@eudiplo/cli 9.1.0-main.ab82b00 → 9.1.0-main.b3aa53d

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (24) hide show
  1. package/dist/commands/config/portability/upgrade.d.ts.map +1 -1
  2. package/dist/commands/config/portability/upgrade.js +6 -2
  3. package/dist/commands/config/portability/upgrade.js.map +1 -1
  4. package/dist/index.js +1861 -526
  5. package/dist/services/diagnostics.js +1 -1
  6. package/dist/services/diagnostics.js.map +1 -1
  7. package/package.json +1 -1
  8. package/templates/demo-config/clients/presentation-test.json +1 -1
  9. package/templates/demo-config/clients/test.json +7 -2
  10. package/templates/demo-config/key-chains/attestation.json +2 -1
  11. package/templates/demo-config/key-chains/status-list.json +2 -1
  12. package/templates/demo-config/presentation/age-over-18.json +10 -0
  13. package/templates/schemas/ClientConfigFile.schema.json +134 -1
  14. package/templates/schemas/CreateClientDto.schema.json +5 -1
  15. package/templates/schemas/CreateTenantDto.schema.json +6 -2
  16. package/templates/schemas/CredentialConfigCreate.schema.json +6 -5
  17. package/templates/schemas/CredentialConfigFile.schema.json +796 -1
  18. package/templates/schemas/KeyChainConfigFile.schema.json +136 -119
  19. package/templates/schemas/KeyChainCreateDto.schema.json +1 -1
  20. package/templates/schemas/KeyChainImportDto.schema.json +8 -0
  21. package/templates/schemas/RotationPolicyCreateDto.schema.json +1 -1
  22. package/templates/schemas/TenantConfigFile.schema.json +4 -129
  23. package/templates/schemas/UpdateClientDto.schema.json +5 -1
  24. package/templates/schemas/UpdateStatusListConfigDto.schema.json +5 -5
package/dist/index.js CHANGED
@@ -14898,9 +14898,9 @@ function unzipSync(data, opts) {
14898
14898
  // ../../packages/eudiplo-config-format/dist/config-format.js
14899
14899
  var CONFIG_FORMATS = {
14900
14900
  Tenant: { slug: "tenant", file: "TenantConfigFile", version: 1 },
14901
- Client: { slug: "client", file: "ClientConfigFile", version: 1 },
14901
+ Client: { slug: "client", file: "ClientConfigFile", version: 2 },
14902
14902
  KmsConfig: { slug: "kms-config", file: "KmsConfigFile", version: 1 },
14903
- KeyChain: { slug: "key-chain", file: "KeyChainConfigFile", version: 1 },
14903
+ KeyChain: { slug: "key-chain", file: "KeyChainConfigFile", version: 2 },
14904
14904
  RegistrarConfig: {
14905
14905
  slug: "registrar-config",
14906
14906
  file: "RegistrarConfigFile",
@@ -14914,7 +14914,7 @@ var CONFIG_FORMATS = {
14914
14914
  CredentialConfig: {
14915
14915
  slug: "credential-config",
14916
14916
  file: "CredentialConfigFile",
14917
- version: 1
14917
+ version: 2
14918
14918
  },
14919
14919
  PresentationConfig: {
14920
14920
  slug: "presentation-config",
@@ -14958,6 +14958,9 @@ function resourceId(input) {
14958
14958
  throw new Error(`Configuration spec.${field} is required`);
14959
14959
  return id;
14960
14960
  }
14961
+ function bareFileVersion(kind, spec) {
14962
+ return kind === "KeyChain" && "type" in spec ? 2 : 1;
14963
+ }
14961
14964
  var presentationConfigV1ToV2 = {
14962
14965
  id: "presentation-config-v2-provides-attestations",
14963
14966
  kind: "PresentationConfig",
@@ -15001,6 +15004,34 @@ var CONFIG_MIGRATIONS = [
15001
15004
  // list references: a v2 spec is a valid v3 spec.
15002
15005
  migrate: (spec) => ({ spec })
15003
15006
  },
15007
+ {
15008
+ id: "client-v2-read-and-status-roles",
15009
+ kind: "Client",
15010
+ from: 1,
15011
+ to: 2,
15012
+ // v2 only adds the roles audit:read, sessions:read, credentials:status
15013
+ // and keys:manage: a v1 spec is a valid v2 spec.
15014
+ migrate: (spec) => ({ spec })
15015
+ },
15016
+ {
15017
+ id: "key-chain-v2-type",
15018
+ kind: "KeyChain",
15019
+ from: 1,
15020
+ to: 2,
15021
+ // v2 only adds the optional key chain `type`: a v1 spec is a valid v2
15022
+ // spec, imported as before.
15023
+ migrate: (spec) => ({ spec })
15024
+ },
15025
+ {
15026
+ id: "credential-config-v2-x509-trusted-authority",
15027
+ kind: "CredentialConfig",
15028
+ from: 1,
15029
+ to: 2,
15030
+ // v2 only adds the frameworkType `x509` to schemaMeta trusted
15031
+ // authorities, which schema metadata publishing already writes: a v1
15032
+ // spec is a valid v2 spec.
15033
+ migrate: (spec) => ({ spec })
15034
+ },
15004
15035
  presentationConfigV1ToV2,
15005
15036
  {
15006
15037
  id: "presentation-config-v3-typed-claim-values",
@@ -20081,13 +20112,13 @@ var CONFIG_SCHEMAS = [
20081
20112
  },
20082
20113
  {
20083
20114
  "$schema": "https://json-schema.org/draft/2020-12/schema",
20084
- "$id": "https://eudiplo.dev/schemas/v2/IssuanceConfigFile.schema.json",
20085
- "title": "IssuanceConfigFile",
20115
+ "$id": "https://eudiplo.dev/schemas/v2/ClientConfigFile.schema.json",
20116
+ "title": "ClientConfigFile",
20086
20117
  "type": "object",
20087
20118
  "properties": {
20088
20119
  "$schema": {
20089
20120
  "type": "string",
20090
- "const": "https://eudiplo.dev/schemas/v2/IssuanceConfigFile.schema.json"
20121
+ "const": "https://eudiplo.dev/schemas/v2/ClientConfigFile.schema.json"
20091
20122
  },
20092
20123
  "metadata": {
20093
20124
  "type": "object",
@@ -20109,7 +20140,23 @@ var CONFIG_SCHEMAS = [
20109
20140
  "additionalProperties": false
20110
20141
  },
20111
20142
  "spec": {
20112
- "$ref": "#/$defs/IssuanceConfig"
20143
+ "allOf": [
20144
+ {
20145
+ "$ref": "#/$defs/CreateClientDto"
20146
+ },
20147
+ {
20148
+ "type": "object",
20149
+ "required": [
20150
+ "clientId"
20151
+ ],
20152
+ "properties": {
20153
+ "clientId": {
20154
+ "type": "string",
20155
+ "minLength": 1
20156
+ }
20157
+ }
20158
+ }
20159
+ ]
20113
20160
  }
20114
20161
  },
20115
20162
  "required": [
@@ -20118,641 +20165,1925 @@ var CONFIG_SCHEMAS = [
20118
20165
  ],
20119
20166
  "additionalProperties": false,
20120
20167
  "$defs": {
20121
- "IssuanceConfig": {
20168
+ "CreateClientDto": {
20122
20169
  "type": "object",
20123
20170
  "properties": {
20124
- "batchSize": {
20125
- "description": "Optional issuance batch size.",
20126
- "type": "integer",
20127
- "minimum": 1,
20128
- "maximum": 9007199254740991
20171
+ "clientId": {
20172
+ "type": "string",
20173
+ "minLength": 1,
20174
+ "pattern": "^[A-Za-z0-9._:-]+$",
20175
+ "description": "Unique client identifier."
20129
20176
  },
20130
- "dPopRequired": {
20131
- "description": "Require DPoP proofs for issuance endpoints.",
20132
- "type": "boolean"
20177
+ "secret": {
20178
+ "description": "Optional client secret for confidential clients.",
20179
+ "type": "string",
20180
+ "minLength": 1
20133
20181
  },
20134
- "walletAttestationRequired": {
20135
- "description": "Default wallet attestation requirement for managed authorization servers.",
20136
- "type": "boolean"
20182
+ "description": {
20183
+ "description": "Optional human-readable client description.",
20184
+ "type": "string",
20185
+ "minLength": 1
20137
20186
  },
20138
- "walletProviderTrustLists": {
20139
- "description": "Shared wallet provider trust lists for key attestations and default authorization server wallet authentication.",
20187
+ "roles": {
20188
+ "minItems": 1,
20140
20189
  "type": "array",
20141
20190
  "items": {
20142
- "type": "object",
20143
- "properties": {
20144
- "trustListId": {
20191
+ "type": "string",
20192
+ "enum": [
20193
+ "presentation:manage",
20194
+ "presentation:request",
20195
+ "issuance:manage",
20196
+ "issuance:offer",
20197
+ "clients:manage",
20198
+ "users:manage",
20199
+ "tenants:manage",
20200
+ "tenant:admin",
20201
+ "registrar:manage",
20202
+ "audit:read",
20203
+ "sessions:read",
20204
+ "credentials:status",
20205
+ "keys:manage"
20206
+ ]
20207
+ },
20208
+ "description": "Roles assigned to the client. At least one role is required."
20209
+ },
20210
+ "allowedPresentationConfigs": {
20211
+ "description": "Optional allow-list of presentation config ids this client can use.",
20212
+ "anyOf": [
20213
+ {
20214
+ "type": "array",
20215
+ "items": {
20145
20216
  "type": "string",
20146
20217
  "minLength": 1
20147
- },
20148
- "url": {
20149
- "description": "URL of the wallet provider trust list.",
20218
+ }
20219
+ },
20220
+ {
20221
+ "type": "null"
20222
+ }
20223
+ ]
20224
+ },
20225
+ "allowedIssuanceConfigs": {
20226
+ "description": "Optional allow-list of issuance config ids this client can use.",
20227
+ "anyOf": [
20228
+ {
20229
+ "type": "array",
20230
+ "items": {
20150
20231
  "type": "string",
20151
- "format": "uri"
20152
- },
20153
- "verifierKey": {
20154
- "description": "Optional verifier key material used for trust list verification.",
20155
- "type": "object",
20156
- "propertyNames": {
20157
- "type": "string"
20158
- },
20159
- "additionalProperties": {}
20160
- },
20161
- "verifierX509Der": {
20162
- "description": "Optional verifier certificate in DER/base64 form.",
20163
- "type": "string"
20232
+ "minLength": 1
20164
20233
  }
20165
20234
  },
20166
- "additionalProperties": false
20167
- }
20235
+ {
20236
+ "type": "null"
20237
+ }
20238
+ ]
20239
+ }
20240
+ },
20241
+ "required": [
20242
+ "clientId",
20243
+ "roles"
20244
+ ],
20245
+ "additionalProperties": false,
20246
+ "title": "CreateClientDto"
20247
+ }
20248
+ }
20249
+ },
20250
+ {
20251
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
20252
+ "$id": "https://eudiplo.dev/schemas/v2/CredentialConfigFile.schema.json",
20253
+ "title": "CredentialConfigFile",
20254
+ "type": "object",
20255
+ "properties": {
20256
+ "$schema": {
20257
+ "type": "string",
20258
+ "const": "https://eudiplo.dev/schemas/v2/CredentialConfigFile.schema.json"
20259
+ },
20260
+ "metadata": {
20261
+ "type": "object",
20262
+ "properties": {
20263
+ "generation": {
20264
+ "type": "integer",
20265
+ "minimum": 1,
20266
+ "description": "Monotonically increasing configuration generation."
