@eudiplo/cli 9.1.0-main.9e52ff4 → 9.1.0-main.a601cfe

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (18) hide show
  1. package/dist/commands/config/portability/migrations.spec.js +3 -2
  2. package/dist/commands/config/portability/migrations.spec.js.map +1 -1
  3. package/dist/commands/config/validate/registry.json +10 -0
  4. package/dist/index.js +2411 -711
  5. package/package.json +4 -3
  6. package/templates/demo-config/key-chains/status-list.json +3 -3
  7. package/templates/schemas/CreateFederationTrustAnchorDto.schema.json +82 -0
  8. package/templates/schemas/FederationTrustAnchorConfigFile.schema.json +60 -0
  9. package/templates/schemas/ImportTenantDto.schema.json +12 -0
  10. package/templates/schemas/IssuanceConfig.schema.json +77 -2
  11. package/templates/schemas/IssuanceConfigFile.schema.json +739 -1
  12. package/templates/schemas/KeyChainConfigFile.schema.json +370 -1
  13. package/templates/schemas/KeyChainCreateDto.schema.json +1 -0
  14. package/templates/schemas/KeyChainImportDto.schema.json +1 -0
  15. package/templates/schemas/TenantConfigFile.schema.json +281 -0
  16. package/templates/schemas/UpdateFederationTrustAnchorDto.schema.json +70 -0
  17. package/templates/schemas/UpdateTenantDto.schema.json +20 -0
  18. package/templates/schemas.manifest.json +3 -0
package/dist/index.js CHANGED
@@ -13749,6 +13749,16 @@ var registry_default = [
13749
13749
  "/apps/backend/test/fixtures/*/attribute-providers/*.json"
13750
13750
  ]
13751
13751
  },
13752
+ {
13753
+ kind: "directory",
13754
+ subfolder: "federation-trust-anchors",
13755
+ resourceType: "federation trust anchor",
13756
+ schemaFile: "FederationTrustAnchorConfigFile.schema.json",
13757
+ fileMatch: [
13758
+ "/assets/config/*/federation-trust-anchors/*.json",
13759
+ "/apps/backend/test/fixtures/*/federation-trust-anchors/*.json"
13760
+ ]
13761
+ },
13752
13762
  {
13753
13763
  kind: "directory",
13754
13764
  subfolder: "webhook-endpoints",
@@ -15081,10 +15091,10 @@ function unzipSync(data, opts) {
15081
15091
 
15082
15092
  // ../../packages/eudiplo-config-format/dist/config-format.js
15083
15093
  var CONFIG_FORMATS = {
15084
- Tenant: { slug: "tenant", file: "TenantConfigFile", version: 1 },
15094
+ Tenant: { slug: "tenant", file: "TenantConfigFile", version: 3 },
15085
15095
  Client: { slug: "client", file: "ClientConfigFile", version: 2 },
15086
15096
  KmsConfig: { slug: "kms-config", file: "KmsConfigFile", version: 2 },
15087
- KeyChain: { slug: "key-chain", file: "KeyChainConfigFile", version: 2 },
15097
+ KeyChain: { slug: "key-chain", file: "KeyChainConfigFile", version: 3 },
15088
15098
  RegistrarConfig: {
15089
15099
  slug: "registrar-config",
15090
15100
  file: "RegistrarConfigFile",
@@ -15093,7 +15103,7 @@ var CONFIG_FORMATS = {
15093
15103
  IssuanceConfig: {
15094
15104
  slug: "issuance-config",
15095
15105
  file: "IssuanceConfigFile",
15096
- version: 4
15106
+ version: 5
15097
15107
  },
15098
15108
  CredentialConfig: {
15099
15109
  slug: "credential-config",
@@ -15116,6 +15126,11 @@ var CONFIG_FORMATS = {
15116
15126
  version: 1
15117
15127
  },
15118
15128
  TrustList: { slug: "trust-list", file: "TrustListConfigFile", version: 1 },
15129
+ FederationTrustAnchor: {
15130
+ slug: "federation-trust-anchor",
15131
+ file: "FederationTrustAnchorConfigFile",
15132
+ version: 1
15133
+ },
15119
15134
  StatusList: {
15120
15135
  slug: "status-list",
15121
15136
  file: "StatusListConfigFile",
@@ -15143,16 +15158,74 @@ function resourceId(input) {
15143
15158
  return id;
15144
15159
  }
15145
15160
  function bareFileVersion(kind, spec) {
15146
- if (kind === "KeyChain")
15161
+ if (kind === "KeyChain") {
15162
+ if (spec.usageType === "federation")
15163
+ return 3;
15147
15164
  return "type" in spec ? 2 : 1;
15165
+ }
15148
15166
  if (kind === "RegistrarConfig")
15149
15167
  return "relyingPartyContact" in spec ? 2 : 1;
15168
+ if (kind === "Tenant") {
15169
+ if ("defaultKeyChains" in spec)
15170
+ return 3;
15171
+ return "defaultAccessKeyChainId" in spec ? 2 : 1;
15172
+ }
15150
15173
  if (kind === "KmsConfig") {
15151
15174
  const providers = Array.isArray(spec.providers) ? spec.providers : [];
15152
15175
  return providers.some((provider) => typeof provider === "object" && provider !== null && ("algorithms" in provider || "defaultAlgorithm" in provider)) ? 2 : 1;
15153
15176
  }
15154
15177
  return 1;
15155
15178
  }
15179
+ var issuanceConfigV4ToV5 = {
15180
+ id: "issuance-config-v5-federation-entity",
15181
+ kind: "IssuanceConfig",
15182
+ from: 4,
15183
+ to: 5,
15184
+ migrate(spec) {
15185
+ const federation = spec.federation;
15186
+ const problem = object(federation) && typeof federation.entityId === "string" && federation.entityId !== "" ? federationEntityIdProblem(federation.entityId, {
15187
+ allowHttp: true
15188
+ }) : void 0;
15189
+ if (!problem)
15190
+ return { spec };
15191
+ return {
15192
+ spec,
15193
+ issues: [
15194
+ {
15195
+ severity: "required-input",
15196
+ code: "FEDERATION_ENTITY_ID_INVALID",
15197
+ path: "/spec/federation/entityId",
15198
+ message: `${problem}: set an https URL with a host and without query or fragment, usually <PUBLIC_URL>/issuers/<tenant>`
15199
+ }
15200
+ ]
15201
+ };
15202
+ }
15203
+ };
15204
+ function federationEntityIdProblem(entityId, options) {
15205
+ const value = `federation.entityId '${JSON.stringify(entityId).slice(1, -1)}'`;
15206
+ if (/[\s\u0000-\u001f\u007f]/.test(entityId)) {
15207
+ return `${value} must not contain whitespace or control characters`;
15208
+ }
15209
+ if (entityId.includes("?") || entityId.includes("#")) {
15210
+ return `${value} must not have a query or fragment`;
15211
+ }
15212
+ let url;
15213
+ try {
15214
+ url = new URL(entityId);
15215
+ } catch {
15216
+ return `${value} is not a URL`;
15217
+ }
15218
+ if (url.protocol !== "https:" && !(options.allowHttp && url.protocol === "http:")) {
15219
+ return options.allowHttp ? `${value} must be an https or http URL` : `${value} must be an https URL (http only with OUTBOUND_URL_ALLOW_HTTP=true)`;
15220
+ }
15221
+ if (url.href !== entityId && url.href !== `${entityId}/`) {
15222
+ return `${value} must be written as the URL it stands for: ${url.href}`;
15223
+ }
15224
+ if (url.username || url.password) {
15225
+ return `${value} must not contain credentials`;
15226
+ }
15227
+ return void 0;
15228
+ }
15156
15229
  var presentationConfigV1ToV2 = {
15157
15230
  id: "presentation-config-v2-provides-attestations",
15158
15231
  kind: "PresentationConfig",
@@ -15206,6 +15279,7 @@ var CONFIG_MIGRATIONS = [
15206
15279
  // a valid v4 spec.
15207
15280
  migrate: (spec) => ({ spec })
15208
15281
  },
15282
+ issuanceConfigV4ToV5,
15209
15283
  {
15210
15284
  id: "client-v2-read-and-status-roles",
15211
15285
  kind: "Client",
@@ -15235,6 +15309,35 @@ var CONFIG_MIGRATIONS = [
15235
15309
  // as before.
15236
15310
  migrate: (spec) => ({ spec })
15237
15311
  },
15312
+ {
15313
+ id: "tenant-v2-default-access-key-chain",
15314
+ kind: "Tenant",
15315
+ from: 1,
15316
+ to: 2,
15317
+ // v2 only adds the optional defaultAccessKeyChainId: a v1 spec is a
15318
+ // valid v2 spec, whose tenant keeps picking its access key chain by
15319
+ // rule.
15320
+ migrate: (spec) => ({ spec })
15321
+ },
15322
+ {
15323
+ id: "tenant-v3-default-key-chains",
15324
+ kind: "Tenant",
15325
+ from: 2,
15326
+ to: 3,
15327
+ // v3 keeps the tenant's default key chains in a map by usage type:
15328
+ // defaultAccessKeyChainId becomes defaultKeyChains.access.
15329
+ migrate: (spec) => {
15330
+ const { defaultAccessKeyChainId, ...rest } = spec;
15331
+ return {
15332
+ spec: typeof defaultAccessKeyChainId === "string" ? {
15333
+ ...rest,
15334
+ defaultKeyChains: {
15335
+ access: defaultAccessKeyChainId
15336
+ }
15337
+ } : rest
15338
+ };
15339
+ }
15340
+ },
15238
15341
  {
15239
15342
  id: "key-chain-v2-type",
15240
15343
  kind: "KeyChain",
@@ -15244,6 +15347,15 @@ var CONFIG_MIGRATIONS = [
15244
15347
  // spec, imported as before.
15245
15348
  migrate: (spec) => ({ spec })
15246
15349
  },
15350
+ {
15351
+ id: "key-chain-v3-federation-usage",
15352
+ kind: "KeyChain",
15353
+ from: 2,
15354
+ to: 3,
15355
+ // v3 only adds the usage type `federation`: a v2 spec is a valid v3
15356
+ // spec.
15357
+ migrate: (spec) => ({ spec })
15358
+ },
15247
15359
  {
15248
15360
  id: "credential-config-v2-x509-trusted-authority",
15249
15361
  kind: "CredentialConfig",
@@ -16806,6 +16918,143 @@ var CONFIG_SCHEMAS = [
16806
16918
  }
16807
16919
  }
16808
16920
  },
16921
+ {
16922
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
16923
+ "$id": "https://eudiplo.dev/schemas/v1/FederationTrustAnchorConfigFile.schema.json",
16924
+ "title": "FederationTrustAnchorConfigFile",
16925
+ "type": "object",
16926
+ "properties": {
16927
+ "$schema": {
16928
+ "type": "string",
16929
+ "const": "https://eudiplo.dev/schemas/v1/FederationTrustAnchorConfigFile.schema.json"
16930
+ },
16931
+ "metadata": {
16932
+ "type": "object",
16933
+ "properties": {
16934
+ "generation": {
16935
+ "type": "integer",
16936
+ "minimum": 1,
16937
+ "description": "Monotonically increasing configuration generation."
16938
+ },
16939
+ "ownership": {
16940
+ "type": "string",
16941
+ "enum": [
16942
+ "unmanaged",
16943
+ "file-managed"
16944
+ ],
16945
+ "description": "Requested ownership recorded when the document is applied."
16946
+ }
16947
+ },
16948
+ "additionalProperties": false
16949
+ },
16950
+ "spec": {
16951
+ "allOf": [
16952
+ {
16953
+ "$ref": "#/$defs/CreateFederationTrustAnchorDto"
16954
+ },
16955
+ {
16956
+ "type": "object",
16957
+ "required": [
16958
+ "id"
16959
+ ],
16960
+ "properties": {
16961
+ "id": {
16962
+ "type": "string",
16963
+ "minLength": 1
16964
+ }
16965
+ }
16966
+ }
16967
+ ]
16968
+ }
16969
+ },
16970
+ "required": [
16971
+ "$schema",
16972
+ "spec"
16973
+ ],
16974
+ "additionalProperties": false,
16975
+ "$defs": {
16976
+ "CreateFederationTrustAnchorDto": {
16977
+ "type": "object",
16978
+ "properties": {
16979
+ "id": {
16980
+ "type": "string",
16981
+ "minLength": 1,
16982
+ "maxLength": 255,
16983
+ "pattern": "^[A-Za-z0-9._-]+$",
16984
+ "description": "Unique identifier of the trust anchor in the tenant."
16985
+ },
16986
+ "entityId": {
16987
+ "type": "string",
16988
+ "minLength": 1,
16989
+ "maxLength": 2048,
16990
+ "description": "Entity identifier of the trust anchor, exactly as configured in `federation.trustAnchors` and DCQL `openid_federation` values."
16991
+ },
16992
+ "description": {
16993
+ "anyOf": [
16994
+ {
16995
+ "type": "string",
16996
+ "minLength": 1,
16997
+ "maxLength": 1e3
16998
+ },
16999
+ {
17000
+ "type": "null"
17001
+ }
17002
+ ],
17003
+ "description": "Optional description of the trust anchor."
17004
+ },
17005
+ "jwks": {
17006
+ "type": "object",
17007
+ "properties": {
17008
+ "keys": {
17009
+ "minItems": 1,
17010
+ "maxItems": 20,
17011
+ "type": "array",
17012
+ "items": {
17013
+ "type": "object",
17014
+ "properties": {
17015
+ "kty": {
17016
+ "type": "string",
17017
+ "enum": [
17018
+ "EC",
17019
+ "RSA",
17020
+ "OKP"
17021
+ ],
17022
+ "description": "Key type of the public federation key."
17023
+ },
17024
+ "kid": {
17025
+ "type": "string",
17026
+ "minLength": 1,
17027
+ "maxLength": 256,
17028
+ "description": "Key ID. Federation statements name their signing key with `kid`."
17029
+ }
17030
+ },
17031
+ "required": [
17032
+ "kty",
17033
+ "kid"
17034
+ ],
17035
+ "additionalProperties": {},
17036
+ "description": "Public federation key of the trust anchor as a JWK."
