019
+ ],
23020
+ "minItems": 1,
23021
+ "type": "array",
23022
+ "items": {
23023
+ "type": "string",
23024
+ "enum": [
23025
+ "ES256",
23026
+ "ES384",
23027
+ "ES512"
23028
+ ]
23029
+ }
23030
+ },
23031
+ "defaultAlgorithm": {
23032
+ "description": "Algorithm used when a key chain is created without one. Must be in algorithms. Defaults to ES256 if allowed, otherwise the first entry of algorithms.",
23033
+ "examples": [
23034
+ "ES256"
23035
+ ],
23036
+ "type": "string",
23037
+ "enum": [
23038
+ "ES256",
23039
+ "ES384",
23040
+ "ES512"
23041
+ ]
23042
+ },
23043
+ "baseUrl": {
23044
+ "anyOf": [
23045
+ {
23046
+ "type": "string",
23047
+ "format": "uri"
23048
+ },
23049
+ {
23050
+ "type": "string",
23051
+ "pattern": "^\\$\\{([A-Z0-9_]+)\\}$"
23052
+ }
23053
+ ],
23054
+ "description": "Base URL of the CSC service (without trailing slash). Supports ${ENV_VAR} placeholders.",
23055
+ "examples": [
23056
+ "${CSC_URL}"
23057
+ ]
23058
+ },
23059
+ "tokenUrl": {
23060
+ "anyOf": [
23061
+ {
23062
+ "type": "string",
23063
+ "format": "uri"
23064
+ },
23065
+ {
23066
+ "type": "string",
23067
+ "pattern": "^\\$\\{([A-Z0-9_]+)\\}$"
23068
+ }
23069
+ ],
23070
+ "description": "OAuth2 token endpoint URL for client-credentials flow. Supports ${ENV_VAR} placeholders.",
23071
+ "examples": [
23072
+ "${CSC_TOKEN_URL}"
23073
+ ]
23074
+ },
23075
+ "clientId": {
23076
+ "anyOf": [
23077
+ {
23078
+ "type": "string",
23079
+ "minLength": 1
23080
+ },
23081
+ {
23082
+ "type": "string",
23083
+ "pattern": "^\\$\\{([A-Z0-9_]+)\\}$"
23084
+ }
23085
+ ],
23086
+ "description": "OAuth2 client ID. Supports ${ENV_VAR} placeholders.",
23087
+ "examples": [
23088
+ "${CSC_CLIENT_ID}"
23089
+ ]
23090
+ },
23091
+ "clientSecret": {
23092
+ "anyOf": [
23093
+ {
23094
+ "type": "string",
23095
+ "minLength": 1
23096
+ },
23097
+ {
23098
+ "type": "string",
23099
+ "pattern": "^\\$\\{([A-Z0-9_]+)\\}$"
23100
+ }
23101
+ ],
23102
+ "description": "OAuth2 client secret. Supports ${ENV_VAR} placeholders.",
23103
+ "examples": [
23104
+ "${CSC_CLIENT_SECRET}"
23105
+ ]
23106
+ },
23107
+ "scope": {
23108
+ "description": "OAuth2 scope to request during token acquisition.",
23109
+ "examples": [
23110
+ "service"
23111
+ ],
23112
+ "anyOf": [
23113
+ {
23114
+ "type": "string",
23115
+ "minLength": 1
23116
+ },
23117
+ {
23118
+ "type": "string",
23119
+ "pattern": "^\\$\\{([A-Z0-9_]+)\\}$"
23120
+ }
23121
+ ]
23122
+ },
23123
+ "credentialId": {
23124
+ "description": "Default CSC credential ID. If omitted, the adapter calls credentials/list and picks the first entry.",
23125
+ "examples": [
23126
+ "[INTESIQCSEALEC]_SEAL_351_SIGN_1781018892758"
23127
+ ],
23128
+ "anyOf": [
23129
+ {
23130
+ "type": "string",
23131
+ "minLength": 1
23132
+ },
23133
+ {
23134
+ "type": "string",
23135
+ "pattern": "^\\$\\{([A-Z0-9_]+)\\}$"
23136
+ }
23137
+ ]
23138
+ },
23139
+ "userId": {
23140
+ "description": "Optional CSC user ID used in credentials/list requests.",
23141
+ "examples": [
23142
+ "eudiplo_user"
23143
+ ],
23144
+ "anyOf": [
23145
+ {
23146
+ "type": "string",
23147
+ "minLength": 1
23148
+ },
23149
+ {
23150
+ "type": "string",
23151
+ "pattern": "^\\$\\{([A-Z0-9_]+)\\}$"
23152
+ }
23153
+ ]
23154
+ },
23155
+ "apiPath": {
23156
+ "description": "CSC API path prefix appended to baseUrl. Defaults to /csc/v2.",
23157
+ "examples": [
23158
+ "/csc/v2"
23159
+ ],
23160
+ "anyOf": [
23161
+ {
23162
+ "type": "string",
23163
+ "minLength": 1
23164
+ },
23165
+ {
23166
+ "type": "string",
23167
+ "pattern": "^\\$\\{([A-Z0-9_]+)\\}$"
23168
+ }
23169
+ ]
23170
+ },
23171
+ "hashAlgorithmOid": {
23172
+ "description": "Hash algorithm OID for signatures/signHash and credentials/authorize. Defaults to SHA-256 OID.",
23173
+ "examples": [
23174
+ "2.16.840.1.101.3.4.2.1"
23175
+ ],
23176
+ "anyOf": [
23177
+ {