20168
20267
  },
20169
- "signingKeyId": {
20170
- "description": "Default signing key chain id for credential issuance.",
20268
+ "ownership": {
20171
20269
  "type": "string",
20172
- "minLength": 1
20270
+ "enum": [
20271
+ "unmanaged",
20272
+ "file-managed"
20273
+ ],
20274
+ "description": "Requested ownership recorded when the document is applied."
20275
+ }
20276
+ },
20277
+ "additionalProperties": false
20278
+ },
20279
+ "spec": {
20280
+ "allOf": [
20281
+ {
20282
+ "$ref": "#/$defs/CredentialConfigCreate"
20173
20283
  },
20174
- "authorizationServers": {
20175
- "minItems": 1,
20176
- "type": "array",
20177
- "items": {
20178
- "oneOf": [
20179
- {
20284
+ {
20285
+ "type": "object",
20286
+ "required": [
20287
+ "id"
20288
+ ],
20289
+ "properties": {
20290
+ "id": {
20291
+ "type": "string",
20292
+ "minLength": 1
20293
+ }
20294
+ }
20295
+ }
20296
+ ]
20297
+ }
20298
+ },
20299
+ "required": [
20300
+ "$schema",
20301
+ "spec"
20302
+ ],
20303
+ "additionalProperties": false,
20304
+ "$defs": {
20305
+ "CredentialConfigCreate": {
20306
+ "type": "object",
20307
+ "properties": {
20308
+ "id": {
20309
+ "type": "string",
20310
+ "minLength": 1,
20311
+ "description": "Credential configuration identifier."
20312
+ },
20313
+ "description": {
20314
+ "description": "Optional description for operators and tooling.",
20315
+ "type": [
20316
+ "string",
20317
+ "null"
20318
+ ]
20319
+ },
20320
+ "config": {
20321
+ "type": "object",
20322
+ "properties": {
20323
+ "format": {
20324
+ "type": "string",
20325
+ "enum": [
20326
+ "mso_mdoc",
20327
+ "dc+sd-jwt"
20328
+ ],
20329
+ "description": "Credential format emitted by this configuration."
20330
+ },
20331
+ "display": {
20332
+ "type": "array",
20333
+ "items": {
20180
20334
  "type": "object",
20181
20335
  "properties": {
20182
- "type": {
20336
+ "locale": {
20183
20337
  "type": "string",
20184
- "const": "external",
20185
- "description": "Use an externally managed authorization server."
20338
+ "minLength": 1,
20339
+ "description": "Locale tag for the display entry."
20186
20340
  },
20187
- "id": {
20341
+ "name": {
20188
20342
  "type": "string",
20189
20343
  "minLength": 1,
20190
- "description": "Authorization server identifier."
20344
+ "description": "Human-readable field name."
20191
20345
  },
20192
- "issuer": {
20193
- "type": "string",
20194
- "format": "uri",
20195
- "description": "Issuer URL for the external authorization server."
20346
+ "description": {
20347
+ "description": "Optional field description for this locale.",
20348
+ "type": "string"
20196
20349
  },
20197
- "sessionBinding": {
20198
- "description": "Explicit mapping from an external access-token claim to an existing issuance session.",
20350
+ "background_color": {
20351
+ "description": "Optional background color for card-style rendering.",
20352
+ "type": "string"
20353
+ },
20354
+ "text_color": {
20355
+ "description": "Optional text color for card-style rendering.",
20356
+ "type": "string"
20357
+ },
20358
+ "background_image": {
20359
+ "description": "Optional background image.",
20199
20360
  "type": "object",
20200
20361
  "properties": {
20201
- "method": {
20202
- "type": "string",
20203
- "const": "access_token_claim",
20204
- "description": "Read the correlation value from a configured access-token claim."
20205
- },
20206
- "claim": {
20362
+ "uri": {
20207
20363
  "type": "string",
20208
20364
  "minLength": 1,
20209
- "description": "Claim name that contains the issuance-session correlation value."
20365
+ "description": "Image URI."
20210
20366
  }
20211
20367
  },
20212
20368
  "required": [
20213
- "method",
20214
- "claim"
20369
+ "uri"
20215
20370
  ],
20216
20371
  "additionalProperties": false
20217
20372
  },
20218
- "label": {
20219
- "description": "Optional display label for UI selection.",
20220
- "type": "string"
20221
- },
20222
- "enabled": {
20223
- "description": "Whether this authorization server entry is enabled.",
20224
- "type": "boolean"
20225
- }
20226
- },
20227
- "required": [
20228
- "type",
20229
- "id",
20230
- "issuer"
20231
- ],
20232
- "additionalProperties": false
20233
- },
20234
- {
20235
- "type": "object",
20236
- "properties": {
20237
- "type": {
20238
- "type": "string",
20239
- "const": "oid4vp",
20240
- "description": "Use OID4VP-based authorization server chaining."
20241
- },
20242
- "id": {
20243
- "type": "string",
20244
- "minLength": 1,
20245
- "description": "Authorization server identifier."
20246
- },
20247
- "presentationConfigId": {
20248
- "type": "string",
20249
- "minLength": 1,
20250
- "description": "Presentation configuration id used during authorization."
20251
- },
20252
- "immediateWalletRedirect": {
20253
- "description": "Redirect wallets immediately after authorization response creation.",
20254
- "type": "boolean"
20255
- },
20256
- "token": {
20257
- "description": "Optional token issuance settings.",
20373
+ "logo": {
20374
+ "description": "Optional logo image.",
20258
20375
  "type": "object",
20259
20376
  "properties": {
20260
- "lifetimeSeconds": {
20261
- "description": "Access token lifetime in seconds.",
20262
- "type": "number",
20263
- "minimum": 60
20264
- },
20265
- "signingKeyId": {
20266
- "description": "Optional key chain id used to sign issued tokens.",
20377
+ "uri": {
20267
20378
  "type": "string",
20268
- "minLength": 1
20269
- },
20270
- "refreshTokenEnabled": {
20271
- "description": "Enable issuing refresh tokens.",
20272
- "type": "boolean"
20273
- },
20274
- "refreshTokenExpiresInSeconds": {
20275
- "description": "Refresh token lifetime in seconds.",
20276
- "type": "number",
20277
- "minimum": 60
20379
+ "minLength": 1,
20380
+ "description": "Image URI."
20278
20381
  }
20279
20382
  },
20383
+ "required": [
20384
+ "uri"
20385
+ ],
20280
20386
  "additionalProperties": false
20281
- },
20282
- "requireDPoP": {
20283
- "description": "Require DPoP proofs for token/credential requests.",
20284
- "type": "boolean"
20285
- },
20286
- "walletAttestationRequired": {
20287
- "description": "Require wallet attestation for this authorization server.",
20288
- "type": "boolean"
20289
- },
20290
- "walletProviderTrustLists": {
20291
- "description": "Optional wallet provider trust list references for this authorization server.",
20292
- "type": "array",
20293
- "items": {
20294
- "type": "object",
20295
- "properties": {
20296
- "trustListId": {
20297
- "type": "string",
20298
- "minLength": 1
20299
- },
20300
- "url": {
20301
- "description": "URL of the wallet provider trust list.",
20302
- "type": "string",
20303
- "format": "uri"
20304
- },
20305
- "verifierKey": {
20306
- "description": "Optional verifier key material used for trust list verification.",
20307
- "type": "object",
20308
- "propertyNames": {
20309
- "type": "string"
20310
- },
20311
- "additionalProperties": {}
20312
- },
20313
- "verifierX509Der": {
20314
- "description": "Optional verifier certificate in DER/base64 form.",
20315
- "type": "string"
20316
- }
20317
- },
20318
- "additionalProperties": false
20319
- }
20320
- },
20321
- "label": {
20322
- "description": "Optional display label for UI selection.",
20323
- "type": "string"
20324
- },
20325
- "enabled": {
20326
- "description": "Whether this authorization server entry is enabled.",
20327
- "type": "boolean"
20328
20387
  }
20329
20388
  },
20330
20389
  "required": [
20331
- "type",
20332
- "id",
20333
- "presentationConfigId"
20390
+ "locale",
20391
+ "name"
20334
20392
  ],
20335
20393
  "additionalProperties": false
20336
20394
  },
20337
- {
20338
- "type": "object",
20339
- "properties": {
20340
- "type": {
20341
- "type": "string",
20342
- "const": "chained",
20343
- "description": "Use upstream OIDC as authorization source."
20344
- },
20345
- "id": {
20346
- "type": "string",
20347
- "minLength": 1,
20348
- "description": "Authorization server identifier."
20349
- },
20350
- "upstream": {
20395
+ "description": "Display metadata shown by wallets."
20396
+ },
20397
+ "scope": {
20398
+ "description": "Optional OAuth scope associated with this credential type.",
20399
+ "type": "string"
20400
+ },
20401
+ "docType": {
20402
+ "description": "Optional mDoc document type.",
20403
+ "type": "string"
20404
+ },
20405
+ "keyAttestationsRequired": {
20406
+ "description": "Optional key attestation requirements.",
20407
+ "type": "object",
20408
+ "properties": {
20409
+ "key_storage": {
20410
+ "description": "Required key storage attestations.",
20411
+ "type": "array",
20412
+ "items": {
20413
+ "type": "string"
20414
+ }
20415
+ },
20416
+ "user_authentication": {
20417
+ "description": "Required user authentication attestations.",
20418
+ "type": "array",
20419
+ "items": {
20420
+ "type": "string"
20421
+ }
20422
+ }
20423
+ },
20424
+ "additionalProperties": false
20425
+ },
20426
+ "proofTypesSupported": {
20427
+ "description": "Supported proof types for issuance requests.",
20428
+ "type": "array",
20429
+ "items": {
20430
+ "type": "string",
20431
+ "enum": [
20432
+ "jwt",
20433
+ "attestation"
20434
+ ]
20435
+ }
20436
+ },
20437
+ "credentialReusePolicy": {
20438
+ "description": "Optional PID/EAA reuse policy published in credential metadata.",
20439
+ "type": "object",
20440
+ "properties": {
20441
+ "id": {
20442
+ "type": "string",
20443
+ "minLength": 1
20444
+ },
20445
+ "options": {
20446
+ "type": "array",
20447
+ "items": {
20351
20448
  "type": "object",
20352
20449
  "properties": {
20353
- "issuer": {
20354
- "type": "string",
20355
- "format": "uri",
20356
- "description": "Upstream OIDC issuer URL."