17037
+ },
17038
+ "description": "The trust anchor's federation keys."
17039
+ }
17040
+ },
17041
+ "required": [
17042
+ "keys"
17043
+ ],
17044
+ "additionalProperties": false,
17045
+ "description": "JWK set with the federation keys of the trust anchor, obtained out of band (OpenID Federation 1.0 Section 10.2)."
17046
+ }
17047
+ },
17048
+ "required": [
17049
+ "id",
17050
+ "entityId",
17051
+ "jwks"
17052
+ ],
17053
+ "additionalProperties": false,
17054
+ "title": "CreateFederationTrustAnchorDto"
17055
+ }
17056
+ }
17057
+ },
16809
17058
  {
16810
17059
  "$schema": "https://json-schema.org/draft/2020-12/schema",
16811
17060
  "$id": "https://eudiplo.dev/schemas/v1/IssuanceConfigFile.schema.json",
@@ -24368,13 +24617,13 @@ var CONFIG_SCHEMAS = [
24368
24617
  },
24369
24618
  {
24370
24619
  "$schema": "https://json-schema.org/draft/2020-12/schema",
24371
- "$id": "https://eudiplo.dev/schemas/v3/IssuanceConfigFile.schema.json",
24372
- "title": "IssuanceConfigFile",
24620
+ "$id": "https://eudiplo.dev/schemas/v2/TenantConfigFile.schema.json",
24621
+ "title": "TenantConfigFile",
24373
24622
  "type": "object",
24374
24623
  "properties": {
24375
24624
  "$schema": {
24376
24625
  "type": "string",
24377
- "const": "https://eudiplo.dev/schemas/v3/IssuanceConfigFile.schema.json"
24626
+ "const": "https://eudiplo.dev/schemas/v2/TenantConfigFile.schema.json"
24378
24627
  },
24379
24628
  "metadata": {
24380
24629
  "type": "object",
@@ -24382,115 +24631,246 @@ var CONFIG_SCHEMAS = [
24382
24631
  "generation": {
24383
24632
  "type": "integer",
24384
24633
  "minimum": 1,
24385
- "description": "Monotonically increasing configuration generation."
24634
+ "maximum": 9007199254740991
24386
24635
  },
24387
24636
  "ownership": {
24388
24637
  "type": "string",
24389
24638
  "enum": [
24390
24639
  "unmanaged",
24391
24640
  "file-managed"
24392
- ],
24393
- "description": "Requested ownership recorded when the document is applied."
24641
+ ]
24394
24642
  }
24395
24643
  },
24396
24644
  "additionalProperties": false
24397
24645
  },
24398
24646
  "spec": {
24399
- "$ref": "#/$defs/IssuanceConfig"
24400
- }
24401
- },
24402
- "required": [
24403
- "$schema",
24404
- "spec"
24405
- ],
24406
- "additionalProperties": false,
24407
- "$defs": {
24408
- "IssuanceConfig": {
24409
24647
  "type": "object",
24410
24648
  "properties": {
24411
- "batchSize": {
24412
- "description": "Optional issuance batch size.",
24413
- "type": "integer",
24414
- "minimum": 1,
24415
- "maximum": 9007199254740991
24416
- },
24417
- "dPopRequired": {
24418
- "description": "Require DPoP proofs for issuance endpoints.",
24419
- "type": "boolean"
24420
- },
24421
- "walletAttestationRequired": {
24422
- "description": "Default wallet attestation requirement for managed authorization servers.",
24423
- "type": "boolean"
24424
- },
24425
- "walletProviderTrustLists": {
24426
- "description": "Shared wallet provider trust lists for key attestations and default authorization server wallet authentication.",
24427
- "type": "array",
24428
- "items": {
24429
- "type": "object",
24430
- "properties": {
24431
- "trustListId": {
24432
- "type": "string",
24433
- "minLength": 1
24434
- },
24435
- "url": {
24436
- "description": "URL of the wallet provider trust list.",
24437
- "type": "string",
24438
- "format": "uri"
24439
- },
24440
- "verifierKey": {
24441
- "description": "Optional verifier key material used for trust list verification.",
24442
- "type": "object",
24443
- "propertyNames": {
24444
- "type": "string"
24445
- },
24446
- "additionalProperties": {}
24447
- },
24448
- "verifierKeyPem": {
24449
- "description": "Optional verifier public key in SPKI PEM form (-----BEGIN PUBLIC KEY-----).",
24450
- "type": "string",
24451
- "pattern": "^\\s*-----BEGIN PUBLIC KEY-----[A-Za-z0-9+/=\\s]+-----END PUBLIC KEY-----\\s*$"
24452
- },
24453
- "verifierX509Der": {
24454
- "description": "Optional verifier certificate in DER/base64 form.",
24455
- "type": "string"
24456
- }
24457
- },
24458
- "additionalProperties": false
24459
- }
24649
+ "name": {
24650
+ "default": "EUDIPLO",
24651
+ "description": "Display name of the tenant.",
24652
+ "type": "string",
24653
+ "minLength": 1
24460
24654
  },
24461
- "signingKeyId": {
24462
- "description": "Default signing key chain id for credential issuance.",
24655
+ "description": {
24656
+ "description": "Optional tenant description.",
24463
24657
  "type": "string",
24464
24658
  "minLength": 1
24465
24659
  },
24466
- "authorizationServers": {
24467
- "minItems": 1,
24468
- "type": "array",
24469
- "items": {
24470
- "oneOf": [
24471
- {
24472
- "type": "object",
24473
- "properties": {
24474
- "type": {
24475
- "type": "string",
24476
- "const": "external",
24477
- "description": "Use an externally managed authorization server."
24478
- },
24479
- "id": {
24480
- "type": "string",
24481
- "minLength": 1,
24482
- "description": "Authorization server identifier."
24483
- },
24484
- "issuer": {
24485
- "type": "string",
24486
- "format": "uri",
24487
- "description": "Issuer URL for the external authorization server."
24488
- },
24489
- "sessionBinding": {
24490
- "description": "Explicit mapping from an external access-token claim to an existing issuance session.",
24491
- "type": "object",
24492
- "properties": {
24493
- "method": {
24660
+ "sessionConfig": {
24661
+ "description": "Optional tenant-specific session storage configuration.",
24662
+ "type": "object",
24663
+ "properties": {
24664
+ "ttlSeconds": {
24665
+ "description": "Session time-to-live in seconds.",
24666
+ "type": "integer",
24667
+ "minimum": 60,
24668
+ "maximum": 9007199254740991
24669
+ },
24670
+ "cleanupMode": {
24671
+ "description": "Whether to fully delete or anonymize expired sessions.",
24672
+ "type": "string",
24673
+ "enum": [
24674
+ "full",
24675
+ "anonymize"
24676
+ ]
24677
+ }
24678
+ },
24679
+ "additionalProperties": false
24680
+ },
24681
+ "statusListConfig": {
24682
+ "description": "Optional tenant-specific status list defaults.",
24683
+ "type": "object",
24684
+ "properties": {
24685
+ "capacity": {
24686
+ "description": "Default status list capacity.",
24687
+ "type": "integer",
24688
+ "minimum": 100,
24689
+ "maximum": 9007199254740991
24690
+ },
24691
+ "bits": {
24692
+ "description": "Bits-per-status setting (1, 2, 4, or 8).",
24693
+ "anyOf": [
24694
+ {
24695
+ "type": "number",
24696
+ "const": 1
24697
+ },
24698
+ {
24699
+ "type": "number",
24700
+ "const": 2
24701
+ },
24702
+ {
24703
+ "type": "number",
24704
+ "const": 4
24705
+ },
24706
+ {
24707
+ "type": "number",
24708
+ "const": 8
24709
+ }
24710
+ ]
24711
+ },
24712
+ "ttl": {
24713
+ "description": "JWT TTL for status list tokens in seconds.",
24714
+ "type": "integer",
24715
+ "minimum": 60,
24716
+ "maximum": 9007199254740991
24717
+ },
24718
+ "immediateUpdate": {
24719
+ "description": "Regenerate status list JWTs immediately after status updates.",
24720
+ "type": "boolean"
24721
+ },
24722
+ "enableAggregation": {
24723
+ "description": "Include aggregation_uri in generated status list JWTs.",
24724
+ "type": "boolean"
24725
+ }
24726
+ },
24727
+ "additionalProperties": false
24728
+ },
24729
+ "defaultAccessKeyChainId": {
24730
+ "description": "ID of the access key chain used where no configuration names one: presentation requests of configurations without accessKeyChainId and the signed issuer metadata. Without it, EUDIPLO picks one of the tenant's access key chains by rule.",
24731
+ "type": "string",
24732
+ "minLength": 1
24733
+ }
24734
+ },
24735
+ "required": [
24736
+ "name"
24737
+ ],
24738
+ "additionalProperties": false,
24739
+ "description": "Payload used when importing tenant metadata from config files."
24740
+ }
24741
+ },
24742
+ "required": [
24743
+ "$schema",
24744
+ "metadata",
24745
+ "spec"
24746
+ ],
24747
+ "additionalProperties": false
24748
+ },
24749
+ {
24750
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
24751
+ "$id": "https://eudiplo.dev/schemas/v3/IssuanceConfigFile.schema.json",
24752
+ "title": "IssuanceConfigFile",
24753
+ "type": "object",
24754
+ "properties": {
24755
+ "$schema": {
24756
+ "type": "string",
24757
+ "const": "https://eudiplo.dev/schemas/v3/IssuanceConfigFile.schema.json"
24758
+ },
24759
+ "metadata": {
24760
+ "type": "object",
24761
+ "properties": {
24762
+ "generation": {
24763
+ "type": "integer",
24764
+ "minimum": 1,
24765
+ "description": "Monotonically increasing configuration generation."
24766
+ },
24767
+ "ownership": {
24768
+ "type": "string",
24769
+ "enum": [
24770
+ "unmanaged",
24771
+ "file-managed"
24772
+ ],
24773
+ "description": "Requested ownership recorded when the document is applied."
24774
+ }
24775
+ },
24776
+ "additionalProperties": false
24777
+ },
24778
+ "spec": {
24779
+ "$ref": "#/$defs/IssuanceConfig"
24780
+ }
24781
+ },
24782
+ "required": [
24783
+ "$schema",
24784
+ "spec"
24785
+ ],
24786
+ "additionalProperties": false,
24787
+ "$defs": {
24788
+ "IssuanceConfig": {
24789
+ "type": "object",
24790
+ "properties": {
24791
+ "batchSize": {
24792
+ "description": "Optional issuance batch size.",
24793
+ "type": "integer",
24794
+ "minimum": 1,
24795
+ "maximum": 9007199254740991
24796
+ },
24797
+ "dPopRequired": {
24798
+ "description": "Require DPoP proofs for issuance endpoints.",
24799
+ "type": "boolean"
24800
+ },
24801
+ "walletAttestationRequired": {
24802
+ "description": "Default wallet attestation requirement for managed authorization servers.",
24803
+ "type": "boolean"
24804
+ },
24805
+ "walletProviderTrustLists": {
24806
+ "description": "Shared wallet provider trust lists for key attestations and default authorization server wallet authentication.",
24807
+ "type": "array",
24808
+ "items": {
24809
+ "type": "object",
24810
+ "properties": {
24811
+ "trustListId": {
24812
+ "type": "string",
24813
+ "minLength": 1
24814
+ },
24815
+ "url": {
24816
+ "description": "URL of the wallet provider trust list.",
24817
+ "type": "string",
24818
+ "format": "uri"
24819
+ },
24820
+ "verifierKey": {
24821
+ "description": "Optional verifier key material used for trust list verification.",
24822
+ "type": "object",
24823
+ "propertyNames": {
24824
+ "type": "string"
24825
+ },
24826
+ "additionalProperties": {}
24827
+ },
24828
+ "verifierKeyPem": {
24829
+ "description": "Optional verifier public key in SPKI PEM form (-----BEGIN PUBLIC KEY-----).",
24830
+ "type": "string",
24831
+ "pattern": "^\\s*-----BEGIN PUBLIC KEY-----[A-Za-z0-9+/=\\s]+-----END PUBLIC KEY-----\\s*$"
24832
+ },
24833
+ "verifierX509Der": {
24834
+ "description": "Optional verifier certificate in DER/base64 form.",
24835
+ "type": "string"
24836
+ }
24837
+ },
24838
+ "additionalProperties": false
24839
+ }
24840
+ },
24841
+ "signingKeyId": {
24842
+ "description": "Default signing key chain id for credential issuance.",
24843
+ "type": "string",
24844
+ "minLength": 1
24845
+ },
24846
+ "authorizationServers": {
24847
+ "minItems": 1,
24848
+ "type": "array",
24849
+ "items": {
24850
+ "oneOf": [
24851
+ {
24852
+ "type": "object",
24853
+ "properties": {
24854
+ "type": {
24855
+ "type": "string",
24856
+ "const": "external",
24857
+ "description": "Use an externally managed authorization server."
24858
+ },
24859
+ "id": {
24860
+ "type": "string",
24861
+ "minLength": 1,
24862
+ "description": "Authorization server identifier."
24863
+ },
24864
+ "issuer": {
24865
+ "type": "string",
24866
+ "format": "uri",
24867
+ "description": "Issuer URL for the external authorization server."
24868
+ },
24869
+ "sessionBinding": {
24870
+ "description": "Explicit mapping from an external access-token claim to an existing issuance session.",
24871
+ "type": "object",
24872
+ "properties": {
24873
+ "method": {
24494
24874
  "type": "string",
24495
24875
  "const": "access_token_claim",
24496
24876
  "description": "Read the correlation value from a configured access-token claim."
@@ -25063,13 +25443,13 @@ var CONFIG_SCHEMAS = [
25063
25443
  },
25064
25444
  {
25065
25445
  "$schema": "https://json-schema.org/draft/2020-12/schema",
25066
- "$id": "https://eudiplo.dev/schemas/v3/PresentationConfigFile.schema.json",
25067
- "title": "PresentationConfigFile",
25446
+ "$id": "https://eudiplo.dev/schemas/v3/KeyChainConfigFile.schema.json",
25447
+ "title": "KeyChainConfigFile",
25068
25448
  "type": "object",
25069
25449
  "properties": {
25070
25450
  "$schema": {
25071
25451
  "type": "string",
25072
- "const": "https://eudiplo.dev/schemas/v3/PresentationConfigFile.schema.json"
25452
+ "const": "https://eudiplo.dev/schemas/v3/KeyChainConfigFile.schema.json"
25073
25453
  },
25074
25454
  "metadata": {
25075
25455
  "type": "object",
@@ -25077,597 +25457,1850 @@ var CONFIG_SCHEMAS = [
25077
25457
  "generation": {
25078
25458
  "type": "integer",
25079
25459
  "minimum": 1,
25080
- "description": "Monotonically increasing configuration generation."
