@eudiplo/cli 9.1.0-main.7cfb7be → 9.1.0-main.84e784c

package/dist/services/url.d.ts

@@ -0,0 +1,21 @@
+/** Throws unless `value` is an absolute HTTP(S) URL, as config loading requires. */
+export declare function validateHttpUrl(value: string, label: string): void;
+/** True when a URL carries user info such as `user:password@`. */
+export declare function hasUserInfo(value: string): boolean;
+/**
+ * Hides user info such as `user:password@` in a URL before it is printed.
+ * URLs without user info are returned exactly as configured. The masked form
+ * is built from the parsed URL, so spellings the URL parser accepts without
+ * `//`, such as `https:user:secret@host`, are masked too. A value that is not
+ * a URL is hidden entirely if it could contain user info.
+ */
+export declare function redactUrl(value: string): string;
+/** Returns the URL without user info, for handing it to another program. */
+export declare function stripUserInfo(url: URL): URL;
+/**
+ * Describes a failed request without the user info of its URL. Node's fetch
+ * repeats the full URL in some errors, for example "Request cannot be
+ * constructed from a URL that includes credentials: <url>".
+ */
+export declare function describeRequestError(error: unknown, url: URL): string;
+//# sourceMappingURL=url.d.ts.map

package/dist/services/url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url.d.ts","sourceRoot":"","sources":["../../src/services/url.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CASlE;AAED,kEAAkE;AAClE,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAOlD;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAa/C;AAED,4EAA4E;AAC5E,wBAAgB,aAAa,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,CAK3C;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,MAAM,CAGrE"}

package/dist/services/url.js

@@ -0,0 +1,61 @@
+/** Throws unless `value` is an absolute HTTP(S) URL, as config loading requires. */
+export function validateHttpUrl(value, label) {
+    try {
+        const url = new URL(value);
+        if (url.protocol !== "http:" && url.protocol !== "https:") {
+            throw new Error("Unsupported URL protocol.");
+        }
+    }
+    catch {
+        throw new Error(`${label} must be an absolute HTTP(S) URL.`);
+    }
+}
+/** True when a URL carries user info such as `user:password@`. */
+export function hasUserInfo(value) {
+    try {
+        const url = new URL(value);
+        return url.username !== "" || url.password !== "";
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Hides user info such as `user:password@` in a URL before it is printed.
+ * URLs without user info are returned exactly as configured. The masked form
+ * is built from the parsed URL, so spellings the URL parser accepts without
+ * `//`, such as `https:user:secret@host`, are masked too. A value that is not
+ * a URL is hidden entirely if it could contain user info.
+ */
+export function redactUrl(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        return value.includes("@") ? "***" : value;
+    }
+    if (url.username === "" && url.password === "") {
+        return value;
+    }
+    url.username = "***";
+    url.password = "";
+    return url.href;
+}
+/** Returns the URL without user info, for handing it to another program. */
+export function stripUserInfo(url) {
+    const stripped = new URL(url.href);
+    stripped.username = "";
+    stripped.password = "";
+    return stripped;
+}
+/**
+ * Describes a failed request without the user info of its URL. Node's fetch
+ * repeats the full URL in some errors, for example "Request cannot be
+ * constructed from a URL that includes credentials: <url>".
+ */
+export function describeRequestError(error, url) {
+    const message = error instanceof Error ? error.message : String(error);
+    return message.replaceAll(url.href, redactUrl(url.href));
+}
+//# sourceMappingURL=url.js.map