20357
- },
20358
- "clientId": {
20359
- "type": "string",
20360
- "minLength": 1,
20361
- "description": "Client id for upstream OIDC authentication."
20362
- },
20363
- "clientSecret": {
20364
- "description": "Optional client secret for upstream OIDC authentication.",
20365
- "type": "string",
20366
- "minLength": 1
20367
- },
20368
- "scopes": {
20369
- "description": "Optional scopes requested from the upstream issuer.",
20450
+ "details": {
20451
+ "minItems": 1,
20370
20452
  "type": "array",
20371
20453
  "items": {
20372
20454
  "type": "string",
20373
- "minLength": 1
20455
+ "enum": [
20456
+ "once_only",
20457
+ "limited_time",
20458
+ "limited-time",
20459
+ "rotating-batch",
20460
+ "per-relying-party"
20461
+ ]
20374
20462
  }
20463
+ },
20464
+ "batch_size": {
20465
+ "type": "integer",
20466
+ "minimum": 2,
20467
+ "maximum": 9007199254740991
20468
+ },
20469
+ "reissue_trigger_unused": {
20470
+ "type": "integer",
20471
+ "minimum": 0,
20472
+ "maximum": 9007199254740991
20473
+ },
20474
+ "reissue_trigger_lifetime_left": {
20475
+ "type": "integer",
20476
+ "minimum": 0,
20477
+ "maximum": 9007199254740991
20375
20478
  }
20376
20479
  },
20377
20480
  "required": [
20378
- "issuer",
20379
- "clientId"
20481
+ "details"
20380
20482
  ],
20381
- "additionalProperties": false,
20382
- "description": "Upstream OIDC connection settings."
20383
- },
20384
- "token": {
20385
- "description": "Optional token issuance settings.",
20386
- "type": "object",
20387
- "properties": {
20388
- "lifetimeSeconds": {
20389
- "description": "Access token lifetime in seconds.",
20390
- "type": "number",
20391
- "minimum": 60
20392
- },
20393
- "signingKeyId": {
20394
- "description": "Optional key chain id used to sign issued tokens.",
20395
- "type": "string",
20396
- "minLength": 1
20397
- },
20398
- "refreshTokenEnabled": {
20399
- "description": "Enable issuing refresh tokens.",
20400
- "type": "boolean"
20401
- },
20402
- "refreshTokenExpiresInSeconds": {
20403
- "description": "Refresh token lifetime in seconds.",
20404
- "type": "number",
20405
- "minimum": 60
20406
- }
20407
- },
20408
20483
  "additionalProperties": false
20409
- },
20410
- "requireDPoP": {
20411
- "description": "Require DPoP proofs for token/credential requests.",
20412
- "type": "boolean"
20413
- },
20414
- "walletAttestationRequired": {
20415
- "description": "Require wallet attestation for this authorization server.",
20416
- "type": "boolean"
20417
- },
20418
- "walletProviderTrustLists": {
20419
- "description": "Optional wallet provider trust list references for this authorization server.",
20420
- "type": "array",
20421
- "items": {
20422
- "type": "object",
20423
- "properties": {
20424
- "trustListId": {
20425
- "type": "string",
20426
- "minLength": 1
20427
- },
20428
- "url": {
20429
- "description": "URL of the wallet provider trust list.",
20430
- "type": "string",
20431
- "format": "uri"
20432
- },
20433
- "verifierKey": {
20434
- "description": "Optional verifier key material used for trust list verification.",
20435
- "type": "object",
20436
- "propertyNames": {
20437
- "type": "string"
20438
- },
20439
- "additionalProperties": {}
20440
- },
20441
- "verifierX509Der": {
20442
- "description": "Optional verifier certificate in DER/base64 form.",
20443
- "type": "string"
20444
- }
20445
- },
20446
- "additionalProperties": false
20447
- }
20448
- },
20449
- "label": {
20450
- "description": "Optional display label for UI selection.",
20451
- "type": "string"
20452
- },
20453
- "enabled": {
20454
- "description": "Whether this authorization server entry is enabled.",
20455
- "type": "boolean"
20456
20484
  }
20485
+ }
20486
+ },
20487
+ "required": [
20488
+ "id"
20489
+ ],
20490
+ "additionalProperties": false
20491
+ }
20492
+ },
20493
+ "required": [
20494
+ "format",
20495
+ "display"
20496
+ ],
20497
+ "additionalProperties": false,
20498
+ "description": "Issuer metadata-facing credential configuration."
20499
+ },
20500
+ "fields": {
20501
+ "type": "array",
20502
+ "items": {
20503
+ "$ref": "#/$defs/CredentialConfigCreate/$defs/__schema0"
20504
+ },
20505
+ "description": "Claim field definitions for credential issuance."
20506
+ },
20507
+ "attributeProviderId": {
20508
+ "description": "Optional attribute provider id used to resolve claim values.",
20509
+ "type": [
20510
+ "string",
20511
+ "null"
20512
+ ]
20513
+ },
20514
+ "webhookEndpointId": {
20515
+ "description": "Not used for notifications: they go to the webhook endpoint of the offer.",
20516
+ "type": [
20517
+ "string",
20518
+ "null"
20519
+ ]
20520
+ },
20521
+ "vct": {
20522
+ "description": "Optional VCT value or structured VCT metadata.",
20523
+ "anyOf": [
20524
+ {
20525
+ "type": "string"
20526
+ },
20527
+ {
20528
+ "type": "object",
20529
+ "properties": {
20530
+ "vct": {
20531
+ "description": "VCT identifier.",
20532
+ "type": "string"
20457
20533
  },
20458
- "required": [
20459
- "type",
20460
- "id",
20461
- "upstream"
20462
- ],
20463
- "additionalProperties": false
20534
+ "name": {
20535
+ "description": "Human-readable VCT name.",
20536
+ "type": "string"
20537
+ },
20538
+ "description": {
20539
+ "description": "Optional VCT description.",
20540
+ "type": "string"
20541
+ },
20542
+ "extends": {
20543
+ "description": "Optional base VCT reference.",
20544
+ "type": "string"
20545
+ },
20546
+ "extends#integrity": {
20547
+ "description": "Integrity hash for the extends reference.",
20548
+ "type": "string"
20549
+ },
20550
+ "schema_uri": {
20551
+ "description": "Optional schema URI for the VCT.",
20552
+ "type": "string"
20553
+ },
20554
+ "schema_uri#integrity": {
20555
+ "description": "Integrity hash for schema_uri.",
20556
+ "type": "string"
20557
+ }
20464
20558
  },
20465
- {
20466
- "type": "object",
20467
- "properties": {
20468
- "type": {
20469
- "type": "string",
20470
- "const": "built-in",
20471
- "description": "Use EUDIPLO built-in authorization server."
20472
- },
20473
- "id": {
20474
- "type": "string",
20475
- "minLength": 1,
20476
- "description": "Authorization server identifier."
20477
- },
20478
- "token": {
20479
- "description": "Optional token issuance settings.",
20559
+ "additionalProperties": false
20560
+ },
20561
+ {
20562
+ "type": "null"
20563
+ }
20564
+ ]
20565
+ },
20566
+ "keyBinding": {
20567
+ "description": "Enable key binding requirements.",
20568
+ "type": "boolean"
20569
+ },
20570
+ "keyChainId": {
20571
+ "description": "Optional key chain id used for credential signing.",
20572
+ "type": "string",
20573
+ "minLength": 1
20574
+ },
20575
+ "statusManagement": {
20576
+ "description": "Enable status management for issued credentials.",
20577
+ "type": "boolean"
20578
+ },
20579
+ "activeCredentials": {
20580
+ "description": "Optional issuer-side policy limiting simultaneously active credentials per subject. Requires statusManagement.",
20581
+ "anyOf": [
20582
+ {
20583
+ "type": "object",
20584
+ "properties": {
20585
+ "enabled": {
20586
+ "type": "boolean",
20587
+ "description": "Ensure a subject has at most one active credential of this configuration."
20588
+ },
20589
+ "tracking": {
20590
+ "description": "How the subject's active credential set is tracked. Only 'internal' (pseudonymous, issuer-side) is currently supported.",
20591
+ "type": "string",
20592
+ "enum": [
20593
+ "internal"
20594
+ ]
20595
+ }
20596
+ },
20597
+ "required": [
20598
+ "enabled"
20599
+ ],
20600
+ "additionalProperties": false,
20601
+ "description": "Issuer-side policy limiting the number of simultaneously active credentials per subject."
20602
+ },
20603
+ {
20604
+ "type": "null"
20605
+ }
20606
+ ]
20607
+ },
20608
+ "iaeActions": {
20609
+ "description": "Interactive authorization steps (a presentation or a web flow) that the wallet completes, in order, before the credential is issued.",
20610
+ "anyOf": [
20611
+ {
20612
+ "type": "array",
20613
+ "items": {
20614
+ "oneOf": [
20615
+ {
20480
20616
  "type": "object",
20481
20617
  "properties": {
20482
- "lifetimeSeconds": {
20483
- "description": "Access token lifetime in seconds.",
20484
- "type": "number",
20485
- "minimum": 60
20486
- },
20487
- "signingKeyId": {
20488
- "description": "Optional key chain id used to sign issued tokens.",
20618
+ "type": {
20489
20619
  "type": "string",
20490
- "minLength": 1
20620
+ "const": "openid4vp_presentation",
20621
+ "description": "Trigger an OpenID4VP presentation action."
20491
20622
  },
20492
- "refreshTokenEnabled": {
20493
- "description": "Enable issuing refresh tokens.",
20494
- "type": "boolean"
20623
+ "label": {
20624
+ "description": "Optional UI label for the action.",
20625
+ "type": "string"
20495
20626
  },
20496
- "refreshTokenExpiresInSeconds": {
20497
- "description": "Refresh token lifetime in seconds.",
20498
- "type": "number",
20499
- "minimum": 60
20627
+ "presentationConfigId": {
20628
+ "type": "string",
20629
+ "minLength": 1,
20630
+ "description": "Presentation configuration id to execute."