25460
+ "maximum": 9007199254740991
25081
25461
  },
25082
25462
  "ownership": {
25083
25463
  "type": "string",
25084
25464
  "enum": [
25085
25465
  "unmanaged",
25086
25466
  "file-managed"
25087
- ],
25088
- "description": "Requested ownership recorded when the document is applied."
25467
+ ]
25089
25468
  }
25090
25469
  },
25091
25470
  "additionalProperties": false
25092
25471
  },
25093
25472
  "spec": {
25094
- "allOf": [
25095
- {
25096
- "$ref": "#/$defs/PresentationConfigCreateDto"
25097
- },
25098
- {
25099
- "type": "object",
25100
- "required": [
25101
- "id"
25102
- ],
25103
- "properties": {
25104
- "id": {
25105
- "type": "string",
25106
- "minLength": 1
25107
- }
25108
- }
25109
- }
25110
- ]
25111
- }
25112
- },
25113
- "required": [
25114
- "$schema",
25115
- "spec"
25116
- ],
25117
- "additionalProperties": false,
25118
- "$defs": {
25119
- "PresentationConfigCreateDto": {
25120
25473
  "type": "object",
25121
25474
  "properties": {
25122
25475
  "id": {
25123
- "type": "string",
25124
- "minLength": 1,
25125
- "description": "Presentation configuration identifier."
25476
+ "type": "string"
25126
25477
  },
25127
25478
  "description": {
25128
- "description": "Optional presentation configuration description.",
25129
- "type": [
25130
- "string",
25131
- "null"
25132
- ]
25479
+ "type": "string"
25480
+ },
25481
+ "usageType": {
25482
+ "type": "string",
25483
+ "enum": [
25484
+ "access",
25485
+ "attestation",
25486
+ "trustList",
25487
+ "statusList",
25488
+ "federation",
25489
+ "encrypt"
25490
+ ]
25491
+ },
25492
+ "type": {
25493
+ "description": "Key chain type. For a `private-jwk` key source without `activeJwk`, `standalone` makes `jwk` the signing key and `crt` its chain, leaf first; `internalChain` makes `jwk` a CA key and the last `crt` entry its CA certificate (created if `crt` is omitted), and the import generates a new signing key with a certificate issued by it. Without `type`, `jwk` is a CA key only if `rotationPolicy.enabled` is true and `crt` is not a single self-signed certificate that is not a CA. For `regenerate`, it is the type of the new key chain and must equal `keySource.keyChainType` if both are set. For the other key sources, it must match the key chain they describe.",
25494
+ "type": "string",
25495
+ "enum": [
25496
+ "standalone",
25497
+ "internalChain"
25498
+ ]
25499
+ },
25500
+ "keySource": {
25501
+ "oneOf": [
25502
+ {
25503
+ "type": "object",
25504
+ "properties": {
25505
+ "type": {
25506
+ "type": "string",
25507
+ "const": "private-jwk"
25508
+ },
25509
+ "jwk": {
25510
+ "type": "object",
25511
+ "properties": {
25512
+ "kty": {
25513
+ "type": "string",
25514
+ "description": "Key type (for example EC)."
25515
+ },
25516
+ "x": {
25517
+ "type": "string",
25518
+ "description": "Elliptic curve public x coordinate."
25519
+ },
25520
+ "y": {
25521
+ "type": "string",
25522
+ "description": "Elliptic curve public y coordinate."
25523
+ },
25524
+ "crv": {
25525
+ "type": "string",
25526
+ "description": "Elliptic curve name."
25527
+ },
25528
+ "d": {
25529
+ "type": "string",
25530
+ "description": "Private key value."
25531
+ },
25532
+ "alg": {
25533
+ "description": "Optional algorithm hint.",
25534
+ "type": "string"
25535
+ },
25536
+ "kid": {
25537
+ "description": "Optional key identifier.",
25538
+ "type": "string"
25539
+ }
25540
+ },
25541
+ "required": [
25542
+ "kty",
25543
+ "x",
25544
+ "y",
25545
+ "crv",
25546
+ "d"
25547
+ ],
25548
+ "additionalProperties": false
25549
+ },
25550
+ "activeJwk": {
25551
+ "type": "object",
25552
+ "properties": {
25553
+ "kty": {
25554
+ "type": "string",
25555
+ "description": "Key type (for example EC)."
25556
+ },
25557
+ "x": {
25558
+ "type": "string",
25559
+ "description": "Elliptic curve public x coordinate."
25560
+ },
25561
+ "y": {
25562
+ "type": "string",
25563
+ "description": "Elliptic curve public y coordinate."
25564
+ },
25565
+ "crv": {
25566
+ "type": "string",
25567
+ "description": "Elliptic curve name."
25568
+ },
25569
+ "d": {
25570
+ "type": "string",
25571
+ "description": "Private key value."
25572
+ },
25573
+ "alg": {
25574
+ "description": "Optional algorithm hint.",
25575
+ "type": "string"
25576
+ },
25577
+ "kid": {
25578
+ "description": "Optional key identifier.",
25579
+ "type": "string"
25580
+ }
25581
+ },
25582
+ "required": [
25583
+ "kty",
25584
+ "x",
25585
+ "y",
25586
+ "crv",
25587
+ "d"
25588
+ ],
25589
+ "additionalProperties": false
25590
+ }
25591
+ },
25592
+ "required": [
25593
+ "type",
25594
+ "jwk"
25595
+ ],
25596
+ "additionalProperties": false
25597
+ },
25598
+ {
25599
+ "type": "object",
25600
+ "properties": {
25601
+ "type": {
25602
+ "type": "string",
25603
+ "const": "external-reference"
25604
+ },
25605
+ "provider": {
25606
+ "type": "string"
25607
+ },
25608
+ "externalKeyId": {
25609
+ "type": "string"
25610
+ },
25611
+ "publicJwk": {
25612
+ "type": "object",
25613
+ "properties": {
25614
+ "kty": {
25615
+ "type": "string"
25616
+ },
25617
+ "x": {
25618
+ "type": "string"
25619
+ },
25620
+ "y": {
25621
+ "type": "string"
25622
+ },
25623
+ "crv": {
25624
+ "type": "string"
25625
+ },
25626
+ "alg": {
25627
+ "type": "string"
25628
+ },
25629
+ "kid": {
25630
+ "type": "string"
25631
+ }
25632
+ },
25633
+ "required": [
25634
+ "kty",
25635
+ "x",
25636
+ "y",
25637
+ "crv"
25638
+ ],
25639
+ "additionalProperties": false
25640
+ },
25641
+ "activeExternalKeyId": {
25642
+ "type": "string"
25643
+ },
25644
+ "activePublicJwk": {
25645
+ "type": "object",
25646
+ "properties": {
25647
+ "kty": {
25648
+ "type": "string"
25649
+ },
25650
+ "x": {
25651
+ "type": "string"
25652
+ },
25653
+ "y": {
25654
+ "type": "string"
25655
+ },
25656
+ "crv": {
25657
+ "type": "string"
25658
+ },
25659
+ "alg": {
25660
+ "type": "string"
25661
+ },
25662
+ "kid": {
25663
+ "type": "string"
25664
+ }
25665
+ },
25666
+ "required": [
25667
+ "kty",
25668
+ "x",
25669
+ "y",
25670
+ "crv"
25671
+ ],
25672
+ "additionalProperties": false
25673
+ }
25674
+ },
25675
+ "required": [
25676
+ "type",
25677
+ "provider",
25678
+ "externalKeyId",
25679
+ "publicJwk"
25680
+ ],
25681
+ "additionalProperties": false
25682
+ },
25683
+ {
25684
+ "type": "object",
25685
+ "properties": {
25686
+ "type": {
25687
+ "type": "string",
25688
+ "const": "required"
25689
+ },
25690
+ "publicJwk": {
25691
+ "type": "object",
25692
+ "properties": {
25693
+ "kty": {
25694
+ "type": "string"
25695
+ },
25696
+ "x": {
25697
+ "type": "string"
25698
+ },
25699
+ "y": {
25700
+ "type": "string"
25701
+ },
25702
+ "crv": {
25703
+ "type": "string"
25704
+ },
25705
+ "alg": {
25706
+ "type": "string"
25707
+ },
25708
+ "kid": {
25709
+ "type": "string"
25710
+ }
25711
+ },
25712
+ "required": [
25713
+ "kty",
25714
+ "x",
25715
+ "y",
25716
+ "crv"
25717
+ ],
25718
+ "additionalProperties": false
25719
+ }
25720
+ },
25721
+ "required": [
25722
+ "type"
25723
+ ],
25724
+ "additionalProperties": false
25725
+ },
25726
+ {
25727
+ "type": "object",
25728
+ "properties": {
25729
+ "type": {
25730
+ "type": "string",
25731
+ "const": "regenerate"
25732
+ },
25733
+ "keyChainType": {
25734
+ "type": "string",
25735
+ "enum": [
25736
+ "standalone",
25737
+ "internalChain"
25738
+ ]
25739
+ }
25740
+ },
25741
+ "required": [
25742
+ "type"
25743
+ ],
25744
+ "additionalProperties": false
25745
+ }
25746
+ ]
25747
+ },
25748
+ "crt": {
25749
+ "type": "array",
25750
+ "items": {
25751
+ "type": "string"
25752
+ }
25753
+ },
25754
+ "activeCertificate": {
25755
+ "description": "Active certificate for an internal key chain.",
25756
+ "type": "string"
25757
+ },
25758
+ "kmsProvider": {
25759
+ "type": "string"
25760
+ },
25761
+ "rotationPolicy": {
25762
+ "type": "object",
25763
+ "properties": {
25764
+ "enabled": {
25765
+ "type": "boolean"
25766
+ },
25767
+ "intervalDays": {
25768
+ "anyOf": [
25769
+ {
25770
+ "type": "number",
25771
+ "minimum": 1,
25772
+ "maximum": 3650
25773
+ },
25774
+ {
25775
+ "type": "null"
25776
+ }
25777
+ ]
25778
+ },
25779
+ "certValidityDays": {
25780
+ "anyOf": [
25781
+ {
25782
+ "type": "number",
25783
+ "minimum": 1,
25784
+ "maximum": 3650
25785
+ },
25786
+ {
25787
+ "type": "null"
25788
+ }
25789
+ ]
25790
+ }
25791
+ },
25792
+ "required": [
25793
+ "enabled"
25794
+ ],
25795
+ "additionalProperties": false
25796
+ }
25797
+ },
25798
+ "required": [
25799
+ "usageType",
25800
+ "keySource"
25801
+ ],
25802
+ "additionalProperties": false
25803
+ }
25804
+ },
25805
+ "required": [
25806
+ "$schema",
25807
+ "metadata",
25808
+ "spec"
25809
+ ],
25810
+ "additionalProperties": false
25811
+ },
25812
+ {
25813
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
25814
+ "$id": "https://eudiplo.dev/schemas/v3/PresentationConfigFile.schema.json",
25815
+ "title": "PresentationConfigFile",
25816
+ "type": "object",
25817
+ "properties": {
25818
+ "$schema": {
25819
+ "type": "string",
25820
+ "const": "https://eudiplo.dev/schemas/v3/PresentationConfigFile.schema.json"
25821
+ },
25822
+ "metadata": {
25823
+ "type": "object",
25824
+ "properties": {
25825
+ "generation": {
25826
+ "type": "integer",
25827
+ "minimum": 1,
25828
+ "description": "Monotonically increasing configuration generation."
25829
+ },
25830
+ "ownership": {
25831
+ "type": "string",
25832
+ "enum": [
25833
+ "unmanaged",
25834
+ "file-managed"
25835
+ ],
25836
+ "description": "Requested ownership recorded when the document is applied."
25837
+ }
25838
+ },
25839
+ "additionalProperties": false
25840
+ },
25841
+ "spec": {
25842
+ "allOf": [
25843
+ {
25844
+ "$ref": "#/$defs/PresentationConfigCreateDto"
25845
+ },
25846
+ {
25847
+ "type": "object",
25848
+ "required": [
25849
+ "id"
25850
+ ],
25851
+ "properties": {
25852
+ "id": {
25853
+ "type": "string",
25854
+ "minLength": 1
25855
+ }
25856
+ }
25857
+ }
25858
+ ]
25859
+ }
25860
+ },
25861
+ "required": [
25862
+ "$schema",
25863
+ "spec"
25864
+ ],
25865
+ "additionalProperties": false,
25866
+ "$defs": {
25867
+ "PresentationConfigCreateDto": {
25868
+ "type": "object",
25869
+ "properties": {
25870
+ "id": {
25871
+ "type": "string",
25872
+ "minLength": 1,
25873
+ "description": "Presentation configuration identifier."
25874
+ },
25875
+ "description": {
25876
+ "description": "Optional presentation configuration description.",
25877
+ "type": [
25878
+ "string",
25879
+ "null"
25880
+ ]
25881
+ },
25882
+ "lifeTime": {
25883
+ "description": "Presentation request lifetime in seconds.",
25884
+ "type": "integer",
25885
+ "minimum": 1,
25886
+ "maximum": 9007199254740991
25887
+ },
25888
+ "skewSeconds": {
25889
+ "description": "Clock skew tolerance in seconds.",
25890
+ "type": "integer",
25891
+ "minimum": 0,
25892
+ "maximum": 9007199254740991
25893
+ },
25894
+ "statusCheckMode": {
25895
+ "description": "Revocation/status check mode.",
25896
+ "type": "string",
25897
+ "enum": [
25898
+ "strict",
25899
+ "best_effort",
25900
+ "disabled"
25901
+ ]
25902
+ },
25903
+ "dcql_query": {
25904
+ "type": "object",
25905
+ "properties": {
25906
+ "credentials": {
25907
+ "minItems": 1,
25908
+ "type": "array",
25909
+ "items": {
25910
+ "oneOf": [
25911
+ {
25912
+ "type": "object",
25913
+ "properties": {
25914
+ "id": {
25915
+ "type": "string",
25916
+ "minLength": 1,
25917
+ "pattern": "^[A-Za-z0-9_-]+$",
25918
+ "description": "Credential query identifier."