package/dist/services/url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url.js","sourceRoot":"","sources":["../../src/services/url.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,KAAa;IACxD,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACjD,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACL,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,mCAAmC,CAAC,CAAC;IACjE,CAAC;AACL,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,WAAW,CAAC,KAAa;IACrC,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACnC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACD,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IAC/C,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC7C,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,GAAG,CAAC,QAAQ,GAAG,KAAK,CAAC;IACrB,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC;IAClB,OAAO,GAAG,CAAC,IAAI,CAAC;AACpB,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,aAAa,CAAC,GAAQ;IAClC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnC,QAAQ,CAAC,QAAQ,GAAG,EAAE,CAAC;IACvB,QAAQ,CAAC,QAAQ,GAAG,EAAE,CAAC;IACvB,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAc,EAAE,GAAQ;IACzD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC7D,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@eudiplo/cli",
-    "version": "9.1.0-main.7cfb7be",
+    "version": "9.1.0-main.84e784c",
     "description": "Deployment-aware command line tools for EUDIPLO",
     "private": false,
     "type": "module",
@@ -15,11 +15,12 @@
     "scripts": {
         "assets:sync": "node scripts/sync-cli-assets.cjs",
         "assets:check": "node scripts/check-cli-assets.cjs",
+        "build:deps": "pnpm --silent --filter \"@eudiplo/cli^...\" build",
         "build": "pnpm assets:sync && pnpm assets:check && tsc -p tsconfig.json",
         "build:publish": "pnpm build && esbuild src/index.ts --bundle --platform=node --format=esm --target=node22.12 --alias:jsonc-parser=jsonc-parser/lib/esm/main.js --outfile=dist/index.js",
         "build:sea:bundle": "pnpm assets:sync && pnpm assets:check && esbuild src/index.ts --bundle --platform=node --format=esm --target=node22.12 --alias:jsonc-parser=jsonc-parser/lib/esm/main.js --outfile=dist-sea/index.js",
         "build:sea": "node scripts/build-cli-sea.mjs",
-        "dev": "tsx src/index.ts",
+        "dev": "pnpm -s build:deps && tsx src/index.ts",
         "test": "vitest run --root ../.. --project cli",
         "lint": "biome lint .",
         "format": "biome format --write .",
@@ -59,11 +60,11 @@
         "jsonc-parser": "^3.3.1"
     },
     "devDependencies": {
-        "@biomejs/biome": "2.5.15",
-        "@types/node": "^26.6.4",
+        "@biomejs/biome": "2.6.3",
+        "@types/node": "^26.6.5",
         "esbuild": "^0.28.2",
         "tsx": "^4.23.15",
         "typescript": "^7.0.2",
-        "vitest": "5.0.3"
+        "vitest": "5.0.5"
     }
 }

package/templates/demo-config/key-chains/status-list.json

@@ -11,10 +11,10 @@
       "type": "private-jwk",
       "jwk": {
         "crv": "P-256",
-        "d": "oXPLTk02Mq9n8GfOTQ8hdoe3ENkNoN_Y2ymLnUmnbV0",
+        "d": "iAUEObUwUI-QDXsFYH9SLm7D-yuEUsOD73YG_jBgLGk",
         "kty": "EC",
-        "x": "HHkkbUgKSkkqXmL8utl-TLWIg8CYQS4WPJ8j_nO44Yw",
-        "y": "1NJY0LT3mEuucLQCZJWNrA7fVW8ypR4Zf5cuu85NjSw",
+        "x": "sSdNHYiCOK0E8lNE9rUQLUN3MbVeDnxjRwVwRiI9BqY",
+        "y": "xRP83r38x_MYGsteGhUW25Q0XVXA-ZRXlP38a8URPDg",
         "alg": "ES256"
       }
     },

package/templates/docker-compose.yml

@@ -89,7 +89,7 @@ services:
       - eudiplo-network
 
   rustfs:
-    image: rustfs/rustfs:1.0.0
+    image: rustfs/rustfs:1.0.1
     restart: always
     profiles: ['s3', 'standard', 'full']
     ports:
@@ -114,7 +114,7 @@ services:
 
   # S3 bucket initialization using the AWS CLI
   rustfs-init:
-    image: amazon/aws-cli:2.37.4
+    image: amazon/aws-cli:2.37.10
     profiles: ['s3', 'standard', 'full']
     depends_on:
       rustfs:

package/templates/schemas/CreateFederationTrustAnchorDto.schema.json

@@ -0,0 +1,82 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "properties": {
+    "id": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 255,
+      "pattern": "^[A-Za-z0-9._-]+$",
+      "description": "Unique identifier of the trust anchor in the tenant."
+    },
+    "entityId": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 2048,
+      "description": "Entity identifier of the trust anchor, exactly as configured in `federation.trustAnchors` and DCQL `openid_federation` values."
+    },
+    "description": {
+      "anyOf": [
+        {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 1000
+        },
+        {
+          "type": "null"
+        }
+      ],
+      "description": "Optional description of the trust anchor."
+    },
+    "jwks": {
+      "type": "object",
+      "properties": {
+        "keys": {
+          "minItems": 1,
+          "maxItems": 20,
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "kty": {
+                "type": "string",
+                "enum": [
+                  "EC",
+                  "RSA",
+                  "OKP"
+                ],
+                "description": "Key type of the public federation key."
+              },
+              "kid": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 256,
+                "description": "Key ID. Federation statements name their signing key with `kid`."
+              }
+            },
+            "required": [
+              "kty",
+              "kid"
+            ],
+            "additionalProperties": {},
+            "description": "Public federation key of the trust anchor as a JWK."
+          },
+          "description": "The trust anchor's federation keys."
+        }
+      },
+      "required": [
+        "keys"
+      ],
+      "additionalProperties": false,
+      "description": "JWK set with the federation keys of the trust anchor, obtained out of band (OpenID Federation 1.0 Section 10.2)."
+    }
+  },
+  "required": [
+    "id",
+    "entityId",
+    "jwks"
+  ],
+  "additionalProperties": false,
+  "$id": "./CreateFederationTrustAnchorDto.schema.json",
+  "title": "CreateFederationTrustAnchorDto"
+}

package/templates/schemas/CreateRegistrarConfigDto.schema.json

@@ -46,6 +46,35 @@
           "type": "null"
         }
       ]
+    },
+    "relyingPartyContact": {
+      "description": "Contact of the relying party, sent when EUDIPLO registers the relying party at the registrar. The registrar needs at least one contact value to issue access certificates. A relying party that is already registered keeps its contact.",
+      "anyOf": [
+        {
+          "type": "object",
+          "properties": {
+            "supportUri": {
+              "description": "https URL where the relying party can be contacted.",
+              "type": "string",
+              "format": "uri"
+            },
+            "email": {
+              "description": "Email address of the relying party.",
+              "type": "string",
+              "pattern": "^[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}$"
+            },
+            "phone": {
+              "description": "Phone number of the relying party.",
+              "type": "string",
+              "pattern": "^[+0-9()\\-\\s]{5,40}$"
+            }
+          },
+          "additionalProperties": false
+        },
+        {
+          "type": "null"
+        }
+      ]
     }
   },
   "required": [