20500
20631
  }
20501
20632
  },
20633
+ "required": [
20634
+ "type",
20635
+ "presentationConfigId"
20636
+ ],
20502
20637
  "additionalProperties": false
20503
20638
  },
20504
- "requireDPoP": {
20505
- "description": "Require DPoP proofs for token/credential requests.",
20506
- "type": "boolean"
20507
- },
20508
- "walletAttestationRequired": {
20509
- "description": "Require wallet attestation for this authorization server.",
20510
- "type": "boolean"
20511
- },
20512
- "walletProviderTrustLists": {
20513
- "description": "Optional wallet provider trust list references for this authorization server.",
20514
- "type": "array",
20515
- "items": {
20516
- "type": "object",
20517
- "properties": {
20518
- "trustListId": {
20519
- "type": "string",
20520
- "minLength": 1
20521
- },
20522
- "url": {
20523
- "description": "URL of the wallet provider trust list.",
20524
- "type": "string",
20525
- "format": "uri"
20639
+ {
20640
+ "type": "object",
20641
+ "properties": {
20642
+ "type": {
20643
+ "type": "string",
20644
+ "const": "redirect_to_web",
20645
+ "description": "Trigger a redirect-to-web action."
20646
+ },
20647
+ "label": {
20648
+ "description": "Optional UI label for the action.",
20649
+ "type": "string"
20650
+ },
20651
+ "url": {
20652
+ "type": "string",
20653
+ "format": "uri",
20654
+ "description": "Destination URL for the redirect action."
20655
+ },
20656
+ "callbackUrl": {
20657
+ "description": "Optional callback URL after redirect completion.",
20658
+ "type": "string",
20659
+ "format": "uri"
20660
+ },
20661
+ "description": {
20662
+ "description": "Optional action description.",
20663
+ "type": "string"
20664
+ }
20665
+ },
20666
+ "required": [
20667
+ "type",
20668
+ "url"
20669
+ ],
20670
+ "additionalProperties": false
20671
+ }
20672
+ ],
20673
+ "description": "In-app experience action definitions."
20674
+ }
20675
+ },
20676
+ {
20677
+ "type": "null"
20678
+ }
20679
+ ]
20680
+ },
20681
+ "sdJwtTrustFormat": {
20682
+ "description": "Trust format used for SD-JWT verification metadata.",
20683
+ "anyOf": [
20684
+ {
20685
+ "type": "string",
20686
+ "enum": [
20687
+ "x5c",
20688
+ "federation"
20689
+ ]
20690
+ },
20691
+ {
20692
+ "type": "null"
20693
+ }
20694
+ ]
20695
+ },
20696
+ "lifeTime": {
20697
+ "description": "Credential lifetime in seconds.",
20698
+ "type": "integer",
20699
+ "minimum": 1,
20700
+ "maximum": 9007199254740991
20701
+ },
20702
+ "schemaMeta": {
20703
+ "description": "Optional schema metadata and trust bindings.",
20704
+ "anyOf": [
20705
+ {
20706
+ "type": "object",
20707
+ "properties": {
20708
+ "id": {
20709
+ "description": "Optional schema metadata identifier.",
20710
+ "type": "string"
20711
+ },
20712
+ "name": {
20713
+ "description": "Optional schema metadata name.",
20714
+ "type": "string"
20715
+ },
20716
+ "version": {
20717
+ "type": "string",
20718
+ "description": "Schema metadata version."
20719
+ },
20720
+ "rulebookURI": {
20721
+ "description": "Optional rulebook URI reference.",
20722
+ "type": "string"
20723
+ },
20724
+ "attestationLoS": {
20725
+ "type": "string",
20726
+ "enum": [
20727
+ "iso_18045_high",
20728
+ "iso_18045_moderate",
20729
+ "iso_18045_enhanced-basic",
20730
+ "iso_18045_basic"
20731
+ ],
20732
+ "description": "Assurance level for attestation requirements."
20733
+ },
20734
+ "bindingType": {
20735
+ "type": "string",
20736
+ "enum": [
20737
+ "claim",
20738
+ "key",
20739
+ "biometric",
20740
+ "none"
20741
+ ],
20742
+ "description": "Subject binding type."
20743
+ },
20744
+ "schemaURIs": {
20745
+ "description": "Optional schema URI entries.",
20746
+ "type": "array",
20747
+ "items": {
20748
+ "type": "object",
20749
+ "properties": {
20750
+ "credentialConfigId": {
20751
+ "description": "Optional credential configuration id this schema URI applies to.",
20752
+ "type": "string"
20753
+ },
20754
+ "format": {
20755
+ "description": "Optional credential format for this schema URI.",
20756
+ "type": "string"
20757
+ },
20758
+ "uri": {
20759
+ "description": "Schema URI reference.",
20760
+ "type": "string"
20761
+ },
20762
+ "meta": {
20763
+ "description": "Optional metadata attached to the schema URI.",
20764
+ "type": "object",
20765
+ "propertyNames": {
20766
+ "type": "string"
20526
20767
  },
20527
- "verifierKey": {
20528
- "description": "Optional verifier key material used for trust list verification.",
20529
- "type": "object",
20530
- "propertyNames": {
20768
+ "additionalProperties": {}
20769
+ }
20770
+ },
20771
+ "additionalProperties": false
20772
+ }
20773
+ },
20774
+ "trustedAuthorities": {
20775
+ "description": "Optional trusted authority entries.",
20776
+ "type": "array",
20777
+ "items": {
20778
+ "type": "object",
20779
+ "properties": {
20780
+ "trustListId": {
20781
+ "description": "Optional trust list id.",
20782
+ "type": "string"
20783
+ },
20784
+ "frameworkType": {
20785
+ "description": "Trust framework type. `x509` takes a root certificate in `value` and no `verificationMethod`.",
20786
+ "type": "string",
20787
+ "enum": [
20788
+ "aki",
20789
+ "etsi_tl",
20790
+ "openid_federation",
20791
+ "x509"
20792
+ ]
20793
+ },
20794
+ "value": {
20795
+ "description": "Framework-specific authority value, for example the trust list URL for `etsi_tl` or the root certificate (base64 DER or PEM) for `x509`.",
20796
+ "type": "string"
20797
+ },
20798
+ "verificationMethod": {
20799
+ "description": "Verification method descriptor.",
20800
+ "anyOf": [
20801
+ {
20802
+ "type": "object",
20803
+ "propertyNames": {
20804
+ "type": "string"
20805
+ },
20806
+ "additionalProperties": {}
20807
+ },
20808
+ {
20531
20809
  "type": "string"
20810
+ }
20811
+ ]
20812
+ }
20813
+ },
20814
+ "additionalProperties": false
20815
+ }
20816
+ }
20817
+ },
20818
+ "required": [
20819
+ "version",
20820
+ "attestationLoS",
20821
+ "bindingType"
20822
+ ],
20823
+ "additionalProperties": false
20824
+ },
20825
+ {
20826
+ "type": "null"
20827
+ }
20828
+ ]
20829
+ },
20830
+ "embeddedDisclosurePolicy": {
20831
+ "description": "Optional embedded disclosure policy.",
20832
+ "anyOf": [
20833
+ {
20834
+ "oneOf": [
20835
+ {
20836
+ "type": "object",
20837
+ "properties": {
20838
+ "policy": {
20839
+ "type": "string",
20840
+ "const": "attestationBased",
20841
+ "description": "Attestation-based policy discriminator."
20842
+ },
20843
+ "values": {
20844
+ "type": "array",
20845
+ "items": {
20846
+ "type": "object",
20847
+ "properties": {
20848
+ "claims": {
20849
+ "description": "Claims constraints considered by policy evaluation.",
20850
+ "type": "array",
20851
+ "items": {}
20532
20852
  },
20533
- "additionalProperties": {}
20853
+ "credentials": {
20854
+ "type": "array",
20855
+ "items": {},
20856
+ "description": "Credential constraints considered by policy evaluation."
20857
+ },
20858
+ "credential_sets": {
20859
+ "description": "Optional credential set constraints.",
20860
+ "type": "array",
20861
+ "items": {}
20862
+ }
20534
20863
  },
20535
- "verifierX509Der": {
20536
- "description": "Optional verifier certificate in DER/base64 form.",
20537
- "type": "string"
20538
- }
20864
+ "required": [
20865
+ "credentials"
20866
+ ],
20867
+ "additionalProperties": false
20539
20868
  },
20540
- "additionalProperties": false
20869
+ "description": "Attestation requirements used for policy enforcement."
20541
20870
  }
20542
20871
  },
20543
- "label": {
20544
- "description": "Optional display label for UI selection.",
20545
- "type": "string"
20546
- },
20547
- "enabled": {
20548
- "description": "Whether this authorization server entry is enabled.",
20549
- "type": "boolean"
20550
- }
20872
+ "required": [
20873
+ "policy",
20874
+ "values"
20875
+ ],
20876
+ "additionalProperties": false
20551
20877
  },
20552
- "required": [
20553
- "type",
20554
- "id"
20555
- ],
20556
- "additionalProperties": false
20557
- }
20558
- ],
20559
- "description": "Supported authorization server configurations."
20560
- },
20878
+ {
20879
+ "type": "object",
20880
+ "properties": {
20881
+ "policy": {
20882
+ "type": "string",
20883
+ "const": "none",
20884
+ "description": "No disclosure policy enforcement."
20885
+ }
20886
+ },
20887
+ "required": [
20888
+ "policy"
20889
+ ],
20890
+ "additionalProperties": false
20891
+ },
20892
+ {
20893
+ "type": "object",
20894
+ "properties": {
20895
+ "policy": {
20896
+ "type": "string",
20897
+ "const": "allowList",
20898
+ "description": "Allow-list based policy discriminator."
20899
+ },
20900
+ "values": {
20901
+ "type": "array",
20902
+ "items": {
20903
+ "type": "string"
20904
+ },
20905
+ "description": "Allowed values for policy checks."
20906
+ }
20907
+ },
20908
+ "required": [
20909
+ "policy",
20910
+ "values"
20911
+ ],
20912
+ "additionalProperties": false
20913
+ },
20914
+ {
20915
+ "type": "object",
20916
+ "properties": {
20917
+ "policy": {
20918
+ "type": "string",
20919
+ "const": "rootOfTrust",
20920
+ "description": "Root-of-trust policy discriminator."
20921
+ },
20922
+ "values": {
20923
+ "type": "string",
20924
+ "description": "Root-of-trust identifier or reference."