25919
+ },
25920
+ "multiple": {
25921
+ "description": "Allow multiple matching credentials.",
25922
+ "type": "boolean"
25923
+ },
25924
+ "claim_sets": {
25925
+ "description": "Optional claim set constraints.",
25926
+ "type": "array",
25927
+ "items": {
25928
+ "type": "array",
25929
+ "items": {
25930
+ "type": "string"
25931
+ }
25932
+ }
25933
+ },
25934
+ "trusted_authorities": {
25935
+ "description": "Optional trusted authority constraints.",
25936
+ "type": "array",
25937
+ "items": {
25938
+ "oneOf": [
25939
+ {
25940
+ "type": "object",
25941
+ "properties": {
25942
+ "type": {
25943
+ "type": "string",
25944
+ "const": "etsi_tl",
25945
+ "description": "Trusted authority type discriminator for ETSI trust lists."
25946
+ },
25947
+ "values": {
25948
+ "type": "array",
25949
+ "items": {
25950
+ "type": "object",
25951
+ "properties": {
25952
+ "trustListId": {
25953
+ "description": "Optional trust list id reference.",
25954
+ "type": "string"
25955
+ },
25956
+ "url": {
25957
+ "description": "Optional trust list URL reference.",
25958
+ "anyOf": [
25959
+ {
25960
+ "type": "string",
25961
+ "format": "uri"
25962
+ },
25963
+ {
25964
+ "type": "string",
25965
+ "pattern": "^<TENANT_URL>(?:\\/.*)?$"
25966
+ }
25967
+ ]
25968
+ },
25969
+ "verifierKey": {
25970
+ "description": "Optional verifier key material.",
25971
+ "type": "object",
25972
+ "propertyNames": {
25973
+ "type": "string"
25974
+ },
25975
+ "additionalProperties": {}
25976
+ },
25977
+ "verifierX509Der": {
25978
+ "description": "Optional verifier certificate in DER/base64 form.",
25979
+ "type": "string"
25980
+ }
25981
+ },
25982
+ "additionalProperties": false
25983
+ },
25984
+ "description": "Trust list references for ETSI TL verification."
25985
+ }
25986
+ },
25987
+ "required": [
25988
+ "type",
25989
+ "values"
25990
+ ],
25991
+ "additionalProperties": false
25992
+ },
25993
+ {
25994
+ "type": "object",
25995
+ "properties": {
25996
+ "type": {
25997
+ "type": "string",
25998
+ "const": "openid_federation",
25999
+ "description": "Trusted authority type discriminator for OpenID Federation."
26000
+ },
26001
+ "values": {
26002
+ "type": "array",
26003
+ "items": {
26004
+ "type": "string"
26005
+ },
26006
+ "description": "OpenID Federation authority identifiers."
26007
+ }
26008
+ },
26009
+ "required": [
26010
+ "type",
26011
+ "values"
26012
+ ],
26013
+ "additionalProperties": false
26014
+ }
26015
+ ]
26016
+ }
26017
+ },
26018
+ "format": {
26019
+ "type": "string",
26020
+ "const": "dc+sd-jwt",
26021
+ "description": "Credential format discriminator."
26022
+ },
26023
+ "meta": {
26024
+ "type": "object",
26025
+ "properties": {
26026
+ "vct_values": {
26027
+ "minItems": 1,
26028
+ "type": "array",
26029
+ "items": {
26030
+ "type": "string"
26031
+ },
26032
+ "description": "Accepted VCT values."
26033
+ }
26034
+ },
26035
+ "required": [
26036
+ "vct_values"
26037
+ ],
26038
+ "additionalProperties": false
26039
+ },
26040
+ "claims": {
26041
+ "description": "Optional claim-level constraints.",
26042
+ "type": "array",
26043
+ "items": {
26044
+ "type": "object",
26045
+ "properties": {
26046
+ "id": {
26047
+ "description": "Optional claim query id.",
26048
+ "type": "string"
26049
+ },
26050
+ "path": {
26051
+ "type": "array",
26052
+ "items": {
26053
+ "type": [
26054
+ "string",
26055
+ "number"
26056
+ ]
26057
+ },
26058
+ "description": "Path to the claim value in presented credentials."
26059
+ },
26060
+ "values": {
26061
+ "description": "Optional allowed values for the claim. A disclosed value must equal one of them in type and value.",
26062
+ "minItems": 1,
26063
+ "type": "array",
26064
+ "items": {
26065
+ "anyOf": [
26066
+ {
26067
+ "type": "string"
26068
+ },
26069
+ {
26070
+ "type": "integer",
26071
+ "minimum": -9007199254740991,
26072
+ "maximum": 9007199254740991
26073
+ },
26074
+ {
26075
+ "type": "boolean"
26076
+ }
26077
+ ]
26078
+ }
26079
+ }
26080
+ },
26081
+ "required": [
26082
+ "path"
26083
+ ],
26084
+ "additionalProperties": false
26085
+ }
26086
+ }
26087
+ },
26088
+ "required": [
26089
+ "id",
26090
+ "format",
26091
+ "meta"
26092
+ ],
26093
+ "additionalProperties": false
26094
+ },
26095
+ {
26096
+ "type": "object",
26097
+ "properties": {
26098
+ "id": {
26099
+ "type": "string",
26100
+ "minLength": 1,
26101
+ "pattern": "^[A-Za-z0-9_-]+$",
26102
+ "description": "Credential query identifier."
26103
+ },
26104
+ "multiple": {
26105
+ "description": "Allow multiple matching credentials.",
26106
+ "type": "boolean"
26107
+ },
26108
+ "claim_sets": {
26109
+ "description": "Optional claim set constraints.",
26110
+ "type": "array",
26111
+ "items": {
26112
+ "type": "array",
26113
+ "items": {
26114
+ "type": "string"
26115
+ }
26116
+ }
26117
+ },
26118
+ "trusted_authorities": {
26119
+ "description": "Optional trusted authority constraints.",
26120
+ "type": "array",
26121
+ "items": {
26122
+ "oneOf": [
26123
+ {
26124
+ "type": "object",
26125
+ "properties": {
26126
+ "type": {
26127
+ "type": "string",
26128
+ "const": "etsi_tl",
26129
+ "description": "Trusted authority type discriminator for ETSI trust lists."
26130
+ },
26131
+ "values": {
26132
+ "type": "array",
26133
+ "items": {
26134
+ "type": "object",
26135
+ "properties": {
26136
+ "trustListId": {
26137
+ "description": "Optional trust list id reference.",
26138
+ "type": "string"
26139
+ },
26140
+ "url": {
26141
+ "description": "Optional trust list URL reference.",
26142
+ "anyOf": [
26143
+ {
26144
+ "type": "string",
26145
+ "format": "uri"
26146
+ },
26147
+ {
26148
+ "type": "string",
26149
+ "pattern": "^<TENANT_URL>(?:\\/.*)?$"
26150
+ }
26151
+ ]
26152
+ },
26153
+ "verifierKey": {
26154
+ "description": "Optional verifier key material.",
26155
+ "type": "object",
26156
+ "propertyNames": {
26157
+ "type": "string"
26158
+ },
26159
+ "additionalProperties": {}
26160
+ },
26161
+ "verifierX509Der": {
26162
+ "description": "Optional verifier certificate in DER/base64 form.",
26163
+ "type": "string"
26164
+ }
26165
+ },
26166
+ "additionalProperties": false
26167
+ },
26168
+ "description": "Trust list references for ETSI TL verification."
26169
+ }
26170
+ },
26171
+ "required": [
26172
+ "type",
26173
+ "values"
26174
+ ],
26175
+ "additionalProperties": false
26176
+ },
26177
+ {
26178
+ "type": "object",
26179
+ "properties": {
26180
+ "type": {
26181
+ "type": "string",
26182
+ "const": "openid_federation",
26183
+ "description": "Trusted authority type discriminator for OpenID Federation."
26184
+ },
26185
+ "values": {
26186
+ "type": "array",
26187
+ "items": {
26188
+ "type": "string"
26189
+ },
26190
+ "description": "OpenID Federation authority identifiers."
26191
+ }
26192
+ },
26193
+ "required": [
26194
+ "type",
26195
+ "values"
26196
+ ],
26197
+ "additionalProperties": false
26198
+ }
26199
+ ]
26200
+ }
26201
+ },
26202
+ "format": {
26203
+ "type": "string",
26204
+ "const": "mso_mdoc",
26205
+ "description": "Credential format discriminator."
26206
+ },
26207
+ "meta": {
26208
+ "type": "object",
26209
+ "properties": {
26210
+ "doctype_value": {
26211
+ "type": "string",
26212
+ "minLength": 1,
26213
+ "description": "Expected mDoc doctype value."
26214
+ }
26215
+ },
26216
+ "required": [
26217
+ "doctype_value"
26218
+ ],
26219
+ "additionalProperties": false
26220
+ },
26221
+ "claims": {
26222
+ "description": "Optional mDoc claim-level constraints.",
26223
+ "type": "array",
26224
+ "items": {
26225
+ "type": "object",
26226
+ "properties": {
26227
+ "id": {
26228
+ "description": "Optional claim query id.",
26229
+ "type": "string"
26230
+ },
26231
+ "path": {
26232
+ "type": "array",
26233
+ "items": {
26234
+ "type": [
26235
+ "string",
26236
+ "number"
26237
+ ]
26238
+ },
26239
+ "description": "Path to the claim value in presented credentials."
26240
+ },
26241
+ "values": {
26242
+ "description": "Optional allowed values for the claim. A disclosed value must equal one of them in type and value.",
26243
+ "minItems": 1,
26244
+ "type": "array",
26245
+ "items": {
26246
+ "anyOf": [
26247
+ {
26248
+ "type": "string"
26249
+ },
26250
+ {
26251
+ "type": "integer",
26252
+ "minimum": -9007199254740991,
26253
+ "maximum": 9007199254740991
26254
+ },
26255
+ {
26256
+ "type": "boolean"
26257
+ }
26258
+ ]
26259
+ }
26260
+ },
26261
+ "intent_to_retain": {
26262
+ "description": "Whether relying party intends to retain the claim.",
26263
+ "type": "boolean"
26264
+ }
26265
+ },
26266
+ "required": [
26267
+ "path"
26268
+ ],
26269
+ "additionalProperties": false
26270
+ }
26271
+ }
26272
+ },
26273
+ "required": [
26274
+ "id",
26275
+ "format",
26276
+ "meta"
26277
+ ],
26278
+ "additionalProperties": false
26279
+ }
26280
+ ]
26281
+ },
26282
+ "description": "Credential queries requested by the verifier."
26283
+ },
26284
+ "credential_sets": {
26285
+ "description": "Optional higher-level credential set requirements.",
26286
+ "type": "array",
26287
+ "items": {
26288
+ "type": "object",
26289
+ "properties": {
26290
+ "options": {
26291
+ "minItems": 1,
26292
+ "type": "array",
26293
+ "items": {
26294
+ "minItems": 1,
26295
+ "type": "array",
26296
+ "items": {
26297
+ "type": "string"
26298
+ }
26299
+ },
26300
+ "description": "Alternative credential query id combinations."
26301
+ },
26302
+ "required": {
26303
+ "description": "Whether this credential set is mandatory.",
26304
+ "type": "boolean"
26305
+ }
26306
+ },
26307
+ "required": [
26308
+ "options"
26309
+ ],
26310
+ "additionalProperties": false
26311
+ }
26312
+ }
26313
+ },
26314
+ "required": [
26315
+ "credentials"
26316
+ ],
26317
+ "additionalProperties": false,
26318
+ "description": "DCQL query defining requested credentials and claims."
26319
+ },
26320
+ "transaction_data": {
26321
+ "description": "Optional transaction data descriptors.",
26322
+ "anyOf": [
26323
+ {
26324
+ "type": "array",
26325
+ "items": {
26326
+ "type": "object",
26327
+ "properties": {
26328
+ "type": {
26329
+ "type": "string",
26330
+ "description": "Transaction data type identifier."
26331
+ },
26332
+ "credential_ids": {
26333
+ "type": "array",
26334
+ "items": {
26335
+ "type": "string"
26336
+ },
26337
+ "description": "Credential query ids this transaction data applies to."
26338
+ },
26339
+ "payload": {
26340
+ "description": "Transaction details. Required for TS12 SCA transaction data."