23178
+ "type": "string",
23179
+ "minLength": 1
23180
+ },
23181
+ {
23182
+ "type": "string",
23183
+ "pattern": "^\\$\\{([A-Z0-9_]+)\\}$"
23184
+ }
23185
+ ]
23186
+ },
23187
+ "signAlgorithmOid": {
23188
+ "description": "Signature algorithm OID for signatures/signHash. Defaults to ecdsa-with-SHA256 OID.",
23189
+ "examples": [
23190
+ "1.2.840.10045.4.3.2"
23191
+ ],
23192
+ "anyOf": [
23193
+ {
23194
+ "type": "string",
23195
+ "minLength": 1
23196
+ },
23197
+ {
23198
+ "type": "string",
23199
+ "pattern": "^\\$\\{([A-Z0-9_]+)\\}$"
23200
+ }
23201
+ ]
23202
+ },
23203
+ "sad": {
23204
+ "description": "Static SAD token. If set, the adapter sends it directly in signatures/signHash requests.",
23205
+ "anyOf": [
23206
+ {
23207
+ "type": "string",
23208
+ "minLength": 1
23209
+ },
23210
+ {
23211
+ "type": "string",
23212
+ "pattern": "^\\$\\{([A-Z0-9_]+)\\}$"
23213
+ }
23214
+ ]
23215
+ },
23216
+ "useAuthorizeEndpoint": {
23217
+ "description": "When true and no static SAD is provided, the adapter calls credentials/authorize to obtain SAD before signatures/signHash.",
23218
+ "examples": [
23219
+ false
23220
+ ],
23221
+ "type": "boolean"
23222
+ },
23223
+ "authorizeAuthData": {
23224
+ "description": "Optional authData array passed to credentials/authorize (e.g., PIN/OTP factors).",
23225
+ "type": "array",
23226
+ "items": {
23227
+ "type": "object",
23228
+ "properties": {
23229
+ "id": {
23230
+ "anyOf": [
23231
+ {
23232
+ "type": "string",
23233
+ "minLength": 1
23234
+ },
23235
+ {
23236
+ "type": "string",
23237
+ "pattern": "^\\$\\{([A-Z0-9_]+)\\}$"
23238
+ }
23239
+ ],
23240
+ "description": "Authentication factor identifier expected by the CSC provider (e.g., PIN, OTP).",
23241
+ "examples": [
23242
+ "PIN"
23243
+ ]
23244
+ },
23245
+ "value": {
23246
+ "anyOf": [
23247
+ {
23248
+ "type": "string",
23249
+ "minLength": 1
23250
+ },
23251
+ {
23252
+ "type": "string",
23253
+ "pattern": "^\\$\\{([A-Z0-9_]+)\\}$"
23254
+ }
23255
+ ],
23256
+ "description": "Authentication factor value sent to CSC credentials/authorize.",
23257
+ "examples": [
23258
+ "123456"
23259
+ ]
23260
+ }
23261
+ },
23262
+ "required": [
23263
+ "id",
23264
+ "value"
23265
+ ],
23266
+ "additionalProperties": false
23267
+ }
23268
+ }
23269
+ },
23270
+ "required": [
23271
+ "id",
23272
+ "type",
23273
+ "baseUrl",
23274
+ "tokenUrl",
23275
+ "clientId",
23276
+ "clientSecret"
23277
+ ],
23278
+ "additionalProperties": false
23279
+ }
23280
+ ]
23281
+ },
23282
+ "description": "List of KMS provider configurations. Each provider must have a unique id and a type.",
23283
+ "examples": [
23284
+ [
23285
+ {
23286
+ "id": "db",
23287
+ "type": "db",
23288
+ "description": "Default database provider"
23289
+ },
23290
+ {
23291
+ "id": "main-vault",
23292
+ "type": "vault",
23293
+ "description": "Production Vault",
23294
+ "vaultUrl": "${VAULT_URL}",
23295
+ "vaultToken": "${VAULT_TOKEN}"
23296
+ },
23297
+ {
23298
+ "id": "aws",
23299
+ "type": "aws-kms",
23300
+ "description": "AWS KMS",
23301
+ "region": "${AWS_REGION}"
23302
+ }
23303
+ ]
23304
+ ]
23305
+ }
23306
+ },
23307
+ "required": [
23308
+ "providers"
23309
+ ],
23310
+ "additionalProperties": false,
23311
+ "title": "KmsConfigDto"
23312
+ }
23313
+ }
23314
+ },
22088
23315
  {
22089
23316
  "$schema": "https://json-schema.org/draft/2020-12/schema",
22090
23317
  "$id": "https://eudiplo.dev/schemas/v2/PresentationConfigFile.schema.json",
@@ -27026,7 +28253,7 @@ function createDeploymentCommands(context, setExitCode) {
27026
28253
  // package.json
27027
28254
  var package_default = {
27028
28255
  name: "@eudiplo/cli",
27029
- version: "9.1.0-main.5e92016",
28256
+ version: "9.1.0-main.60d236d",
27030
28257
  description: "Deployment-aware command line tools for EUDIPLO",
27031
28258
  private: false,
27032
28259
  type: "module",