20925
+ }
20926
+ },
20927
+ "required": [
20928
+ "policy",
20929
+ "values"
20930
+ ],
20931
+ "additionalProperties": false
20932
+ }
20933
+ ],
20934
+ "description": "Embedded disclosure policy configuration."
20935
+ },
20936
+ {
20937
+ "type": "null"
20938
+ }
20939
+ ]
20940
+ }
20941
+ },
20942
+ "required": [
20943
+ "id",
20944
+ "config",
20945
+ "fields"
20946
+ ],
20947
+ "additionalProperties": false,
20948
+ "description": "Payload for creating credential issuance configuration.",
20949
+ "$defs": {
20950
+ "__schema0": {
20951
+ "type": "object",
20952
+ "properties": {
20953
+ "path": {
20954
+ "type": "array",
20955
+ "items": {
20956
+ "type": [
20957
+ "string",
20958
+ "number",
20959
+ "null"
20960
+ ]
20961
+ },
20962
+ "description": "Path to this claim inside the credential payload."
20963
+ },
20964
+ "type": {
20965
+ "type": "string",
20966
+ "enum": [
20967
+ "string",
20968
+ "number",
20969
+ "integer",
20970
+ "boolean",
20971
+ "object",
20972
+ "array"
20973
+ ],
20974
+ "description": "Data type of the claim value."
20975
+ },
20976
+ "defaultValue": {
20977
+ "description": "Optional default value for this field."
20978
+ },
20979
+ "mandatory": {
20980
+ "description": "Whether the field is required at issuance time.",
20981
+ "type": "boolean"
20982
+ },
20983
+ "disclosable": {
20984
+ "description": "Whether the claim is selectively disclosable.",
20985
+ "type": "boolean"
20986
+ },
20987
+ "namespace": {
20988
+ "description": "Optional namespace for claim grouping.",
20989
+ "type": "string"
20990
+ },
20991
+ "display": {
20992
+ "description": "Localized display metadata for this field.",
20993
+ "type": "array",
20994
+ "items": {
20995
+ "type": "object",
20996
+ "properties": {
20997
+ "locale": {
20998
+ "type": "string",
20999
+ "minLength": 1,
21000
+ "description": "Locale tag for the display entry."
21001
+ },
21002
+ "name": {
21003
+ "type": "string",
21004
+ "minLength": 1,
21005
+ "description": "Human-readable field name."
21006
+ },
21007
+ "description": {
21008
+ "description": "Optional field description for this locale.",
21009
+ "type": "string"
21010
+ }
21011
+ },
21012
+ "required": [
21013
+ "locale",
21014
+ "name"
21015
+ ],
21016
+ "additionalProperties": false
21017
+ }
21018
+ },
21019
+ "constraints": {
21020
+ "description": "Optional validation constraints for the claim value.",
21021
+ "type": "object",
21022
+ "propertyNames": {
21023
+ "type": "string"
21024
+ },
21025
+ "additionalProperties": {}
21026
+ },
21027
+ "children": {
21028
+ "description": "Nested child claim definitions for object or array fields.",
21029
+ "type": "array",
21030
+ "items": {
21031
+ "$ref": "#/$defs/CredentialConfigCreate/$defs/__schema0"
21032
+ }
21033
+ }
21034
+ },
21035
+ "required": [
21036
+ "path",
21037
+ "type"
21038
+ ],
21039
+ "additionalProperties": false
21040
+ }
21041
+ },
21042
+ "title": "CredentialConfigCreate"
21043
+ }
21044
+ }
21045
+ },
21046
+ {
21047
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
21048
+ "$id": "https://eudiplo.dev/schemas/v2/IssuanceConfigFile.schema.json",
21049
+ "title": "IssuanceConfigFile",
21050
+ "type": "object",
21051
+ "properties": {
21052
+ "$schema": {
21053
+ "type": "string",
21054
+ "const": "https://eudiplo.dev/schemas/v2/IssuanceConfigFile.schema.json"
21055
+ },
21056
+ "metadata": {
21057
+ "type": "object",
21058
+ "properties": {
21059
+ "generation": {
21060
+ "type": "integer",
21061
+ "minimum": 1,
21062
+ "description": "Monotonically increasing configuration generation."
21063
+ },
21064
+ "ownership": {
21065
+ "type": "string",
21066
+ "enum": [
21067
+ "unmanaged",
21068
+ "file-managed"
21069
+ ],
21070
+ "description": "Requested ownership recorded when the document is applied."
21071
+ }
21072
+ },
21073
+ "additionalProperties": false
21074
+ },
21075
+ "spec": {
21076
+ "$ref": "#/$defs/IssuanceConfig"
21077
+ }
21078
+ },
21079
+ "required": [
21080
+ "$schema",
21081
+ "spec"
21082
+ ],
21083
+ "additionalProperties": false,
21084
+ "$defs": {
21085
+ "IssuanceConfig": {
21086
+ "type": "object",
21087
+ "properties": {
21088
+ "batchSize": {
21089
+ "description": "Optional issuance batch size.",
21090
+ "type": "integer",
21091
+ "minimum": 1,
21092
+ "maximum": 9007199254740991
21093
+ },
21094
+ "dPopRequired": {
21095
+ "description": "Require DPoP proofs for issuance endpoints.",
21096
+ "type": "boolean"
21097
+ },
21098
+ "walletAttestationRequired": {
21099
+ "description": "Default wallet attestation requirement for managed authorization servers.",
21100
+ "type": "boolean"
21101
+ },
21102
+ "walletProviderTrustLists": {
21103
+ "description": "Shared wallet provider trust lists for key attestations and default authorization server wallet authentication.",
21104
+ "type": "array",
21105
+ "items": {
21106
+ "type": "object",
21107
+ "properties": {
21108
+ "trustListId": {
21109
+ "type": "string",
21110
+ "minLength": 1
21111
+ },
21112
+ "url": {
21113
+ "description": "URL of the wallet provider trust list.",
21114
+ "type": "string",
21115
+ "format": "uri"
21116
+ },
21117
+ "verifierKey": {
21118
+ "description": "Optional verifier key material used for trust list verification.",
21119
+ "type": "object",
21120
+ "propertyNames": {
21121
+ "type": "string"
21122
+ },
21123
+ "additionalProperties": {}
21124
+ },
21125
+ "verifierX509Der": {
21126
+ "description": "Optional verifier certificate in DER/base64 form.",
21127
+ "type": "string"
21128
+ }
21129
+ },
21130
+ "additionalProperties": false
21131
+ }
21132
+ },
21133
+ "signingKeyId": {
21134
+ "description": "Default signing key chain id for credential issuance.",
21135
+ "type": "string",
21136
+ "minLength": 1
21137
+ },
21138
+ "authorizationServers": {
21139
+ "minItems": 1,
21140
+ "type": "array",
21141
+ "items": {
21142
+ "oneOf": [
21143
+ {
21144
+ "type": "object",
21145
+ "properties": {
21146
+ "type": {
21147
+ "type": "string",
21148
+ "const": "external",
21149
+ "description": "Use an externally managed authorization server."
21150
+ },
21151
+ "id": {
21152
+ "type": "string",
21153
+ "minLength": 1,
21154
+ "description": "Authorization server identifier."
21155
+ },
21156
+ "issuer": {
21157
+ "type": "string",
21158
+ "format": "uri",
21159
+ "description": "Issuer URL for the external authorization server."
21160
+ },
21161
+ "sessionBinding": {
21162
+ "description": "Explicit mapping from an external access-token claim to an existing issuance session.",
21163
+ "type": "object",
21164
+ "properties": {
21165
+ "method": {
21166
+ "type": "string",
21167
+ "const": "access_token_claim",
21168
+ "description": "Read the correlation value from a configured access-token claim."
21169
+ },
21170
+ "claim": {
21171
+ "type": "string",
21172
+ "minLength": 1,
21173
+ "description": "Claim name that contains the issuance-session correlation value."
21174
+ }
21175
+ },
21176
+ "required": [
21177
+ "method",
21178
+ "claim"
21179
+ ],
21180
+ "additionalProperties": false
21181
+ },
21182
+ "label": {
21183
+ "description": "Optional display label for UI selection.",
21184
+ "type": "string"
21185
+ },
21186
+ "enabled": {
21187
+ "description": "Whether this authorization server entry is enabled.",
21188
+ "type": "boolean"
21189
+ }
21190
+ },
21191
+ "required": [
21192
+ "type",
21193
+ "id",
21194
+ "issuer"
21195
+ ],
21196
+ "additionalProperties": false
21197
+ },
21198
+ {
21199
+ "type": "object",
21200
+ "properties": {
21201
+ "type": {
21202
+ "type": "string",
21203
+ "const": "oid4vp",
21204
+ "description": "Use OID4VP-based authorization server chaining."
21205
+ },
21206
+ "id": {
21207
+ "type": "string",
21208
+ "minLength": 1,
21209
+ "description": "Authorization server identifier."
21210
+ },
21211
+ "presentationConfigId": {
21212
+ "type": "string",
21213
+ "minLength": 1,
21214
+ "description": "Presentation configuration id used during authorization."
21215
+ },
21216
+ "immediateWalletRedirect": {
21217
+ "description": "Redirect wallets immediately after authorization response creation.",
21218
+ "type": "boolean"
21219
+ },
21220
+ "token": {
21221
+ "description": "Optional token issuance settings.",
21222
+ "type": "object",
21223
+ "properties": {
21224
+ "lifetimeSeconds": {
21225
+ "description": "Access token lifetime in seconds.",
21226
+ "type": "number",
21227
+ "minimum": 60
21228
+ },
21229
+ "signingKeyId": {
21230
+ "description": "Optional key chain id used to sign issued tokens.",
21231
+ "type": "string",
21232
+ "minLength": 1
21233
+ },
21234
+ "refreshTokenEnabled": {
21235
+ "description": "Enable issuing refresh tokens.",
21236
+ "type": "boolean"
21237
+ },
21238
+ "refreshTokenExpiresInSeconds": {
21239
+ "description": "Refresh token lifetime in seconds.",
21240
+ "type": "number",
21241
+ "minimum": 60
21242
+ }
21243
+ },
21244
+ "additionalProperties": false
21245
+ },
21246
+ "requireDPoP": {
21247
+ "description": "Require DPoP proofs for token/credential requests.",
21248
+ "type": "boolean"
21249
+ },
21250
+ "walletAttestationRequired": {
21251
+ "description": "Require wallet attestation for this authorization server.",
21252
+ "type": "boolean"
21253
+ },
21254
+ "walletProviderTrustLists": {
21255
+ "description": "Optional wallet provider trust list references for this authorization server.",
21256
+ "type": "array",
21257
+ "items": {
21258
+ "type": "object",
21259
+ "properties": {
21260
+ "trustListId": {
21261
+ "type": "string",
21262
+ "minLength": 1
21263
+ },
21264
+ "url": {
21265
+ "description": "URL of the wallet provider trust list.",
21266
+ "type": "string",
21267
+ "format": "uri"
21268
+ },
21269
+ "verifierKey": {
21270
+ "description": "Optional verifier key material used for trust list verification.",
21271
+ "type": "object",
21272
+ "propertyNames": {
21273
+ "type": "string"
21274
+ },
21275
+ "additionalProperties": {}
21276
+ },
21277
+ "verifierX509Der": {
21278
+ "description": "Optional verifier certificate in DER/base64 form.",
21279
+ "type": "string"
21280
+ }
21281
+ },
21282
+ "additionalProperties": false
21283
+ }
21284
+ },
21285
+ "label": {
21286
+ "description": "Optional display label for UI selection.",
21287
+ "type": "string"
21288
+ },
21289
+ "enabled": {
21290
+ "description": "Whether this authorization server entry is enabled.",
21291
+ "type": "boolean"
21292
+ }
21293
+ },
21294
+ "required": [
21295
+ "type",
21296
+ "id",
21297
+ "presentationConfigId"
21298
+ ],
21299
+ "additionalProperties": false
21300
+ },
21301
+ {
21302
+ "type": "object",
21303
+ "properties": {
21304
+ "type": {
21305
+ "type": "string",
21306
+ "const": "chained",
21307
+ "description": "Use upstream OIDC as authorization source."