26341
+ }
26342
+ },
26343
+ "required": [
26344
+ "type",
26345
+ "credential_ids"
26346
+ ],
26347
+ "additionalProperties": {}
26348
+ }
26349
+ },
26350
+ {
26351
+ "type": "null"
26352
+ }
26353
+ ]
26354
+ },
26355
+ "registration_cert": {
26356
+ "description": "Optional registration certificate request settings.",
26357
+ "anyOf": [
26358
+ {
26359
+ "type": "object",
26360
+ "properties": {
26361
+ "id": {
26362
+ "type": "string"
26363
+ },
26364
+ "body": {
26365
+ "type": "object",
26366
+ "properties": {
26367
+ "privacy_policy": {
26368
+ "type": "string"
26369
+ },
26370
+ "support_uri": {
26371
+ "type": "string"
26372
+ },
26373
+ "intermediary": {
26374
+ "type": "string"
26375
+ },
26376
+ "purpose": {
26377
+ "type": "array",
26378
+ "items": {
26379
+ "type": "object",
26380
+ "properties": {
26381
+ "lang": {
26382
+ "type": "string"
26383
+ },
26384
+ "content": {
26385
+ "type": "string"
26386
+ }
26387
+ },
26388
+ "required": [
26389
+ "lang",
26390
+ "content"
26391
+ ],
26392
+ "additionalProperties": false
26393
+ }
26394
+ },
26395
+ "credentials": {
26396
+ "type": "array",
26397
+ "items": {
26398
+ "type": "object",
26399
+ "propertyNames": {
26400
+ "type": "string"
26401
+ },
26402
+ "additionalProperties": {}
26403
+ }
26404
+ },
26405
+ "provides_attestations": {
26406
+ "type": "array",
26407
+ "items": {
26408
+ "type": "string",
26409
+ "minLength": 1
26410
+ }
26411
+ }
26412
+ },
26413
+ "additionalProperties": false
26414
+ },
26415
+ "jwt": {
26416
+ "type": "string"
26417
+ }
26418
+ },
26419
+ "additionalProperties": false
26420
+ },
26421
+ {
26422
+ "type": "null"
26423
+ }
26424
+ ]
26425
+ },
26426
+ "registrationCertImportJwt": {
26427
+ "description": "Optional imported registration certificate JWT.",
26428
+ "type": [
26429
+ "string",
26430
+ "null"
26431
+ ]
26432
+ },
26433
+ "registrationCertImportId": {
26434
+ "description": "Optional registrar-side registration certificate id.",
26435
+ "type": [
26436
+ "string",
26437
+ "null"
26438
+ ]
26439
+ },
26440
+ "registrationCertBodyPrivacyPolicy": {
26441
+ "description": "Optional registration certificate privacy policy URI.",
26442
+ "type": [
26443
+ "string",
26444
+ "null"
26445
+ ]
26446
+ },
26447
+ "registrationCertBodySupportUri": {
26448
+ "description": "Optional registration certificate support URI.",
26449
+ "type": [
26450
+ "string",
26451
+ "null"
26452
+ ]
26453
+ },
26454
+ "registrationCertBodyIntermediary": {
26455
+ "description": "Optional registration certificate intermediary.",
26456
+ "type": [
26457
+ "string",
26458
+ "null"
26459
+ ]
26460
+ },
26461
+ "registrationCertBodyPurpose": {
26462
+ "description": "Optional registration certificate purpose entries.",
26463
+ "anyOf": [
26464
+ {
26465
+ "type": "array",
26466
+ "items": {
26467
+ "type": "object",
26468
+ "properties": {
26469
+ "lang": {
26470
+ "type": "string"
26471
+ },
26472
+ "content": {
26473
+ "type": "string"
26474
+ }
26475
+ },
26476
+ "additionalProperties": false
26477
+ }
26478
+ },
26479
+ {
26480
+ "type": "null"
26481
+ }
26482
+ ]
26483
+ },
26484
+ "webhookEndpointId": {
26485
+ "description": "Optional webhook endpoint id for presentation callbacks.",
26486
+ "type": [
26487
+ "string",
26488
+ "null"
26489
+ ]
26490
+ },
26491
+ "attached": {
26492
+ "description": "Optional attachments included with presentation requests.",
26493
+ "anyOf": [
26494
+ {
26495
+ "type": "array",
26496
+ "items": {
26497
+ "type": "object",
26498
+ "properties": {
26499
+ "format": {
26500
+ "type": "string",
26501
+ "description": "Attachment format identifier."
26502
+ },
26503
+ "data": {
26504
+ "description": "Attachment payload."
26505
+ },
26506
+ "credential_ids": {
26507
+ "description": "Optional credential query ids bound to this attachment.",
26508
+ "type": "array",
26509
+ "items": {
26510
+ "type": "string"
26511
+ }
26512
+ }
26513
+ },
26514
+ "required": [
26515
+ "format",
26516
+ "data"
26517
+ ],
26518
+ "additionalProperties": false
26519
+ }
26520
+ },
26521
+ {
26522
+ "type": "null"
26523
+ }
26524
+ ]
26525
+ },
26526
+ "redirectUri": {
26527
+ "description": "Optional redirect URI after presentation completion.",
26528
+ "type": [
26529
+ "string",
26530
+ "null"
26531
+ ]
26532
+ },
26533
+ "accessKeyChainId": {
26534
+ "description": "Optional key chain id for access token/auth operations.",
26535
+ "type": [
26536
+ "string",
26537
+ "null"
26538
+ ]
26539
+ },
26540
+ "readerAuth": {
26541
+ "description": "Whether reader authentication is required for mDoc requests.",
26542
+ "type": [
26543
+ "boolean",
26544
+ "null"
26545
+ ]
26546
+ }
26547
+ },
26548
+ "required": [
26549
+ "id",
26550
+ "dcql_query"
26551
+ ],
26552
+ "additionalProperties": false,
26553
+ "title": "PresentationConfigCreateDto"
26554
+ }
26555
+ }
26556
+ },
26557
+ {
26558
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
26559
+ "$id": "https://eudiplo.dev/schemas/v3/TenantConfigFile.schema.json",
26560
+ "title": "TenantConfigFile",
26561
+ "type": "object",
26562
+ "properties": {
26563
+ "$schema": {
26564
+ "type": "string",
26565
+ "const": "https://eudiplo.dev/schemas/v3/TenantConfigFile.schema.json"
26566
+ },
26567
+ "metadata": {
26568
+ "type": "object",
26569
+ "properties": {
26570
+ "generation": {
26571
+ "type": "integer",
26572
+ "minimum": 1,
26573
+ "maximum": 9007199254740991
26574
+ },
26575
+ "ownership": {
26576
+ "type": "string",
26577
+ "enum": [
26578
+ "unmanaged",
26579
+ "file-managed"
26580
+ ]
26581
+ }
26582
+ },
26583
+ "additionalProperties": false
26584
+ },
26585
+ "spec": {
26586
+ "type": "object",
26587
+ "properties": {
26588
+ "name": {
26589
+ "default": "EUDIPLO",
26590
+ "description": "Display name of the tenant.",
26591
+ "type": "string",
26592
+ "minLength": 1
26593
+ },
26594
+ "description": {
26595
+ "description": "Optional tenant description.",
26596
+ "type": "string",
26597
+ "minLength": 1
26598
+ },
26599
+ "sessionConfig": {
26600
+ "description": "Optional tenant-specific session storage configuration.",
26601
+ "type": "object",
26602
+ "properties": {
26603
+ "ttlSeconds": {
26604
+ "description": "Session time-to-live in seconds.",
26605
+ "type": "integer",
26606
+ "minimum": 60,
26607
+ "maximum": 9007199254740991
26608
+ },
26609
+ "cleanupMode": {
26610
+ "description": "Whether to fully delete or anonymize expired sessions.",
26611
+ "type": "string",
26612
+ "enum": [
26613
+ "full",
26614
+ "anonymize"
26615
+ ]
26616
+ }
26617
+ },
26618
+ "additionalProperties": false
26619
+ },
26620
+ "statusListConfig": {
26621
+ "description": "Optional tenant-specific status list defaults.",
26622
+ "type": "object",
26623
+ "properties": {
26624
+ "capacity": {
26625
+ "description": "Default status list capacity.",
26626
+ "type": "integer",
26627
+ "minimum": 100,
26628
+ "maximum": 9007199254740991
26629
+ },
26630
+ "bits": {
26631
+ "description": "Bits-per-status setting (1, 2, 4, or 8).",
26632
+ "anyOf": [
26633
+ {
26634
+ "type": "number",
26635
+ "const": 1
26636
+ },
26637
+ {
26638
+ "type": "number",
26639
+ "const": 2
26640
+ },
26641
+ {
26642
+ "type": "number",
26643
+ "const": 4
26644
+ },
26645
+ {
26646
+ "type": "number",
26647
+ "const": 8
26648
+ }
26649
+ ]
26650
+ },
26651
+ "ttl": {
26652
+ "description": "JWT TTL for status list tokens in seconds.",
26653
+ "type": "integer",
26654
+ "minimum": 60,
26655
+ "maximum": 9007199254740991
26656
+ },
26657
+ "immediateUpdate": {
26658
+ "description": "Regenerate status list JWTs immediately after status updates.",
26659
+ "type": "boolean"
26660
+ },
26661
+ "enableAggregation": {
26662
+ "description": "Include aggregation_uri in generated status list JWTs.",
26663
+ "type": "boolean"
26664
+ }
26665
+ },
26666
+ "additionalProperties": false
25133
26667
  },
25134
- "lifeTime": {
25135
- "description": "Presentation request lifetime in seconds.",
26668
+ "defaultKeyChains": {
26669
+ "type": "object",
26670
+ "properties": {
26671
+ "access": {
26672
+ "description": "ID of the access key chain used where no configuration names one: presentation requests of configurations without accessKeyChainId and the signed issuer metadata. Without it, EUDIPLO picks one of the tenant's access key chains by rule.",
26673
+ "type": "string",
26674
+ "minLength": 1
26675
+ }
26676
+ },
26677
+ "additionalProperties": false,
26678
+ "description": "The tenant's key chain per usage type, used where no configuration names one. A usage type without an entry uses a key chain picked by rule."
26679
+ }
26680
+ },
26681
+ "required": [
26682
+ "name"
26683
+ ],
26684
+ "additionalProperties": false,
26685
+ "description": "Payload used when importing tenant metadata from config files."
26686
+ }
26687
+ },
26688
+ "required": [
26689
+ "$schema",
26690
+ "metadata",
26691
+ "spec"
26692
+ ],
26693
+ "additionalProperties": false
26694
+ },
26695
+ {
26696
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
26697
+ "$id": "https://eudiplo.dev/schemas/v4/IssuanceConfigFile.schema.json",
26698
+ "title": "IssuanceConfigFile",
26699
+ "type": "object",
26700
+ "properties": {
26701
+ "$schema": {
26702
+ "type": "string",
26703
+ "const": "https://eudiplo.dev/schemas/v4/IssuanceConfigFile.schema.json"
26704
+ },
26705
+ "metadata": {
26706
+ "type": "object",
26707
+ "properties": {
26708
+ "generation": {
25136
26709
  "type": "integer",
25137
26710
  "minimum": 1,
25138
- "maximum": 9007199254740991
26711
+ "description": "Monotonically increasing configuration generation."
25139
26712
  },
25140
- "skewSeconds": {
25141
- "description": "Clock skew tolerance in seconds.",
26713
+ "ownership": {
26714
+ "type": "string",
26715
+ "enum": [
26716
+ "unmanaged",
26717
+ "file-managed"
26718
+ ],
26719
+ "description": "Requested ownership recorded when the document is applied."
26720
+ }
26721
+ },
26722
+ "additionalProperties": false
26723
+ },
26724
+ "spec": {
26725
+ "$ref": "#/$defs/IssuanceConfig"
26726
+ }
26727
+ },
26728
+ "required": [
26729
+ "$schema",
26730
+ "spec"
26731
+ ],
26732
+ "additionalProperties": false,
26733
+ "$defs": {
26734
+ "IssuanceConfig": {
26735
+ "type": "object",
26736
+ "properties": {
26737
+ "batchSize": {
26738
+ "description": "Optional issuance batch size.",
25142
26739
  "type": "integer",
25143
- "minimum": 0,
26740
+ "minimum": 1,
25144
26741
  "maximum": 9007199254740991
25145
26742
  },
25146
- "statusCheckMode": {
25147
- "description": "Revocation/status check mode.",
25148
- "type": "string",
25149
- "enum": [
25150
- "strict",
25151
- "best_effort",
25152
- "disabled"
26743
+ "dPopRequired": {
26744
+ "description": "Require DPoP proofs for issuance endpoints.",
26745
+ "type": "boolean"
26746
+ },
26747
+ "walletAttestationRequired": {
26748
+ "description": "Default wallet attestation requirement for managed authorization servers.",
26749
+ "type": "boolean"
26750
+ },
26751
+ "walletProviderTrustLists": {
26752
+ "description": "Shared wallet provider trust lists for key attestations and default authorization server wallet authentication.",
26753
+ "type": "array",
26754
+ "items": {
26755
+ "type": "object",
26756
+ "properties": {
26757
+ "trustListId": {
26758
+ "type": "string",
26759
+ "minLength": 1
26760
+ },
26761
+ "url": {
26762
+ "description": "URL of the wallet provider trust list.",
26763
+ "type": "string",
26764
+ "format": "uri"
26765
+ },
26766
+ "verifierKey": {
26767
+ "description": "Optional verifier key material used for trust list verification.",
26768
+ "type": "object",
26769
+ "propertyNames": {
26770
+ "type": "string"
26771
+ },
26772
+ "additionalProperties": {}
26773
+ },
26774
+ "verifierKeyPem": {
26775
+ "description": "Optional verifier public key in SPKI PEM form (-----BEGIN PUBLIC KEY-----).",
26776
+ "type": "string",
26777
+ "pattern": "^\\s*-----BEGIN PUBLIC KEY-----[A-Za-z0-9+/=\\s]+-----END PUBLIC KEY-----\\s*$"
26778
+ },
26779
+ "verifierX509Der": {
26780
+ "description": "Optional verifier certificate in DER/base64 form.",
26781
+ "type": "string"
26782
+ }
26783
+ },
26784
+ "additionalProperties": false
26785
+ }
26786
+ },
26787
+ "walletAttestationStatusCheckMode": {
26788
+ "description": "Default status check mode for wallet attestations at managed authorization servers: strict, best_effort (default) or disabled.",
26789
+ "anyOf": [
26790
+ {
26791
+ "type": "string",
26792
+ "enum": [
26793
+ "strict",
26794
+ "best_effort",
26795
+ "disabled"
26796
+ ]
26797
+ },
26798
+ {
26799
+ "type": "null"
26800
+ }
25153
26801
  ]
25154
26802
  },
25155
- "dcql_query": {
25156
- "type": "object",
25157
- "properties": {
25158
- "credentials": {
25159
- "minItems": 1,
25160
- "type": "array",
25161
- "items": {
25162
- "oneOf": [
25163
- {
26803
+ "signingKeyId": {
26804
+ "description": "Default signing key chain id for credential issuance.",
26805
+ "type": "string",
26806
+ "minLength": 1
26807
+ },
26808
+ "authorizationServers": {
26809
+ "minItems": 1,
26810
+ "type": "array",
26811
+ "items": {
26812
+ "oneOf": [
26813
+ {
26814
+ "type": "object",
26815
+ "properties": {
26816
+ "type": {
26817
+ "type": "string",
26818
+ "const": "external",
26819
+ "description": "Use an externally managed authorization server."
