@eudiplo/cli 9.1.0-main.ab82b00 → 9.1.0-main.aba3274

package/dist/services/url.d.ts

@@ -0,0 +1,21 @@
+/** Throws unless `value` is an absolute HTTP(S) URL, as config loading requires. */
+export declare function validateHttpUrl(value: string, label: string): void;
+/** True when a URL carries user info such as `user:password@`. */
+export declare function hasUserInfo(value: string): boolean;
+/**
+ * Hides user info such as `user:password@` in a URL before it is printed.
+ * URLs without user info are returned exactly as configured. The masked form
+ * is built from the parsed URL, so spellings the URL parser accepts without
+ * `//`, such as `https:user:secret@host`, are masked too. A value that is not
+ * a URL is hidden entirely if it could contain user info.
+ */
+export declare function redactUrl(value: string): string;
+/** Returns the URL without user info, for handing it to another program. */
+export declare function stripUserInfo(url: URL): URL;
+/**
+ * Describes a failed request without the user info of its URL. Node's fetch
+ * repeats the full URL in some errors, for example "Request cannot be
+ * constructed from a URL that includes credentials: <url>".
+ */
+export declare function describeRequestError(error: unknown, url: URL): string;
+//# sourceMappingURL=url.d.ts.map

package/dist/services/url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url.d.ts","sourceRoot":"","sources":["../../src/services/url.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CASlE;AAED,kEAAkE;AAClE,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAOlD;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAa/C;AAED,4EAA4E;AAC5E,wBAAgB,aAAa,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,CAK3C;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,MAAM,CAGrE"}

package/dist/services/url.js

@@ -0,0 +1,61 @@
+/** Throws unless `value` is an absolute HTTP(S) URL, as config loading requires. */
+export function validateHttpUrl(value, label) {
+    try {
+        const url = new URL(value);
+        if (url.protocol !== "http:" && url.protocol !== "https:") {
+            throw new Error("Unsupported URL protocol.");
+        }
+    }
+    catch {
+        throw new Error(`${label} must be an absolute HTTP(S) URL.`);
+    }
+}
+/** True when a URL carries user info such as `user:password@`. */
+export function hasUserInfo(value) {
+    try {
+        const url = new URL(value);
+        return url.username !== "" || url.password !== "";
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Hides user info such as `user:password@` in a URL before it is printed.
+ * URLs without user info are returned exactly as configured. The masked form
+ * is built from the parsed URL, so spellings the URL parser accepts without
+ * `//`, such as `https:user:secret@host`, are masked too. A value that is not
+ * a URL is hidden entirely if it could contain user info.
+ */
+export function redactUrl(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        return value.includes("@") ? "***" : value;
+    }
+    if (url.username === "" && url.password === "") {
+        return value;
+    }
+    url.username = "***";
+    url.password = "";
+    return url.href;
+}
+/** Returns the URL without user info, for handing it to another program. */
+export function stripUserInfo(url) {
+    const stripped = new URL(url.href);
+    stripped.username = "";
+    stripped.password = "";
+    return stripped;
+}
+/**
+ * Describes a failed request without the user info of its URL. Node's fetch
+ * repeats the full URL in some errors, for example "Request cannot be
+ * constructed from a URL that includes credentials: <url>".
+ */
+export function describeRequestError(error, url) {
+    const message = error instanceof Error ? error.message : String(error);
+    return message.replaceAll(url.href, redactUrl(url.href));
+}
+//# sourceMappingURL=url.js.map

package/dist/services/url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url.js","sourceRoot":"","sources":["../../src/services/url.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,KAAa;IACxD,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACjD,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACL,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,mCAAmC,CAAC,CAAC;IACjE,CAAC;AACL,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,WAAW,CAAC,KAAa;IACrC,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACnC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACD,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IAC/C,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC7C,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,GAAG,CAAC,QAAQ,GAAG,KAAK,CAAC;IACrB,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC;IAClB,OAAO,GAAG,CAAC,IAAI,CAAC;AACpB,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,aAAa,CAAC,GAAQ;IAClC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnC,QAAQ,CAAC,QAAQ,GAAG,EAAE,CAAC;IACvB,QAAQ,CAAC,QAAQ,GAAG,EAAE,CAAC;IACvB,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAc,EAAE,GAAQ;IACzD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC7D,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@eudiplo/cli",
-    "version": "9.1.0-main.ab82b00",
+    "version": "9.1.0-main.aba3274",
     "description": "Deployment-aware command line tools for EUDIPLO",
     "private": false,
     "type": "module",