21308
+ },
21309
+ "id": {
21310
+ "type": "string",
21311
+ "minLength": 1,
21312
+ "description": "Authorization server identifier."
21313
+ },
21314
+ "upstream": {
21315
+ "type": "object",
21316
+ "properties": {
21317
+ "issuer": {
21318
+ "type": "string",
21319
+ "format": "uri",
21320
+ "description": "Upstream OIDC issuer URL."
21321
+ },
21322
+ "clientId": {
21323
+ "type": "string",
21324
+ "minLength": 1,
21325
+ "description": "Client id for upstream OIDC authentication."
21326
+ },
21327
+ "clientSecret": {
21328
+ "description": "Optional client secret for upstream OIDC authentication.",
21329
+ "type": "string",
21330
+ "minLength": 1
21331
+ },
21332
+ "scopes": {
21333
+ "description": "Optional scopes requested from the upstream issuer.",
21334
+ "type": "array",
21335
+ "items": {
21336
+ "type": "string",
21337
+ "minLength": 1
21338
+ }
21339
+ }
21340
+ },
21341
+ "required": [
21342
+ "issuer",
21343
+ "clientId"
21344
+ ],
21345
+ "additionalProperties": false,
21346
+ "description": "Upstream OIDC connection settings."
21347
+ },
21348
+ "token": {
21349
+ "description": "Optional token issuance settings.",
21350
+ "type": "object",
21351
+ "properties": {
21352
+ "lifetimeSeconds": {
21353
+ "description": "Access token lifetime in seconds.",
21354
+ "type": "number",
21355
+ "minimum": 60
21356
+ },
21357
+ "signingKeyId": {
21358
+ "description": "Optional key chain id used to sign issued tokens.",
21359
+ "type": "string",
21360
+ "minLength": 1
21361
+ },
21362
+ "refreshTokenEnabled": {
21363
+ "description": "Enable issuing refresh tokens.",
21364
+ "type": "boolean"
21365
+ },
21366
+ "refreshTokenExpiresInSeconds": {
21367
+ "description": "Refresh token lifetime in seconds.",
21368
+ "type": "number",
21369
+ "minimum": 60
21370
+ }
21371
+ },
21372
+ "additionalProperties": false
21373
+ },
21374
+ "requireDPoP": {
21375
+ "description": "Require DPoP proofs for token/credential requests.",
21376
+ "type": "boolean"
21377
+ },
21378
+ "walletAttestationRequired": {
21379
+ "description": "Require wallet attestation for this authorization server.",
21380
+ "type": "boolean"
21381
+ },
21382
+ "walletProviderTrustLists": {
21383
+ "description": "Optional wallet provider trust list references for this authorization server.",
21384
+ "type": "array",
21385
+ "items": {
21386
+ "type": "object",
21387
+ "properties": {
21388
+ "trustListId": {
21389
+ "type": "string",
21390
+ "minLength": 1
21391
+ },
21392
+ "url": {
21393
+ "description": "URL of the wallet provider trust list.",
21394
+ "type": "string",
21395
+ "format": "uri"
21396
+ },
21397
+ "verifierKey": {
21398
+ "description": "Optional verifier key material used for trust list verification.",
21399
+ "type": "object",
21400
+ "propertyNames": {
21401
+ "type": "string"
21402
+ },
21403
+ "additionalProperties": {}
21404
+ },
21405
+ "verifierX509Der": {
21406
+ "description": "Optional verifier certificate in DER/base64 form.",
21407
+ "type": "string"
21408
+ }
21409
+ },
21410
+ "additionalProperties": false
21411
+ }
21412
+ },
21413
+ "label": {
21414
+ "description": "Optional display label for UI selection.",
21415
+ "type": "string"
21416
+ },
21417
+ "enabled": {
21418
+ "description": "Whether this authorization server entry is enabled.",
21419
+ "type": "boolean"
21420
+ }
21421
+ },
21422
+ "required": [
21423
+ "type",
21424
+ "id",
21425
+ "upstream"
21426
+ ],
21427
+ "additionalProperties": false
21428
+ },
21429
+ {
21430
+ "type": "object",
21431
+ "properties": {
21432
+ "type": {
21433
+ "type": "string",
21434
+ "const": "built-in",
21435
+ "description": "Use EUDIPLO built-in authorization server."
21436
+ },
21437
+ "id": {
21438
+ "type": "string",
21439
+ "minLength": 1,
21440
+ "description": "Authorization server identifier."
21441
+ },
21442
+ "token": {
21443
+ "description": "Optional token issuance settings.",
21444
+ "type": "object",
21445
+ "properties": {
21446
+ "lifetimeSeconds": {
21447
+ "description": "Access token lifetime in seconds.",
21448
+ "type": "number",
21449
+ "minimum": 60
21450
+ },
21451
+ "signingKeyId": {
21452
+ "description": "Optional key chain id used to sign issued tokens.",
21453
+ "type": "string",
21454
+ "minLength": 1
21455
+ },
21456
+ "refreshTokenEnabled": {
21457
+ "description": "Enable issuing refresh tokens.",
21458
+ "type": "boolean"
21459
+ },
21460
+ "refreshTokenExpiresInSeconds": {
21461
+ "description": "Refresh token lifetime in seconds.",
21462
+ "type": "number",
21463
+ "minimum": 60
21464
+ }
21465
+ },
21466
+ "additionalProperties": false
21467
+ },
21468
+ "requireDPoP": {
21469
+ "description": "Require DPoP proofs for token/credential requests.",
21470
+ "type": "boolean"
21471
+ },
21472
+ "walletAttestationRequired": {
21473
+ "description": "Require wallet attestation for this authorization server.",
21474
+ "type": "boolean"
21475
+ },
21476
+ "walletProviderTrustLists": {
21477
+ "description": "Optional wallet provider trust list references for this authorization server.",
21478
+ "type": "array",
21479
+ "items": {
21480
+ "type": "object",
21481
+ "properties": {
21482
+ "trustListId": {
21483
+ "type": "string",
21484
+ "minLength": 1
21485
+ },
21486
+ "url": {
21487
+ "description": "URL of the wallet provider trust list.",
21488
+ "type": "string",
21489
+ "format": "uri"
21490
+ },
21491
+ "verifierKey": {
21492
+ "description": "Optional verifier key material used for trust list verification.",
21493
+ "type": "object",
21494
+ "propertyNames": {
21495
+ "type": "string"
21496
+ },
21497
+ "additionalProperties": {}
21498
+ },
21499
+ "verifierX509Der": {
21500
+ "description": "Optional verifier certificate in DER/base64 form.",
21501
+ "type": "string"
21502
+ }
21503
+ },
21504
+ "additionalProperties": false
21505
+ }
21506
+ },
21507
+ "label": {
21508
+ "description": "Optional display label for UI selection.",
21509
+ "type": "string"
21510
+ },
21511
+ "enabled": {
21512
+ "description": "Whether this authorization server entry is enabled.",
21513
+ "type": "boolean"
21514
+ }
21515
+ },
21516
+ "required": [
21517
+ "type",
21518
+ "id"
21519
+ ],
21520
+ "additionalProperties": false
21521
+ }
21522
+ ],
21523
+ "description": "Supported authorization server configurations."
21524
+ },
20561
21525
  "description": "Configured authorization server entries."
20562
21526
  },
20563
- "federation": {
20564
- "description": "Optional OpenID Federation settings.",
21527
+ "federation": {
21528
+ "description": "Optional OpenID Federation settings.",
21529
+ "anyOf": [
21530
+ {
21531
+ "type": "object",
21532
+ "properties": {
21533
+ "role": {
21534
+ "description": "Federation role for this issuer.",
21535
+ "type": "string",
21536
+ "enum": [
21537
+ "trust_anchor",
21538
+ "intermediate",
21539
+ "leaf"
21540
+ ]
21541
+ },
21542
+ "mode": {
21543
+ "description": "Federation operation mode.",
21544
+ "type": "string",
21545
+ "enum": [
21546
+ "federation-only",
21547
+ "hybrid"
21548
+ ]
21549
+ },
21550
+ "entityId": {
21551
+ "description": "Optional local federation entity id.",
21552
+ "type": "string"
21553
+ },
21554
+ "enforceSigningPolicy": {
21555
+ "description": "Enforce strict signing policy checks.",
21556
+ "type": "boolean"
21557
+ },
21558
+ "cacheTtlSeconds": {
21559
+ "description": "Cache time-to-live for federation metadata in seconds.",
21560
+ "type": "integer",
21561
+ "minimum": 1,
21562
+ "maximum": 9007199254740991
21563
+ },
21564
+ "trustAnchors": {
21565
+ "type": "array",
21566
+ "items": {
21567
+ "type": "object",
21568
+ "properties": {
21569
+ "entityId": {
21570
+ "type": "string",
21571
+ "minLength": 1,
21572
+ "description": "Federation trust anchor entity id."
21573
+ },
21574
+ "entityConfigurationUri": {
21575
+ "type": "string",
21576
+ "format": "uri",
21577
+ "description": "Entity configuration URI for the trust anchor."