26820
+ },
26821
+ "id": {
26822
+ "type": "string",
26823
+ "minLength": 1,
26824
+ "description": "Authorization server identifier."
26825
+ },
26826
+ "issuer": {
26827
+ "type": "string",
26828
+ "format": "uri",
26829
+ "description": "Issuer URL for the external authorization server."
26830
+ },
26831
+ "sessionBinding": {
26832
+ "description": "Explicit mapping from an external access-token claim to an existing issuance session.",
25164
26833
  "type": "object",
25165
26834
  "properties": {
25166
- "id": {
26835
+ "method": {
26836
+ "type": "string",
26837
+ "const": "access_token_claim",
26838
+ "description": "Read the correlation value from a configured access-token claim."
26839
+ },
26840
+ "claim": {
26841
+ "type": "string",
26842
+ "minLength": 1,
26843
+ "description": "Claim name that contains the issuance-session correlation value."
26844
+ }
26845
+ },
26846
+ "required": [
26847
+ "method",
26848
+ "claim"
26849
+ ],
26850
+ "additionalProperties": false
26851
+ },
26852
+ "label": {
26853
+ "description": "Optional display label for UI selection.",
26854
+ "type": "string"
26855
+ },
26856
+ "enabled": {
26857
+ "description": "Whether this authorization server entry is enabled.",
26858
+ "type": "boolean"
26859
+ }
26860
+ },
26861
+ "required": [
26862
+ "type",
26863
+ "id",
26864
+ "issuer"
26865
+ ],
26866
+ "additionalProperties": false
26867
+ },
26868
+ {
26869
+ "type": "object",
26870
+ "properties": {
26871
+ "type": {
26872
+ "type": "string",
26873
+ "const": "oid4vp",
26874
+ "description": "Use OID4VP-based authorization server chaining."
26875
+ },
26876
+ "id": {
26877
+ "type": "string",
26878
+ "minLength": 1,
26879
+ "description": "Authorization server identifier."
26880
+ },
26881
+ "presentationConfigId": {
26882
+ "type": "string",
26883
+ "minLength": 1,
26884
+ "description": "Presentation configuration id used during authorization."
26885
+ },
26886
+ "immediateWalletRedirect": {
26887
+ "description": "Redirect wallets immediately after authorization response creation.",
26888
+ "type": "boolean"
26889
+ },
26890
+ "token": {
26891
+ "description": "Optional token issuance settings.",
26892
+ "type": "object",
26893
+ "properties": {
26894
+ "lifetimeSeconds": {
26895
+ "description": "Access token lifetime in seconds.",
26896
+ "type": "number",
26897
+ "minimum": 60
26898
+ },
26899
+ "signingKeyId": {
26900
+ "description": "Optional key chain id used to sign issued tokens.",
25167
26901
  "type": "string",
25168
- "minLength": 1,
25169
- "pattern": "^[A-Za-z0-9_-]+$",
25170
- "description": "Credential query identifier."
26902
+ "minLength": 1
25171
26903
  },
25172
- "multiple": {
25173
- "description": "Allow multiple matching credentials.",
26904
+ "refreshTokenEnabled": {
26905
+ "description": "Enable issuing refresh tokens.",
25174
26906
  "type": "boolean"
25175
26907
  },
25176
- "claim_sets": {
25177
- "description": "Optional claim set constraints.",
25178
- "type": "array",
25179
- "items": {
25180
- "type": "array",
25181
- "items": {
25182
- "type": "string"
25183
- }
25184
- }
25185
- },
25186
- "trusted_authorities": {
25187
- "description": "Optional trusted authority constraints.",
25188
- "type": "array",
25189
- "items": {
25190
- "oneOf": [
25191
- {
25192
- "type": "object",
25193
- "properties": {
25194
- "type": {
25195
- "type": "string",
25196
- "const": "etsi_tl",
25197
- "description": "Trusted authority type discriminator for ETSI trust lists."
25198
- },
25199
- "values": {
25200
- "type": "array",
25201
- "items": {
25202
- "type": "object",
25203
- "properties": {
25204
- "trustListId": {
25205
- "description": "Optional trust list id reference.",
25206
- "type": "string"
25207
- },
25208
- "url": {
25209
- "description": "Optional trust list URL reference.",
25210
- "anyOf": [
25211
- {
25212
- "type": "string",
25213
- "format": "uri"
25214
- },
25215
- {
25216
- "type": "string",
25217
- "pattern": "^<TENANT_URL>(?:\\/.*)?$"
25218
- }
25219
- ]
25220
- },
25221
- "verifierKey": {
25222
- "description": "Optional verifier key material.",
25223
- "type": "object",
25224
- "propertyNames": {
25225
- "type": "string"
25226
- },
25227
- "additionalProperties": {}
25228
- },
25229
- "verifierX509Der": {
25230
- "description": "Optional verifier certificate in DER/base64 form.",
25231
- "type": "string"
25232
- }
25233
- },
25234
- "additionalProperties": false
25235
- },
25236
- "description": "Trust list references for ETSI TL verification."
25237
- }
25238
- },
25239
- "required": [
25240
- "type",
25241
- "values"
25242
- ],
25243
- "additionalProperties": false
25244
- },
25245
- {
25246
- "type": "object",
25247
- "properties": {
25248
- "type": {
25249
- "type": "string",
25250
- "const": "openid_federation",
25251
- "description": "Trusted authority type discriminator for OpenID Federation."
25252
- },
25253
- "values": {
25254
- "type": "array",
25255
- "items": {
25256
- "type": "string"
25257
- },
25258
- "description": "OpenID Federation authority identifiers."
25259
- }
25260
- },
25261
- "required": [
25262
- "type",
25263
- "values"
25264
- ],
25265
- "additionalProperties": false
25266
- }
25267
- ]
25268
- }
25269
- },
25270
- "format": {
25271
- "type": "string",
25272
- "const": "dc+sd-jwt",
25273
- "description": "Credential format discriminator."
25274
- },
25275
- "meta": {
25276
- "type": "object",
25277
- "properties": {
25278
- "vct_values": {
25279
- "minItems": 1,
25280
- "type": "array",
25281
- "items": {
25282
- "type": "string"
25283
- },
25284
- "description": "Accepted VCT values."
25285
- }
26908
+ "refreshTokenExpiresInSeconds": {
26909
+ "description": "Refresh token lifetime in seconds.",
26910
+ "type": "number",
26911
+ "minimum": 60
26912
+ }
26913
+ },
26914
+ "additionalProperties": false
26915
+ },
26916
+ "requireDPoP": {
26917
+ "description": "Require DPoP proofs for token/credential requests.",
26918
+ "type": "boolean"
26919
+ },
26920
+ "walletAttestationRequired": {
26921
+ "description": "Require wallet attestation for this authorization server.",
26922
+ "type": "boolean"
26923
+ },
26924
+ "walletProviderTrustLists": {
26925
+ "description": "Optional wallet provider trust list references for this authorization server.",
26926
+ "type": "array",
26927
+ "items": {
26928
+ "type": "object",
26929
+ "properties": {
26930
+ "trustListId": {
26931
+ "type": "string",
26932
+ "minLength": 1
25286
26933
  },
25287
- "required": [
25288
- "vct_values"
25289
- ],
25290
- "additionalProperties": false
25291
- },
25292
- "claims": {
25293
- "description": "Optional claim-level constraints.",
25294
- "type": "array",
25295
- "items": {
26934
+ "url": {
26935
+ "description": "URL of the wallet provider trust list.",
26936
+ "type": "string",
26937
+ "format": "uri"
26938
+ },
26939
+ "verifierKey": {
26940
+ "description": "Optional verifier key material used for trust list verification.",
25296
26941
  "type": "object",
25297
- "properties": {
25298
- "id": {
25299
- "description": "Optional claim query id.",
25300
- "type": "string"
25301
- },
25302
- "path": {
25303
- "type": "array",
25304
- "items": {
25305
- "type": [
25306
- "string",
25307
- "number"
25308
- ]
25309
- },
25310
- "description": "Path to the claim value in presented credentials."
25311
- },
25312
- "values": {
25313
- "description": "Optional allowed values for the claim. A disclosed value must equal one of them in type and value.",
25314
- "minItems": 1,
25315
- "type": "array",
25316
- "items": {
25317
- "anyOf": [
25318
- {
25319
- "type": "string"
25320
- },
25321
- {
25322
- "type": "integer",
25323
- "minimum": -9007199254740991,
25324
- "maximum": 9007199254740991
25325
- },
25326
- {
25327
- "type": "boolean"
25328
- }
25329
- ]
25330
- }
25331
- }
26942
+ "propertyNames": {
26943
+ "type": "string"
25332
26944
  },
25333
- "required": [
25334
- "path"
25335
- ],
25336
- "additionalProperties": false
26945
+ "additionalProperties": {}
26946
+ },
26947
+ "verifierKeyPem": {
26948
+ "description": "Optional verifier public key in SPKI PEM form (-----BEGIN PUBLIC KEY-----).",
26949
+ "type": "string",
26950
+ "pattern": "^\\s*-----BEGIN PUBLIC KEY-----[A-Za-z0-9+/=\\s]+-----END PUBLIC KEY-----\\s*$"
26951
+ },
26952
+ "verifierX509Der": {
26953
+ "description": "Optional verifier certificate in DER/base64 form.",
26954
+ "type": "string"
25337
26955
  }
25338
- }
25339
- },
25340
- "required": [
25341
- "id",
25342
- "format",
25343
- "meta"
25344
- ],
25345
- "additionalProperties": false
26956
+ },
26957
+ "additionalProperties": false
26958
+ }
26959
+ },
26960
+ "walletAttestationStatusCheckMode": {
26961
+ "description": "Status check mode for wallet attestations at this authorization server. Omit to inherit the issuance default.",
26962
+ "type": "string",
26963
+ "enum": [
26964
+ "strict",
26965
+ "best_effort",
26966
+ "disabled"
26967
+ ]
26968
+ },
26969
+ "label": {
26970
+ "description": "Optional display label for UI selection.",
26971
+ "type": "string"
26972
+ },
26973
+ "enabled": {
26974
+ "description": "Whether this authorization server entry is enabled.",
26975
+ "type": "boolean"
26976
+ }
26977
+ },
26978
+ "required": [
26979
+ "type",
26980
+ "id",
26981
+ "presentationConfigId"
26982
+ ],
26983
+ "additionalProperties": false
26984
+ },
26985
+ {
26986
+ "type": "object",
26987
+ "properties": {
26988
+ "type": {
26989
+ "type": "string",
26990
+ "const": "chained",
26991
+ "description": "Use upstream OIDC as authorization source."
26992
+ },
26993
+ "id": {
26994
+ "type": "string",
26995
+ "minLength": 1,
26996
+ "description": "Authorization server identifier."
25346
26997
  },
25347
- {
26998
+ "upstream": {
25348
26999
  "type": "object",
25349
27000
  "properties": {
25350
- "id": {
27001
+ "issuer": {
25351
27002
  "type": "string",
25352
- "minLength": 1,
25353
- "pattern": "^[A-Za-z0-9_-]+$",
25354
- "description": "Credential query identifier."
27003
+ "format": "uri",
27004
+ "description": "Upstream OIDC issuer URL."
25355
27005
  },
25356
- "multiple": {
25357
- "description": "Allow multiple matching credentials.",
25358
- "type": "boolean"
27006
+ "clientId": {
27007
+ "type": "string",
27008
+ "minLength": 1,
27009
+ "description": "Client id for upstream OIDC authentication."
25359
27010
  },
25360
- "claim_sets": {
25361
- "description": "Optional claim set constraints.",
25362
- "type": "array",
25363
- "items": {
25364
- "type": "array",
25365
- "items": {
25366
- "type": "string"
25367
- }
25368
- }
27011
+ "clientSecret": {
27012
+ "description": "Optional client secret for upstream OIDC authentication.",
27013
+ "type": "string",
27014
+ "minLength": 1
25369
27015
  },
25370
- "trusted_authorities": {
25371
- "description": "Optional trusted authority constraints.",
27016
+ "scopes": {
27017
+ "description": "Optional scopes requested from the upstream issuer.",
25372
27018
  "type": "array",
25373
27019
  "items": {
25374
- "oneOf": [
25375
- {
25376
- "type": "object",
25377
- "properties": {
25378
- "type": {
25379
- "type": "string",
25380
- "const": "etsi_tl",
25381
- "description": "Trusted authority type discriminator for ETSI trust lists."
25382
- },
25383
- "values": {
25384
- "type": "array",
25385
- "items": {
25386
- "type": "object",
25387
- "properties": {
25388
- "trustListId": {
25389
- "description": "Optional trust list id reference.",
25390
- "type": "string"
25391
- },
25392
- "url": {
25393
- "description": "Optional trust list URL reference.",
25394
- "anyOf": [
25395
- {
25396
- "type": "string",
25397
- "format": "uri"
25398
- },
25399
- {
25400
- "type": "string",
25401
- "pattern": "^<TENANT_URL>(?:\\/.*)?$"
25402
- }
25403
- ]
25404
- },
25405
- "verifierKey": {
25406
- "description": "Optional verifier key material.",
25407
- "type": "object",
25408
- "propertyNames": {
25409
- "type": "string"
25410
- },
25411
- "additionalProperties": {}
25412
- },
25413
- "verifierX509Der": {
25414
- "description": "Optional verifier certificate in DER/base64 form.",
25415
- "type": "string"
25416
- }
25417
- },
25418
- "additionalProperties": false
25419
- },
25420
- "description": "Trust list references for ETSI TL verification."
25421
- }
25422
- },
25423
- "required": [
25424
- "type",
25425
- "values"
25426
- ],
25427
- "additionalProperties": false
25428
- },
25429
- {
25430
- "type": "object",
25431
- "properties": {
25432
- "type": {
25433
- "type": "string",
25434
- "const": "openid_federation",
25435
- "description": "Trusted authority type discriminator for OpenID Federation."
25436
- },
25437
- "values": {
25438
- "type": "array",
25439
- "items": {
25440
- "type": "string"
25441
- },
25442
- "description": "OpenID Federation authority identifiers."