package/templates/demo-config/clients/presentation-test.json

@@ -1,5 +1,5 @@
 {
-  "$schema": "https://eudiplo.dev/schemas/v1/ClientConfigFile.schema.json",
+  "$schema": "https://eudiplo.dev/schemas/v2/ClientConfigFile.schema.json",
   "metadata": {
     "generation": 1
   },

package/templates/demo-config/clients/test.json

@@ -1,5 +1,5 @@
 {
-  "$schema": "https://eudiplo.dev/schemas/v1/ClientConfigFile.schema.json",
+  "$schema": "https://eudiplo.dev/schemas/v2/ClientConfigFile.schema.json",
   "metadata": {
     "generation": 1
   },
@@ -12,7 +12,12 @@
       "issuance:offer",
       "issuance:manage",
       "presentation:request",
-      "presentation:manage"
+      "presentation:manage",
+      "registrar:manage",
+      "sessions:read",
+      "credentials:status",
+      "audit:read",
+      "keys:manage"
     ]
   }
 }

package/templates/demo-config/key-chains/attestation.json

@@ -21,7 +21,8 @@
     "kmsProvider": "db",
     "rotationPolicy": {
       "certValidityDays": 30,
-      "enabled": true
+      "enabled": true,
+      "intervalDays": 20
     }
   }
 }

package/templates/demo-config/key-chains/status-list.json

@@ -21,7 +21,8 @@
     "kmsProvider": "db",
     "rotationPolicy": {
       "certValidityDays": 30,
-      "enabled": true
+      "enabled": true,
+      "intervalDays": 20
     }
   }
 }

package/templates/demo-config/presentation/age-over-18.json

@@ -23,6 +23,16 @@
                 "18"
               ]
             }
+          ],
+          "trusted_authorities": [
+            {
+              "type": "etsi_tl",
+              "values": [
+                {
+                  "trustListId": "580831bc-ef11-43f4-a3be-a2b6bf1b29a3"
+                }
+              ]
+            }
           ]
         },
         {

package/templates/docker-compose.yml

@@ -89,7 +89,7 @@ services:
       - eudiplo-network
 
   rustfs:
-    image: rustfs/rustfs:1.0.0
+    image: rustfs/rustfs:1.0.1
     restart: always
     profiles: ['s3', 'standard', 'full']
     ports:
@@ -114,7 +114,7 @@ services:
 
   # S3 bucket initialization using the AWS CLI
   rustfs-init:
-    image: amazon/aws-cli:2.37.4
+    image: amazon/aws-cli:2.37.10
     profiles: ['s3', 'standard', 'full']
     depends_on:
       rustfs:

package/templates/schemas/ClientConfigFile.schema.json

@@ -9,7 +9,7 @@
       "properties": {
         "$schema": {
           "type": "string",
-          "const": "https://eudiplo.dev/schemas/v1/ClientConfigFile.schema.json"
+          "const": "https://eudiplo.dev/schemas/v2/ClientConfigFile.schema.json"
         },
         "metadata": {
           "type": "object",
@@ -55,6 +55,139 @@
         "spec"
       ],
       "additionalProperties": false
+    },
+    {
+      "$schema": "https://json-schema.org/draft/2020-12/schema",
+      "$id": "https://eudiplo.dev/schemas/v1/ClientConfigFile.schema.json",
+      "title": "ClientConfigFile",
+      "type": "object",
+      "properties": {
+        "$schema": {
+          "type": "string",
+          "const": "https://eudiplo.dev/schemas/v1/ClientConfigFile.schema.json"
+        },
+        "metadata": {
+          "type": "object",
+          "properties": {
+            "generation": {
+              "type": "integer",
+              "minimum": 1,
+              "description": "Monotonically increasing configuration generation."
+            },
+            "ownership": {
+              "type": "string",
+              "enum": [
+                "unmanaged",
+                "file-managed"
+              ],
+              "description": "Requested ownership recorded when the document is applied."
+            }
+          },
+          "additionalProperties": false
+        },
+        "spec": {
+          "allOf": [
+            {
+              "$ref": "#/$defs/CreateClientDto"
+            },
+            {
+              "type": "object",
+              "required": [
+                "clientId"
+              ],
+              "properties": {
+                "clientId": {
+                  "type": "string",
+                  "minLength": 1
+                }
+              }
+            }
+          ]
+        }
+      },
+      "required": [
+        "$schema",
+        "spec"
+      ],
+      "additionalProperties": false,
+      "$defs": {
+        "CreateClientDto": {
+          "type": "object",
+          "properties": {
+            "clientId": {
+              "type": "string",
+              "minLength": 1,
+              "pattern": "^[A-Za-z0-9._:-]+$",
+              "description": "Unique client identifier."
+            },
+            "secret": {
+              "description": "Optional client secret for confidential clients.",
+              "type": "string",
+              "minLength": 1
+            },
+            "description": {
+              "description": "Optional human-readable client description.",
+              "type": "string",
+              "minLength": 1
+            },
+            "roles": {
+              "minItems": 1,
+              "type": "array",
+              "items": {
+                "type": "string",
+                "enum": [
+                  "presentation:manage",
+                  "presentation:request",
+                  "issuance:manage",
+                  "issuance:offer",
+                  "clients:manage",
+                  "users:manage",
+                  "tenants:manage",
+                  "tenant:admin",
+                  "registrar:manage"
+                ]
+              },
+              "description": "Roles assigned to the client. At least one role is required."
+            },
+            "allowedPresentationConfigs": {
+              "description": "Optional allow-list of presentation config ids this client can use.",
+              "anyOf": [
+                {
+                  "type": "array",
+                  "items": {
+                    "type": "string",
+                    "minLength": 1
+                  }
+                },
+                {
+                  "type": "null"
+                }
+              ]
+            },
+            "allowedIssuanceConfigs": {
+              "description": "Optional allow-list of issuance config ids this client can use.",
+              "anyOf": [
+                {
+                  "type": "array",
+                  "items": {
+                    "type": "string",
+                    "minLength": 1
+                  }
+                },
+                {
+                  "type": "null"
+                }
+              ]
+            }
+          },
+          "required": [
+            "clientId",
+            "roles"
+          ],
+          "additionalProperties": false,
+          "title": "CreateClientDto"
+        }
+      }
     }
   ]
 }

package/templates/schemas/CreateClientDto.schema.json

@@ -32,7 +32,11 @@
           "users:manage",
           "tenants:manage",
           "tenant:admin",
-          "registrar:manage"
+          "registrar:manage",
+          "audit:read",
+          "sessions:read",
+          "credentials:status",
+          "keys:manage"
         ]
       },
       "description": "Roles assigned to the client. At least one role is required."

package/templates/schemas/CreateTenantDto.schema.json

@@ -19,7 +19,7 @@
       "minLength": 1
     },
     "roles": {
-      "description": "Optional default role assignments for the tenant.",
+      "description": "Roles of the tenant's admin client `<id>-admin`, which also gets clients:manage. They are all that client can grant, unless they include tenant:admin. Without roles, no admin client is created.",
       "type": "array",
       "items": {
         "type": "string",
@@ -32,7 +32,11 @@
           "clients:manage",
           "users:manage",
           "registrar:manage",
-          "tenant:admin"
+          "tenant:admin",
+          "audit:read",
+          "sessions:read",
+          "credentials:status",
+          "keys:manage"
         ]
       }
     },

package/templates/schemas/CredentialConfigCreate.schema.json

@@ -209,7 +209,7 @@
       ]
     },
     "webhookEndpointId": {
-      "description": "Optional webhook endpoint id notified during issuance events.",
+      "description": "Not used for notifications: they go to the webhook endpoint of the offer.",
       "type": [
         "string",
         "null"
@@ -303,7 +303,7 @@
       ]
     },
     "iaeActions": {
-      "description": "Optional in-app experience actions for wallet flows.",
+      "description": "Interactive authorization steps (a presentation or a web flow) that the wallet completes, in order, before the credential is issued.",
       "anyOf": [
         {
           "type": "array",
@@ -479,16 +479,17 @@
                     "type": "string"
                   },
                   "frameworkType": {
-                    "description": "Trust framework type.",
+                    "description": "Trust framework type. `x509` takes a root certificate in `value` and no `verificationMethod`.",
                     "type": "string",
                     "enum": [
                       "aki",
                       "etsi_tl",
-                      "openid_federation"
+                      "openid_federation",
+                      "x509"
                     ]
                   },
                   "value": {
-                    "description": "Framework-specific authority value.",
+                    "description": "Framework-specific authority value, for example the trust list URL for `etsi_tl` or the root certificate (base64 DER or PEM) for `x509`.",
                     "type": "string"
                   },
                   "verificationMethod": {