21578
+ }
21579
+ },
21580
+ "required": [
21581
+ "entityId",
21582
+ "entityConfigurationUri"
21583
+ ],
21584
+ "additionalProperties": false
21585
+ },
21586
+ "description": "Federation trust anchors."
21587
+ }
21588
+ },
21589
+ "required": [
21590
+ "trustAnchors"
21591
+ ],
21592
+ "additionalProperties": false
21593
+ },
21594
+ {
21595
+ "type": "null"
21596
+ }
21597
+ ]
21598
+ },
21599
+ "registrationCertificate": {
21600
+ "description": "Optional registration certificate settings.",
21601
+ "anyOf": [
21602
+ {
21603
+ "type": "object",
21604
+ "properties": {
21605
+ "enabled": {
21606
+ "description": "Enable issuer registration certificate support.",
21607
+ "type": "boolean"
21608
+ },
21609
+ "mode": {
21610
+ "description": "How registration certificate data is provided.",
21611
+ "type": "string",
21612
+ "enum": [
21613
+ "import",
21614
+ "generate"
21615
+ ]
21616
+ },
21617
+ "jwt": {
21618
+ "description": "Optional registration certificate JWT when using import mode.",
21619
+ "type": "string"
21620
+ },
21621
+ "privacyPolicy": {
21622
+ "description": "Optional privacy policy URI.",
21623
+ "type": "string"
21624
+ },
21625
+ "supportUri": {
21626
+ "description": "Optional support URI.",
21627
+ "type": "string"
21628
+ }
21629
+ },
21630
+ "additionalProperties": false
21631
+ },
21632
+ {
21633
+ "type": "null"
21634
+ }
21635
+ ]
21636
+ },
21637
+ "display": {
21638
+ "description": "Localized issuer metadata shown to wallets.",
21639
+ "type": "array",
21640
+ "items": {
21641
+ "type": "object",
21642
+ "properties": {
21643
+ "name": {
21644
+ "description": "Issuer display name.",
21645
+ "type": "string"
21646
+ },
21647
+ "locale": {
21648
+ "description": "Locale tag for this display entry.",
21649
+ "type": "string"
21650
+ },
21651
+ "logo": {
21652
+ "description": "Optional issuer logo metadata.",
21653
+ "type": "object",
21654
+ "properties": {
21655
+ "uri": {
21656
+ "type": "string",
21657
+ "minLength": 1,
21658
+ "description": "Logo URI."
21659
+ },
21660
+ "alt_text": {
21661
+ "description": "Optional localized alternative text.",
21662
+ "type": "string"
21663
+ }
21664
+ },
21665
+ "required": [
21666
+ "uri"
21667
+ ],
21668
+ "additionalProperties": {}
21669
+ }
21670
+ },
21671
+ "additionalProperties": {}
21672
+ }
21673
+ },
21674
+ "notificationEndpointEnabled": {
21675
+ "description": "Whether the OID4VCI notification endpoint is exposed for this issuance configuration.",
21676
+ "type": "boolean"
21677
+ },
21678
+ "credentialResponseEncryption": {
21679
+ "description": "Enable encrypted credential responses.",
21680
+ "type": "boolean"
21681
+ },
21682
+ "credentialRequestEncryption": {
21683
+ "description": "Require encrypted credential requests.",
21684
+ "type": "boolean"
21685
+ },
21686
+ "txCodeMaxAttempts": {
21687
+ "description": "Maximum verification attempts for transaction codes. Null resets to defaults.",
21688
+ "anyOf": [
21689
+ {
21690
+ "type": "integer",
21691
+ "minimum": 1,
21692
+ "maximum": 9007199254740991
21693
+ },
21694
+ {
21695
+ "type": "null"
21696
+ }
21697
+ ]
21698
+ },
21699
+ "offerLifetimeSeconds": {
21700
+ "description": "Default lifetime of credential offers in seconds. Can be overridden per offer request. Null or unset: offers do not expire.",
20565
21701
  "anyOf": [
21702
+ {
21703
+ "type": "integer",
21704
+ "minimum": 1,
21705
+ "maximum": 9007199254740991
21706
+ },
21707
+ {
21708
+ "type": "null"
21709
+ }
21710
+ ]
21711
+ }
21712
+ },
21713
+ "required": [
21714
+ "authorizationServers"
21715
+ ],
21716
+ "additionalProperties": false,
21717
+ "title": "IssuanceConfig"
21718
+ }
21719
+ }
21720
+ },
21721
+ {
21722
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
21723
+ "$id": "https://eudiplo.dev/schemas/v2/KeyChainConfigFile.schema.json",
21724
+ "title": "KeyChainConfigFile",
21725
+ "type": "object",
21726
+ "properties": {
21727
+ "$schema": {
21728
+ "type": "string",
21729
+ "const": "https://eudiplo.dev/schemas/v2/KeyChainConfigFile.schema.json"
21730
+ },
21731
+ "metadata": {
21732
+ "type": "object",
21733
+ "properties": {
21734
+ "generation": {
21735
+ "type": "integer",
21736
+ "minimum": 1,
21737
+ "maximum": 9007199254740991
21738
+ },
21739
+ "ownership": {
21740
+ "type": "string",
21741
+ "enum": [
21742
+ "unmanaged",
21743
+ "file-managed"
21744
+ ]
21745
+ }
21746
+ },
21747
+ "additionalProperties": false
21748
+ },
21749
+ "spec": {
21750
+ "type": "object",
21751
+ "properties": {
21752
+ "id": {
21753
+ "type": "string"
21754
+ },
21755
+ "description": {
21756
+ "type": "string"
21757
+ },
21758
+ "usageType": {
21759
+ "type": "string",
21760
+ "enum": [
21761
+ "access",
21762
+ "attestation",
21763
+ "trustList",
21764
+ "statusList",
21765
+ "encrypt"
21766
+ ]
21767
+ },
21768
+ "type": {
21769
+ "description": "Key chain type. For a `private-jwk` key source without `activeJwk`, `standalone` makes `jwk` the signing key and `crt` its chain, leaf first; `internalChain` makes `jwk` a CA key and the last `crt` entry its CA certificate (created if `crt` is omitted), and the import generates a new signing key with a certificate issued by it. Without `type`, `jwk` is a CA key only if `rotationPolicy.enabled` is true and `crt` is not a single self-signed certificate that is not a CA. For `regenerate`, it is the type of the new key chain and must equal `keySource.keyChainType` if both are set. For the other key sources, it must match the key chain they describe.",
21770
+ "type": "string",
21771
+ "enum": [
21772
+ "standalone",
21773
+ "internalChain"
21774
+ ]
21775
+ },
21776
+ "keySource": {
21777
+ "oneOf": [
21778
+ {
21779
+ "type": "object",
21780
+ "properties": {
21781
+ "type": {
21782
+ "type": "string",
21783
+ "const": "private-jwk"
21784
+ },
21785
+ "jwk": {
21786
+ "type": "object",
21787
+ "properties": {
21788
+ "kty": {
21789
+ "type": "string",
21790
+ "description": "Key type (for example EC)."
21791
+ },
21792
+ "x": {
21793
+ "type": "string",
21794
+ "description": "Elliptic curve public x coordinate."
21795
+ },
21796
+ "y": {
21797
+ "type": "string",
21798
+ "description": "Elliptic curve public y coordinate."
21799
+ },
21800
+ "crv": {
21801
+ "type": "string",
21802
+ "description": "Elliptic curve name."
21803
+ },
21804
+ "d": {
21805
+ "type": "string",
21806
+ "description": "Private key value."
21807
+ },
21808
+ "alg": {
21809
+ "description": "Optional algorithm hint.",
21810
+ "type": "string"
21811
+ },
21812
+ "kid": {
21813
+ "description": "Optional key identifier.",
21814
+ "type": "string"
21815
+ }
21816
+ },
21817
+ "required": [
21818
+ "kty",
21819
+ "x",
21820
+ "y",
21821
+ "crv",
21822
+ "d"
21823
+ ],
21824
+ "additionalProperties": false
21825
+ },
21826
+ "activeJwk": {
21827
+ "type": "object",
21828
+ "properties": {
21829
+ "kty": {
21830
+ "type": "string",
21831
+ "description": "Key type (for example EC)."
21832
+ },
21833
+ "x": {
21834
+ "type": "string",
21835
+ "description": "Elliptic curve public x coordinate."
21836
+ },
21837
+ "y": {
21838
+ "type": "string",
21839
+ "description": "Elliptic curve public y coordinate."
21840
+ },
21841
+ "crv": {
21842
+ "type": "string",
21843
+ "description": "Elliptic curve name."
21844
+ },
21845
+ "d": {
21846
+ "type": "string",
21847
+ "description": "Private key value."