25443
- }
25444
- },
25445
- "required": [
25446
- "type",
25447
- "values"
25448
- ],
25449
- "additionalProperties": false
25450
- }
25451
- ]
27020
+ "type": "string",
27021
+ "minLength": 1
25452
27022
  }
27023
+ }
27024
+ },
27025
+ "required": [
27026
+ "issuer",
27027
+ "clientId"
27028
+ ],
27029
+ "additionalProperties": false,
27030
+ "description": "Upstream OIDC connection settings."
27031
+ },
27032
+ "token": {
27033
+ "description": "Optional token issuance settings.",
27034
+ "type": "object",
27035
+ "properties": {
27036
+ "lifetimeSeconds": {
27037
+ "description": "Access token lifetime in seconds.",
27038
+ "type": "number",
27039
+ "minimum": 60
25453
27040
  },
25454
- "format": {
27041
+ "signingKeyId": {
27042
+ "description": "Optional key chain id used to sign issued tokens.",
25455
27043
  "type": "string",
25456
- "const": "mso_mdoc",
25457
- "description": "Credential format discriminator."
27044
+ "minLength": 1
25458
27045
  },
25459
- "meta": {
25460
- "type": "object",
25461
- "properties": {
25462
- "doctype_value": {
25463
- "type": "string",
25464
- "minLength": 1,
25465
- "description": "Expected mDoc doctype value."
25466
- }
25467
- },
25468
- "required": [
25469
- "doctype_value"
25470
- ],
25471
- "additionalProperties": false
27046
+ "refreshTokenEnabled": {
27047
+ "description": "Enable issuing refresh tokens.",
27048
+ "type": "boolean"
25472
27049
  },
25473
- "claims": {
25474
- "description": "Optional mDoc claim-level constraints.",
25475
- "type": "array",
25476
- "items": {
25477
- "type": "object",
25478
- "properties": {
25479
- "id": {
25480
- "description": "Optional claim query id.",
25481
- "type": "string"
25482
- },
25483
- "path": {
25484
- "type": "array",
25485
- "items": {
25486
- "type": [
25487
- "string",
25488
- "number"
25489
- ]
25490
- },
25491
- "description": "Path to the claim value in presented credentials."
25492
- },
25493
- "values": {
25494
- "description": "Optional allowed values for the claim. A disclosed value must equal one of them in type and value.",
25495
- "minItems": 1,
25496
- "type": "array",
25497
- "items": {
25498
- "anyOf": [
25499
- {
25500
- "type": "string"
25501
- },
25502
- {
25503
- "type": "integer",
25504
- "minimum": -9007199254740991,
25505
- "maximum": 9007199254740991
25506
- },
25507
- {
25508
- "type": "boolean"
25509
- }
25510
- ]
25511
- }
25512
- },
25513
- "intent_to_retain": {
25514
- "description": "Whether relying party intends to retain the claim.",
25515
- "type": "boolean"
25516
- }
25517
- },
25518
- "required": [
25519
- "path"
25520
- ],
25521
- "additionalProperties": false
25522
- }
27050
+ "refreshTokenExpiresInSeconds": {
27051
+ "description": "Refresh token lifetime in seconds.",
27052
+ "type": "number",
27053
+ "minimum": 60
25523
27054
  }
25524
27055
  },
25525
- "required": [
25526
- "id",
25527
- "format",
25528
- "meta"
25529
- ],
25530
27056
  "additionalProperties": false
25531
- }
25532
- ]
25533
- },
25534
- "description": "Credential queries requested by the verifier."
25535
- },
25536
- "credential_sets": {
25537
- "description": "Optional higher-level credential set requirements.",
25538
- "type": "array",
25539
- "items": {
25540
- "type": "object",
25541
- "properties": {
25542
- "options": {
25543
- "minItems": 1,
27057
+ },
27058
+ "requireDPoP": {
27059
+ "description": "Require DPoP proofs for token/credential requests.",
27060
+ "type": "boolean"
27061
+ },
27062
+ "walletAttestationRequired": {
27063
+ "description": "Require wallet attestation for this authorization server.",
27064
+ "type": "boolean"
27065
+ },
27066
+ "walletProviderTrustLists": {
27067
+ "description": "Optional wallet provider trust list references for this authorization server.",
25544
27068
  "type": "array",
25545
27069
  "items": {
25546
- "minItems": 1,
25547
- "type": "array",
25548
- "items": {
25549
- "type": "string"
25550
- }
25551
- },
25552
- "description": "Alternative credential query id combinations."
27070
+ "type": "object",
27071
+ "properties": {
27072
+ "trustListId": {
27073
+ "type": "string",
27074
+ "minLength": 1
27075
+ },
27076
+ "url": {
27077
+ "description": "URL of the wallet provider trust list.",
27078
+ "type": "string",
27079
+ "format": "uri"
27080
+ },
27081
+ "verifierKey": {
27082
+ "description": "Optional verifier key material used for trust list verification.",
27083
+ "type": "object",
27084
+ "propertyNames": {
27085
+ "type": "string"
27086
+ },
27087
+ "additionalProperties": {}
27088
+ },
27089
+ "verifierKeyPem": {
27090
+ "description": "Optional verifier public key in SPKI PEM form (-----BEGIN PUBLIC KEY-----).",
27091
+ "type": "string",
27092
+ "pattern": "^\\s*-----BEGIN PUBLIC KEY-----[A-Za-z0-9+/=\\s]+-----END PUBLIC KEY-----\\s*$"
27093
+ },
27094
+ "verifierX509Der": {
27095
+ "description": "Optional verifier certificate in DER/base64 form.",
27096
+ "type": "string"
27097
+ }
27098
+ },
27099
+ "additionalProperties": false
27100
+ }
25553
27101
  },
25554
- "required": {
25555
- "description": "Whether this credential set is mandatory.",
27102
+ "walletAttestationStatusCheckMode": {
27103
+ "description": "Status check mode for wallet attestations at this authorization server. Omit to inherit the issuance default.",
27104
+ "type": "string",
27105
+ "enum": [
27106
+ "strict",
27107
+ "best_effort",
27108
+ "disabled"
27109
+ ]
27110
+ },
27111
+ "label": {
27112
+ "description": "Optional display label for UI selection.",
27113
+ "type": "string"
27114
+ },
27115
+ "enabled": {
27116
+ "description": "Whether this authorization server entry is enabled.",
25556
27117
  "type": "boolean"
25557
27118
  }
25558
27119
  },
25559
27120
  "required": [
25560
- "options"
27121
+ "type",
27122
+ "id",
27123
+ "upstream"
25561
27124
  ],
25562
27125
  "additionalProperties": false
25563
- }
25564
- }
25565
- },
25566
- "required": [
25567
- "credentials"
25568
- ],
25569
- "additionalProperties": false,
25570
- "description": "DCQL query defining requested credentials and claims."
25571
- },
25572
- "transaction_data": {
25573
- "description": "Optional transaction data descriptors.",
25574
- "anyOf": [
25575
- {
25576
- "type": "array",
25577
- "items": {
27126
+ },
27127
+ {
25578
27128
  "type": "object",
25579
27129
  "properties": {
25580
27130
  "type": {
25581
27131
  "type": "string",
25582
- "description": "Transaction data type identifier."
27132
+ "const": "built-in",
27133
+ "description": "Use EUDIPLO built-in authorization server."
25583
27134
  },
25584
- "credential_ids": {
27135
+ "id": {
27136
+ "type": "string",
27137
+ "minLength": 1,
27138
+ "description": "Authorization server identifier."
27139
+ },
27140
+ "token": {
27141
+ "description": "Optional token issuance settings.",
27142
+ "type": "object",
27143
+ "properties": {
27144
+ "lifetimeSeconds": {
27145
+ "description": "Access token lifetime in seconds.",
27146
+ "type": "number",
27147
+ "minimum": 60
27148
+ },
27149
+ "signingKeyId": {
27150
+ "description": "Optional key chain id used to sign issued tokens.",
27151
+ "type": "string",
27152
+ "minLength": 1
27153
+ },
27154
+ "refreshTokenEnabled": {
27155
+ "description": "Enable issuing refresh tokens.",
27156
+ "type": "boolean"
27157
+ },
27158
+ "refreshTokenExpiresInSeconds": {
27159
+ "description": "Refresh token lifetime in seconds.",
27160
+ "type": "number",
27161
+ "minimum": 60
27162
+ }
27163
+ },
27164
+ "additionalProperties": false
27165
+ },
27166
+ "requireDPoP": {
27167
+ "description": "Require DPoP proofs for token/credential requests.",
27168
+ "type": "boolean"
27169
+ },
27170
+ "walletAttestationRequired": {
27171
+ "description": "Require wallet attestation for this authorization server.",
27172
+ "type": "boolean"
27173
+ },
27174
+ "walletProviderTrustLists": {
27175
+ "description": "Optional wallet provider trust list references for this authorization server.",
25585
27176
  "type": "array",
25586
27177
  "items": {
25587
- "type": "string"
25588
- },
25589
- "description": "Credential query ids this transaction data applies to."
27178
+ "type": "object",
27179
+ "properties": {
27180
+ "trustListId": {
27181
+ "type": "string",
27182
+ "minLength": 1
27183
+ },
27184
+ "url": {
27185
+ "description": "URL of the wallet provider trust list.",
27186
+ "type": "string",
27187
+ "format": "uri"
27188
+ },
27189
+ "verifierKey": {
27190
+ "description": "Optional verifier key material used for trust list verification.",
27191
+ "type": "object",
27192
+ "propertyNames": {
27193
+ "type": "string"
27194
+ },
27195
+ "additionalProperties": {}
27196
+ },
27197
+ "verifierKeyPem": {
27198
+ "description": "Optional verifier public key in SPKI PEM form (-----BEGIN PUBLIC KEY-----).",
27199
+ "type": "string",
27200
+ "pattern": "^\\s*-----BEGIN PUBLIC KEY-----[A-Za-z0-9+/=\\s]+-----END PUBLIC KEY-----\\s*$"
27201
+ },
27202
+ "verifierX509Der": {
27203
+ "description": "Optional verifier certificate in DER/base64 form.",
27204
+ "type": "string"
27205
+ }
27206
+ },
27207
+ "additionalProperties": false
27208
+ }
25590
27209
  },
25591
- "payload": {
25592
- "description": "Transaction details. Required for TS12 SCA transaction data."
27210
+ "walletAttestationStatusCheckMode": {
27211
+ "description": "Status check mode for wallet attestations at this authorization server. Omit to inherit the issuance default.",
27212
+ "type": "string",
27213
+ "enum": [
27214
+ "strict",
27215
+ "best_effort",
27216
+ "disabled"
27217
+ ]
27218
+ },
27219
+ "label": {
27220
+ "description": "Optional display label for UI selection.",
27221
+ "type": "string"
27222
+ },
27223
+ "enabled": {
27224
+ "description": "Whether this authorization server entry is enabled.",
27225
+ "type": "boolean"
25593
27226
  }
25594
27227
  },
25595
27228
  "required": [
25596
27229
  "type",
25597
- "credential_ids"
27230
+ "id"
25598
27231
  ],
25599
- "additionalProperties": {}
27232
+ "additionalProperties": false
25600
27233
  }
25601
- },
25602
- {
25603
- "type": "null"
25604
- }
25605
- ]
27234
+ ],
27235
+ "description": "Supported authorization server configurations."
27236
+ },
27237
+ "description": "Configured authorization server entries."
25606
27238
  },
25607
- "registration_cert": {
25608
- "description": "Optional registration certificate request settings.",
27239
+ "federation": {
27240
+ "description": "Optional OpenID Federation settings.",
25609
27241
  "anyOf": [
25610
27242
  {
25611
27243
  "type": "object",
25612
27244
  "properties": {
25613
- "id": {
27245
+ "role": {
27246
+ "description": "Federation role for this issuer.",
27247
+ "type": "string",
27248
+ "enum": [
27249
+ "trust_anchor",
27250
+ "intermediate",
27251
+ "leaf"
27252
+ ]
27253
+ },
27254
+ "mode": {
27255
+ "description": "Federation operation mode.",
27256
+ "type": "string",
27257
+ "enum": [
27258
+ "federation-only",
27259
+ "hybrid"
27260
+ ]
27261
+ },
27262
+ "entityId": {
27263
+ "description": "Optional local federation entity id.",
25614
27264
  "type": "string"
25615
27265
  },
25616
- "body": {
25617
- "type": "object",
25618
- "properties": {
25619
- "privacy_policy": {
25620
- "type": "string"
25621
- },
25622
- "support_uri": {
25623
- "type": "string"
25624
- },
25625
- "intermediary": {
25626
- "type": "string"
25627
- },
25628
- "purpose": {
25629
- "type": "array",
25630
- "items": {
25631
- "type": "object",
25632
- "properties": {
25633
- "lang": {
25634
- "type": "string"
25635
- },
25636
- "content": {
25637
- "type": "string"
25638
- }
25639
- },
25640
- "required": [
25641
- "lang",
25642
- "content"
25643
- ],
25644
- "additionalProperties": false
25645
- }
25646
- },
25647
- "credentials": {
25648
- "type": "array",
25649
- "items": {
25650
- "type": "object",
25651
- "propertyNames": {
25652
- "type": "string"
25653
- },
25654
- "additionalProperties": {}
25655
- }
25656
- },
25657
- "provides_attestations": {
25658
- "type": "array",
25659
- "items": {
27266
+ "enforceSigningPolicy": {
27267
+ "description": "Enforce strict signing policy checks.",
27268
+ "type": "boolean"
27269
+ },
27270
+ "cacheTtlSeconds": {
27271
+ "description": "Cache time-to-live for federation metadata in seconds.",
27272
+ "type": "integer",
27273
+ "minimum": 1,
27274
+ "maximum": 9007199254740991
27275
+ },
27276
+ "trustAnchors": {
27277
+ "type": "array",
27278
+ "items": {
27279
+ "type": "object",
27280
+ "properties": {
27281
+ "entityId": {
27282
+ "type": "string",
27283
+ "minLength": 1,
27284
+ "description": "Federation trust anchor entity id."
27285
+ },
27286
+ "entityConfigurationUri": {
25660
27287
  "type": "string",
25661
- "minLength": 1
27288
+ "format": "uri",
27289
+ "description": "Entity configuration URI for the trust anchor."