package/templates/schemas/CredentialConfigCreate.schema.json

@@ -714,12 +714,8 @@
           }
         },
         "constraints": {
-          "description": "Optional validation constraints for the claim value.",
-          "type": "object",
-          "propertyNames": {
-            "type": "string"
-          },
-          "additionalProperties": {}
+          "description": "Optional JSON Schema 2020-12 validation keywords for the claim value. Only the JSON Schema keywords listed under Constraints in the claims documentation are accepted (validation keywords such as pattern, minLength or enum, subschemas such as items or properties, and annotations); other keys, such as format or $ref, are refused.",
+          "$ref": "#/$defs/ClaimConstraints"
         },
         "children": {
           "description": "Nested child claim definitions for object or array fields.",
@@ -734,6 +730,240 @@
         "type"
       ],
       "additionalProperties": false
+    },
+    "ClaimConstraints": {
+      "type": "object",
+      "properties": {
+        "type": {},
+        "enum": {},
+        "const": {},
+        "multipleOf": {},
+        "maximum": {},
+        "exclusiveMaximum": {},
+        "minimum": {},
+        "exclusiveMinimum": {},
+        "maxLength": {},
+        "minLength": {},
+        "pattern": {},
+        "maxItems": {},
+        "minItems": {},
+        "uniqueItems": {},
+        "maxContains": {},
+        "minContains": {},
+        "maxProperties": {},
+        "minProperties": {},
+        "required": {},
+        "dependentRequired": {},
+        "title": {},
+        "description": {},
+        "default": {},
+        "examples": {},
+        "deprecated": {},
+        "readOnly": {},
+        "writeOnly": {},
+        "$comment": {},
+        "items": {
+          "anyOf": [
+            {
+              "type": "boolean"
+            },
+            {
+              "$ref": "#/$defs/ClaimConstraints"
+            }
+          ]
+        },
+        "contains": {
+          "anyOf": [
+            {
+              "type": "boolean"
+            },
+            {
+              "$ref": "#/$defs/ClaimConstraints"
+            }
+          ]
+        },
+        "additionalProperties": {
+          "anyOf": [
+            {
+              "type": "boolean"
+            },
+            {
+              "$ref": "#/$defs/ClaimConstraints"
+            }
+          ]
+        },
+        "propertyNames": {
+          "anyOf": [
+            {
+              "type": "boolean"
+            },
+            {
+              "$ref": "#/$defs/ClaimConstraints"
+            }
+          ]
+        },
+        "not": {
+          "anyOf": [
+            {
+              "type": "boolean"
+            },
+            {
+              "$ref": "#/$defs/ClaimConstraints"
+            }
+          ]
+        },
+        "if": {
+          "anyOf": [
+            {
+              "type": "boolean"
+            },
+            {
+              "$ref": "#/$defs/ClaimConstraints"
+            }
+          ]
+        },
+        "then": {
+          "anyOf": [
+            {
+              "type": "boolean"
+            },
+            {
+              "$ref": "#/$defs/ClaimConstraints"
+            }
+          ]
+        },
+        "else": {
+          "anyOf": [
+            {
+              "type": "boolean"
+            },
+            {
+              "$ref": "#/$defs/ClaimConstraints"
+            }
+          ]
+        },
+        "unevaluatedItems": {
+          "anyOf": [
+            {
+              "type": "boolean"
+            },
+            {
+              "$ref": "#/$defs/ClaimConstraints"
+            }
+          ]
+        },
+        "unevaluatedProperties": {
+          "anyOf": [
+            {
+              "type": "boolean"
+            },
+            {
+              "$ref": "#/$defs/ClaimConstraints"
+            }
+          ]
+        },
+        "prefixItems": {
+          "type": "array",
+          "items": {
+            "anyOf": [
+              {
+                "type": "boolean"
+              },
+              {
+                "$ref": "#/$defs/ClaimConstraints"
+              }
+            ]
+          }
+        },
+        "allOf": {
+          "type": "array",
+          "items": {
+            "anyOf": [
+              {
+                "type": "boolean"
+              },
+              {
+                "$ref": "#/$defs/ClaimConstraints"
+              }
+            ]
+          }
+        },
+        "anyOf": {
+          "type": "array",
+          "items": {
+            "anyOf": [
+              {
+                "type": "boolean"
+              },
+              {
+                "$ref": "#/$defs/ClaimConstraints"
+              }
+            ]
+          }
+        },
+        "oneOf": {
+          "type": "array",
+          "items": {
+            "anyOf": [
+              {
+                "type": "boolean"
+              },
+              {
+                "$ref": "#/$defs/ClaimConstraints"
+              }
+            ]
+          }
+        },
+        "properties": {
+          "type": "object",
+          "propertyNames": {
+            "type": "string"
+          },
+          "additionalProperties": {
+            "anyOf": [
+              {
+                "type": "boolean"
+              },
+              {
+                "$ref": "#/$defs/ClaimConstraints"
+              }
+            ]
+          }
+        },
+        "patternProperties": {
+          "type": "object",
+          "propertyNames": {
+            "type": "string"
+          },
+          "additionalProperties": {
+            "anyOf": [
+              {
+                "type": "boolean"
+              },
+              {
+                "$ref": "#/$defs/ClaimConstraints"
+              }
+            ]
+          }
+        },
+        "dependentSchemas": {
+          "type": "object",
+          "propertyNames": {
+            "type": "string"
+          },
+          "additionalProperties": {
+            "anyOf": [
+              {
+                "type": "boolean"
+              },
+              {
+                "$ref": "#/$defs/ClaimConstraints"
+              }
+            ]
+          }
+        }
+      },
+      "additionalProperties": false
     }
   },
   "$id": "./CredentialConfigCreate.schema.json",