21848
+ },
21849
+ "alg": {
21850
+ "description": "Optional algorithm hint.",
21851
+ "type": "string"
21852
+ },
21853
+ "kid": {
21854
+ "description": "Optional key identifier.",
21855
+ "type": "string"
21856
+ }
21857
+ },
21858
+ "required": [
21859
+ "kty",
21860
+ "x",
21861
+ "y",
21862
+ "crv",
21863
+ "d"
21864
+ ],
21865
+ "additionalProperties": false
21866
+ }
21867
+ },
21868
+ "required": [
21869
+ "type",
21870
+ "jwk"
21871
+ ],
21872
+ "additionalProperties": false
21873
+ },
21874
+ {
21875
+ "type": "object",
21876
+ "properties": {
21877
+ "type": {
21878
+ "type": "string",
21879
+ "const": "external-reference"
21880
+ },
21881
+ "provider": {
21882
+ "type": "string"
21883
+ },
21884
+ "externalKeyId": {
21885
+ "type": "string"
21886
+ },
21887
+ "publicJwk": {
21888
+ "type": "object",
21889
+ "properties": {
21890
+ "kty": {
21891
+ "type": "string"
21892
+ },
21893
+ "x": {
21894
+ "type": "string"
21895
+ },
21896
+ "y": {
21897
+ "type": "string"
21898
+ },
21899
+ "crv": {
21900
+ "type": "string"
21901
+ },
21902
+ "alg": {
21903
+ "type": "string"
21904
+ },
21905
+ "kid": {
21906
+ "type": "string"
21907
+ }
21908
+ },
21909
+ "required": [
21910
+ "kty",
21911
+ "x",
21912
+ "y",
21913
+ "crv"
21914
+ ],
21915
+ "additionalProperties": false
21916
+ },
21917
+ "activeExternalKeyId": {
21918
+ "type": "string"
21919
+ },
21920
+ "activePublicJwk": {
21921
+ "type": "object",
21922
+ "properties": {
21923
+ "kty": {
21924
+ "type": "string"
21925
+ },
21926
+ "x": {
21927
+ "type": "string"
21928
+ },
21929
+ "y": {
21930
+ "type": "string"
21931
+ },
21932
+ "crv": {
21933
+ "type": "string"
21934
+ },
21935
+ "alg": {
21936
+ "type": "string"
21937
+ },
21938
+ "kid": {
21939
+ "type": "string"
21940
+ }
21941
+ },
21942
+ "required": [
21943
+ "kty",
21944
+ "x",
21945
+ "y",
21946
+ "crv"
21947
+ ],
21948
+ "additionalProperties": false
21949
+ }
21950
+ },
21951
+ "required": [
21952
+ "type",
21953
+ "provider",
21954
+ "externalKeyId",
21955
+ "publicJwk"
21956
+ ],
21957
+ "additionalProperties": false
21958
+ },
20566
21959
  {
20567
21960
  "type": "object",
20568
21961
  "properties": {
20569
- "role": {
20570
- "description": "Federation role for this issuer.",
20571
- "type": "string",
20572
- "enum": [
20573
- "trust_anchor",
20574
- "intermediate",
20575
- "leaf"
20576
- ]
20577
- },
20578
- "mode": {
20579
- "description": "Federation operation mode.",
21962
+ "type": {
20580
21963
  "type": "string",
20581
- "enum": [
20582
- "federation-only",
20583
- "hybrid"
20584
- ]
20585
- },
20586
- "entityId": {
20587
- "description": "Optional local federation entity id.",
20588
- "type": "string"
20589
- },
20590
- "enforceSigningPolicy": {
20591
- "description": "Enforce strict signing policy checks.",
20592
- "type": "boolean"
20593
- },
20594
- "cacheTtlSeconds": {
20595
- "description": "Cache time-to-live for federation metadata in seconds.",
20596
- "type": "integer",
20597
- "minimum": 1,
20598
- "maximum": 9007199254740991
21964
+ "const": "required"
20599
21965
  },
20600
- "trustAnchors": {
20601
- "type": "array",
20602
- "items": {
20603
- "type": "object",
20604
- "properties": {
20605
- "entityId": {
20606
- "type": "string",
20607
- "minLength": 1,
20608
- "description": "Federation trust anchor entity id."
20609
- },
20610
- "entityConfigurationUri": {
20611
- "type": "string",
20612
- "format": "uri",
20613
- "description": "Entity configuration URI for the trust anchor."
20614
- }
21966
+ "publicJwk": {
21967
+ "type": "object",
21968
+ "properties": {
21969
+ "kty": {
21970
+ "type": "string"
20615
21971
  },
20616
- "required": [
20617
- "entityId",
20618
- "entityConfigurationUri"
20619
- ],
20620
- "additionalProperties": false
21972
+ "x": {
21973
+ "type": "string"
21974
+ },
21975
+ "y": {
21976
+ "type": "string"
21977
+ },
21978
+ "crv": {
21979
+ "type": "string"
21980
+ },
21981
+ "alg": {
21982
+ "type": "string"
21983
+ },
21984
+ "kid": {
21985
+ "type": "string"
21986
+ }
20621
21987
  },
20622
- "description": "Federation trust anchors."
21988
+ "required": [
21989
+ "kty",
21990
+ "x",
21991
+ "y",
21992
+ "crv"
21993
+ ],
21994
+ "additionalProperties": false
20623
21995
  }
20624
21996
  },
20625
21997
  "required": [
20626
- "trustAnchors"
21998
+ "type"
20627
21999
  ],
20628
22000
  "additionalProperties": false
20629
22001
  },
20630
- {
20631
- "type": "null"
20632
- }
20633
- ]
20634
- },
20635
- "registrationCertificate": {
20636
- "description": "Optional registration certificate settings.",
20637
- "anyOf": [
20638
22002
  {
20639
22003
  "type": "object",
20640
22004
  "properties": {
20641
- "enabled": {
20642
- "description": "Enable issuer registration certificate support.",
20643
- "type": "boolean"
22005
+ "type": {
22006
+ "type": "string",
22007
+ "const": "regenerate"
20644
22008
  },
20645
- "mode": {
20646
- "description": "How registration certificate data is provided.",
22009
+ "keyChainType": {
20647
22010
  "type": "string",
20648
22011
  "enum": [
20649
- "import",
20650
- "generate"
22012
+ "standalone",
22013
+ "internalChain"
20651
22014
  ]
20652
- },
20653
- "jwt": {
20654
- "description": "Optional registration certificate JWT when using import mode.",
20655
- "type": "string"
20656
- },
20657
- "privacyPolicy": {
20658
- "description": "Optional privacy policy URI.",
20659
- "type": "string"
20660
- },
20661
- "supportUri": {
20662
- "description": "Optional support URI.",
20663
- "type": "string"
20664
22015
  }
20665
22016
  },
22017
+ "required": [
22018
+ "type"
22019
+ ],
20666
22020
  "additionalProperties": false
20667
- },
20668
- {
20669
- "type": "null"
20670
22021
  }
20671
22022
  ]
20672
22023
  },
20673
- "display": {
20674
- "description": "Localized issuer metadata shown to wallets.",
22024
+ "crt": {
20675
22025
  "type": "array",
20676
22026
  "items": {
20677
- "type": "object",
20678
- "properties": {
20679
- "name": {
20680
- "description": "Issuer display name.",
20681
- "type": "string"
20682
- },
20683
- "locale": {
20684
- "description": "Locale tag for this display entry.",
20685
- "type": "string"
20686
- },
20687
- "logo": {
20688
- "description": "Optional issuer logo metadata.",
20689
- "type": "object",
20690
- "properties": {
20691
- "uri": {
20692
- "type": "string",
20693
- "minLength": 1,
20694
- "description": "Logo URI."
20695
- },
20696
- "alt_text": {
20697
- "description": "Optional localized alternative text.",
20698
- "type": "string"
20699
- }
20700
- },
20701
- "required": [
20702
- "uri"
20703
- ],
20704
- "additionalProperties": {}
20705
- }
20706
- },
20707
- "additionalProperties": {}
22027
+ "type": "string"
20708
22028
  }
20709
22029
  },
20710
- "notificationEndpointEnabled": {
20711
- "description": "Whether the OID4VCI notification endpoint is exposed for this issuance configuration.",
20712
- "type": "boolean"
20713
- },
20714
- "credentialResponseEncryption": {
20715
- "description": "Enable encrypted credential responses.",
20716
- "type": "boolean"
22030
+ "activeCertificate": {
22031
+ "description": "Active certificate for an internal key chain.",
22032
+ "type": "string"
20717
22033
  },
20718
- "credentialRequestEncryption": {
20719
- "description": "Require encrypted credential requests.",
20720
- "type": "boolean"
22034
+ "kmsProvider": {
22035
+ "type": "string"
20721
22036
  },
20722
- "txCodeMaxAttempts": {
20723
- "description": "Maximum verification attempts for transaction codes. Null resets to defaults.",
20724
- "anyOf": [
20725
- {
20726
- "type": "integer",
20727
- "minimum": 1,
20728
- "maximum": 9007199254740991
22037
+ "rotationPolicy": {
22038
+ "type": "object",
22039
+ "properties": {
22040
+ "enabled": {
22041
+ "type": "boolean"
20729
22042
  },
20730
- {
20731
- "type": "null"
20732
- }
20733
- ]
20734
- },
20735
- "offerLifetimeSeconds": {
20736
- "description": "Default lifetime of credential offers in seconds. Can be overridden per offer request. Null or unset: offers do not expire.",
20737
- "anyOf": [
20738
- {
20739
- "type": "integer",
20740
- "minimum": 1,
20741
- "maximum": 9007199254740991
22043
+ "intervalDays": {
22044
+ "anyOf": [
22045
+ {
22046
+ "type": "number",
22047
+ "minimum": 1,
22048
+ "maximum": 3650
22049
+ },
22050
+ {
22051
+ "type": "null"
22052
+ }
22053
+ ]
20742
22054
  },
20743
- {
20744
- "type": "null"
22055
+ "certValidityDays": {
22056
+ "anyOf": [
22057
+ {
22058
+ "type": "number",
22059
+ "minimum": 1,
22060
+ "maximum": 3650
22061
+ },
22062
+ {
22063
+ "type": "null"
22064
+ }
22065
+ ]
20745
22066
  }
20746
- ]
22067
+ },
22068
+ "required": [
22069
+ "enabled"
22070
+ ],
22071
+ "additionalProperties": false
20747
22072
  }
20748
22073
  },
20749
22074
  "required": [
20750
- "authorizationServers"
22075
+ "usageType",
22076
+ "keySource"
20751
22077
  ],
20752
- "additionalProperties": false,
20753
- "title": "IssuanceConfig"
22078
+ "additionalProperties": false
20754
22079
  }
20755
- }
22080
+ },
22081
+ "required": [
22082
+ "$schema",
22083
+ "metadata",
22084
+ "spec"
22085
+ ],
22086
+ "additionalProperties": false
20756
22087
  },
20757
22088
  {
20758
22089
  "$schema": "https://json-schema.org/draft/2020-12/schema",
@@ -23053,7 +24384,11 @@ function wrapBare(kind, input, path2) {
23053
24384
  singleton[kind] ?? spec.id ?? spec.clientId ?? basename2(path2, ".json")
23054
24385
  );
23055
24386
  if (!singleton[kind]) spec[kind === "Client" ? "clientId" : "id"] = id;
23056
- return { $schema: schemaUrl(kind, 1), metadata: { generation: 1 }, spec };
24387
+ return {
24388
+ $schema: schemaUrl(kind, bareFileVersion(kind, input)),
24389
+ metadata: { generation: 1 },
24390
+ spec
24391
+ };
23057
24392
  }
23058
24393
  async function folderFiles(path2) {
23059
24394
  const files = [];
@@ -25691,7 +27026,7 @@ function createDeploymentCommands(context, setExitCode) {
25691
27026
  // package.json
25692
27027
  var package_default = {
25693
27028
  name: "@eudiplo/cli",
25694
- version: "9.1.0-main.ab82b00",
27029
+ version: "9.1.0-main.b3aa53d",
25695
27030
  description: "Deployment-aware command line tools for EUDIPLO",
25696
27031
  private: false,
25697
27032
  type: "module",
@@ -26138,7 +27473,7 @@ var kmsHealthCheck = {
26138
27473
  return {
26139
27474
  name: "KMS providers",
26140
27475
  status: "skip",
26141
- message: `Needs a tenant client with issuance:manage or presentation:manage (${response.reason}).`
27476
+ message: `Needs a tenant client with issuance:manage, presentation:manage or keys:manage (${response.reason}).`
26142
27477
  };
26143
27478
  }
26144
27479
  return {