25662
27290
  }
25663
- }
27291
+ },
27292
+ "required": [
27293
+ "entityId",
27294
+ "entityConfigurationUri"
27295
+ ],
27296
+ "additionalProperties": false
25664
27297
  },
25665
- "additionalProperties": false
25666
- },
25667
- "jwt": {
25668
- "type": "string"
27298
+ "description": "Federation trust anchors."
25669
27299
  }
25670
27300
  },
27301
+ "required": [
27302
+ "trustAnchors"
27303
+ ],
25671
27304
  "additionalProperties": false
25672
27305
  },
25673
27306
  {
@@ -25675,146 +27308,137 @@ var CONFIG_SCHEMAS = [
25675
27308
  }
25676
27309
  ]
25677
27310
  },
25678
- "registrationCertImportJwt": {
25679
- "description": "Optional imported registration certificate JWT.",
25680
- "type": [
25681
- "string",
25682
- "null"
25683
- ]
25684
- },
25685
- "registrationCertImportId": {
25686
- "description": "Optional registrar-side registration certificate id.",
25687
- "type": [
25688
- "string",
25689
- "null"
25690
- ]
25691
- },
25692
- "registrationCertBodyPrivacyPolicy": {
25693
- "description": "Optional registration certificate privacy policy URI.",
25694
- "type": [
25695
- "string",
25696
- "null"
25697
- ]
25698
- },
25699
- "registrationCertBodySupportUri": {
25700
- "description": "Optional registration certificate support URI.",
25701
- "type": [
25702
- "string",
25703
- "null"
25704
- ]
25705
- },
25706
- "registrationCertBodyIntermediary": {
25707
- "description": "Optional registration certificate intermediary.",
25708
- "type": [
25709
- "string",
25710
- "null"
25711
- ]
25712
- },
25713
- "registrationCertBodyPurpose": {
25714
- "description": "Optional registration certificate purpose entries.",
27311
+ "registrationCertificate": {
27312
+ "description": "Optional registration certificate settings.",
25715
27313
  "anyOf": [
25716
27314
  {
25717
- "type": "array",
25718
- "items": {
25719
- "type": "object",
25720
- "properties": {
25721
- "lang": {
25722
- "type": "string"
25723
- },
25724
- "content": {
25725
- "type": "string"
25726
- }
27315
+ "type": "object",
27316
+ "properties": {
27317
+ "enabled": {
27318
+ "description": "Enable issuer registration certificate support.",
27319
+ "type": "boolean"
25727
27320
  },
25728
- "additionalProperties": false
25729
- }
27321
+ "mode": {
27322
+ "description": "How registration certificate data is provided.",
27323
+ "type": "string",
27324
+ "enum": [
27325
+ "import",
27326
+ "generate"
27327
+ ]
27328
+ },
27329
+ "jwt": {
27330
+ "description": "Optional registration certificate JWT when using import mode.",
27331
+ "type": "string"
27332
+ },
27333
+ "privacyPolicy": {
27334
+ "description": "Optional privacy policy URI.",
27335
+ "type": "string"
27336
+ },
27337
+ "supportUri": {
27338
+ "description": "Optional support URI.",
27339
+ "type": "string"
27340
+ }
27341
+ },
27342
+ "additionalProperties": false
25730
27343
  },
25731
27344
  {
25732
27345
  "type": "null"
25733
27346
  }
25734
27347
  ]
25735
27348
  },
25736
- "webhookEndpointId": {
25737
- "description": "Optional webhook endpoint id for presentation callbacks.",
25738
- "type": [
25739
- "string",
25740
- "null"
25741
- ]
25742
- },
25743
- "attached": {
25744
- "description": "Optional attachments included with presentation requests.",
25745
- "anyOf": [
25746
- {
25747
- "type": "array",
25748
- "items": {
27349
+ "display": {
27350
+ "description": "Localized issuer metadata shown to wallets.",
27351
+ "type": "array",
27352
+ "items": {
27353
+ "type": "object",
27354
+ "properties": {
27355
+ "name": {
27356
+ "description": "Issuer display name.",
27357
+ "type": "string"
27358
+ },
27359
+ "locale": {
27360
+ "description": "Locale tag for this display entry.",
27361
+ "type": "string"
27362
+ },
27363
+ "logo": {
27364
+ "description": "Optional issuer logo metadata.",
25749
27365
  "type": "object",
25750
27366
  "properties": {
25751
- "format": {
27367
+ "uri": {
25752
27368
  "type": "string",
25753
- "description": "Attachment format identifier."
25754
- },
25755
- "data": {
25756
- "description": "Attachment payload."
27369
+ "minLength": 1,
27370
+ "description": "Logo URI."
25757
27371
  },
25758
- "credential_ids": {
25759
- "description": "Optional credential query ids bound to this attachment.",
25760
- "type": "array",
25761
- "items": {
25762
- "type": "string"
25763
- }
27372
+ "alt_text": {
27373
+ "description": "Optional localized alternative text.",
27374
+ "type": "string"
25764
27375
  }
25765
27376
  },
25766
27377
  "required": [
25767
- "format",
25768
- "data"
27378
+ "uri"
25769
27379
  ],
25770
- "additionalProperties": false
27380
+ "additionalProperties": {}
25771
27381
  }
25772
27382
  },
27383
+ "additionalProperties": {}
27384
+ }
27385
+ },
27386
+ "notificationEndpointEnabled": {
27387
+ "description": "Whether the OID4VCI notification endpoint is exposed for this issuance configuration.",
27388
+ "type": "boolean"
27389
+ },
27390
+ "credentialResponseEncryption": {
27391
+ "description": "Enable encrypted credential responses.",
27392
+ "type": "boolean"
27393
+ },
27394
+ "credentialRequestEncryption": {
27395
+ "description": "Require encrypted credential requests.",
27396
+ "type": "boolean"
27397
+ },
27398
+ "txCodeMaxAttempts": {
27399
+ "description": "Maximum verification attempts for transaction codes. Null resets to defaults.",
27400
+ "anyOf": [
27401
+ {
27402
+ "type": "integer",
27403
+ "minimum": 1,
27404
+ "maximum": 9007199254740991
27405
+ },
25773
27406
  {
25774
27407
  "type": "null"
25775
27408
  }
25776
27409
  ]
25777
27410
  },
25778
- "redirectUri": {
25779
- "description": "Optional redirect URI after presentation completion.",
25780
- "type": [
25781
- "string",
25782
- "null"
25783
- ]
25784
- },
25785
- "accessKeyChainId": {
25786
- "description": "Optional key chain id for access token/auth operations.",
25787
- "type": [
25788
- "string",
25789
- "null"
25790
- ]
25791
- },
25792
- "readerAuth": {
25793
- "description": "Whether reader authentication is required for mDoc requests.",
25794
- "type": [
25795
- "boolean",
25796
- "null"
27411
+ "offerLifetimeSeconds": {
27412
+ "description": "Default lifetime of credential offers in seconds. Can be overridden per offer request. Null or unset: offers do not expire.",
27413
+ "anyOf": [
27414
+ {
27415
+ "type": "integer",
27416
+ "minimum": 1,
27417
+ "maximum": 9007199254740991
27418
+ },
27419
+ {
27420
+ "type": "null"
27421
+ }
25797
27422
  ]
25798
27423
  }
25799
27424
  },
25800
27425
  "required": [
25801
- "id",
25802
- "dcql_query"
27426
+ "authorizationServers"
25803
27427
  ],
25804
27428
  "additionalProperties": false,
25805
- "title": "PresentationConfigCreateDto"
27429
+ "title": "IssuanceConfig"
25806
27430
  }
25807
27431
  }
25808
27432
  },
25809
27433
  {
25810
27434
  "$schema": "https://json-schema.org/draft/2020-12/schema",
25811
- "$id": "https://eudiplo.dev/schemas/v4/IssuanceConfigFile.schema.json",
27435
+ "$id": "https://eudiplo.dev/schemas/v5/IssuanceConfigFile.schema.json",
25812
27436
  "title": "IssuanceConfigFile",
25813
27437
  "type": "object",
25814
27438
  "properties": {
25815
27439
  "$schema": {
25816
27440
  "type": "string",
25817
- "const": "https://eudiplo.dev/schemas/v4/IssuanceConfigFile.schema.json"
27441
+ "const": "https://eudiplo.dev/schemas/v5/IssuanceConfigFile.schema.json"
25818
27442
  },
25819
27443
  "metadata": {
25820
27444
  "type": "object",
@@ -26374,8 +27998,9 @@ var CONFIG_SCHEMAS = [
26374
27998
  ]
26375
27999
  },
26376
28000
  "entityId": {
26377
- "description": "Optional local federation entity id.",
26378
- "type": "string"
28001
+ "description": "Entity Identifier of the tenant's federation entity, usually {PUBLIC_URL}/issuers/{tenantId}: an https URL with a host and without query or fragment (OpenID Federation 1.0 Section 1.2). http is accepted only when OUTBOUND_URL_ALLOW_HTTP is true.",
28002
+ "type": "string",
28003
+ "pattern": "^(https?:\\/\\/[^\\s?#]+)?$"
26379
28004
  },
26380
28005
  "enforceSigningPolicy": {
26381
28006
  "description": "Enforce strict signing policy checks.",
@@ -26410,6 +28035,80 @@ var CONFIG_SCHEMAS = [
26410
28035
  "additionalProperties": false
26411
28036
  },
26412
28037
  "description": "Federation trust anchors."
28038
+ },
28039
+ "entityTypes": {
28040
+ "description": "Roles the entity configuration publishes metadata for. Defaults to openid_credential_issuer.",
28041
+ "minItems": 1,
28042
+ "type": "array",
28043
+ "items": {
28044
+ "type": "string",
28045
+ "enum": [
28046
+ "openid_credential_issuer",
28047
+ "openid_credential_verifier"
28048
+ ]
28049
+ }
28050
+ },
28051
+ "authorityHints": {
28052
+ "description": "authority_hints of the entity configuration: the superiors that issue a subordinate statement about this entity. Defaults to the trust anchor entity ids.",
28053
+ "type": "array",
28054
+ "items": {
28055
+ "type": "string",
28056
+ "format": "uri"
28057
+ }
28058
+ },
28059
+ "entityKeyChainId": {
28060
+ "description": "Key chain with usage type 'federation' that signs the entity configuration. Without it, a federation key chain of the tenant is used; set it when the tenant has several.",
28061
+ "type": "string",
28062
+ "minLength": 1
28063
+ },
28064
+ "entityConfigurationLifetimeSeconds": {
28065
+ "description": "Lifetime (exp - iat) of the entity configuration in seconds. Defaults to 86400.",
28066
+ "type": "integer",
28067
+ "minimum": 60,
28068
+ "maximum": 31536e3
28069
+ },
28070
+ "trustMarks": {
28071
+ "description": "Trust mark JWTs issued to this entity, published in the entity configuration.",
28072
+ "type": "array",
28073
+ "items": {
28074
+ "type": "string",
28075
+ "minLength": 1
28076
+ }
28077
+ },
28078
+ "entityMetadata": {
28079
+ "description": "Informational federation_entity metadata of the entity configuration.",
28080
+ "type": "object",
28081
+ "properties": {
28082
+ "organization_name": {
28083
+ "type": "string",
28084
+ "minLength": 1
28085
+ },
28086
+ "contacts": {
28087
+ "minItems": 1,
28088
+ "type": "array",
28089
+ "items": {
28090
+ "type": "string",
28091
+ "minLength": 1
28092
+ }
28093
+ },
28094
+ "logo_uri": {
28095
+ "type": "string",
28096
+ "format": "uri"
28097
+ },
28098
+ "policy_uri": {
28099
+ "type": "string",
28100
+ "format": "uri"
28101
+ },
28102
+ "homepage_uri": {
28103
+ "type": "string",
28104
+ "format": "uri"
28105
+ }
28106
+ },
28107
+ "additionalProperties": false
28108
+ },
28109
+ "includeTrustChain": {
28110
+ "description": "Add the trust chain of this entity as trust_chain header to federation SD-JWT VCs and OID4VP request objects.",
28111
+ "type": "boolean"
26413
28112
  }
26414
28113
  },
26415
28114
  "required": [
@@ -29324,7 +31023,7 @@ function createDeploymentCommands(context, setExitCode) {
29324
31023
  // package.json
29325
31024
  var package_default = {
29326
31025
  name: "@eudiplo/cli",
29327
- version: "9.1.0-main.9e52ff4",
31026
+ version: "9.1.0-main.a601cfe",
29328
31027
  description: "Deployment-aware command line tools for EUDIPLO",
29329
31028
  private: false,
29330
31029
  type: "module",
@@ -29339,11 +31038,12 @@ var package_default = {
29339
31038
  scripts: {
29340
31039
  "assets:sync": "node scripts/sync-cli-assets.cjs",
29341
31040
  "assets:check": "node scripts/check-cli-assets.cjs",
31041
+ "build:deps": 'pnpm --silent --filter "@eudiplo/cli^..." build',
29342
31042
  build: "pnpm assets:sync && pnpm assets:check && tsc -p tsconfig.json",
29343
31043
  "build:publish": "pnpm build && esbuild src/index.ts --bundle --platform=node --format=esm --target=node22.12 --alias:jsonc-parser=jsonc-parser/lib/esm/main.js --outfile=dist/index.js",
29344
31044
  "build:sea:bundle": "pnpm assets:sync && pnpm assets:check && esbuild src/index.ts --bundle --platform=node --format=esm --target=node22.12 --alias:jsonc-parser=jsonc-parser/lib/esm/main.js --outfile=dist-sea/index.js",
29345
31045
  "build:sea": "node scripts/build-cli-sea.mjs",
29346
- dev: "tsx src/index.ts",
31046
+ dev: "pnpm -s build:deps && tsx src/index.ts",
29347
31047
  test: "vitest run --root ../.. --project cli",
29348
31048
  lint: "biome lint .",
29349
31049
  format: "biome format --write .",
@@ -29389,7 +31089,7 @@ var package_default = {
29389
31089
  esbuild: "^0.28.2",
29390
31090
  tsx: "^4.23.15",
29391
31091
  typescript: "^7.0.2",
29392
- vitest: "5.0.3"
31092
+ vitest: "5.0.4"
29393
31093
  }
29394
31094
  };
29395
31095