@eudiplo/cli 9.1.0-main.b3aa53d → 9.1.0-main.b97c2d6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (64) hide show
  1. package/dist/commands/completion/action.js +3 -1
  2. package/dist/commands/completion/action.js.map +1 -1
  3. package/dist/commands/config/portability/migrations.spec.js +4 -2
  4. package/dist/commands/config/portability/migrations.spec.js.map +1 -1
  5. package/dist/commands/config/validate/action.d.ts.map +1 -1
  6. package/dist/commands/config/validate/action.js +2 -1
  7. package/dist/commands/config/validate/action.js.map +1 -1
  8. package/dist/commands/config/validate/registry.json +10 -0
  9. package/dist/commands/init/action.d.ts.map +1 -1
  10. package/dist/commands/init/action.js +1 -11
  11. package/dist/commands/init/action.js.map +1 -1
  12. package/dist/commands/instance/action.d.ts +2 -0
  13. package/dist/commands/instance/action.d.ts.map +1 -1
  14. package/dist/commands/instance/action.js +68 -12
  15. package/dist/commands/instance/action.js.map +1 -1
  16. package/dist/commands/instance/index.d.ts.map +1 -1
  17. package/dist/commands/instance/index.js +21 -3
  18. package/dist/commands/instance/index.js.map +1 -1
  19. package/dist/commands/open/action.d.ts.map +1 -1
  20. package/dist/commands/open/action.js +13 -2
  21. package/dist/commands/open/action.js.map +1 -1
  22. package/dist/commands/status/action.d.ts.map +1 -1
  23. package/dist/commands/status/action.js +2 -1
  24. package/dist/commands/status/action.js.map +1 -1
  25. package/dist/index.js +4922 -845
  26. package/dist/services/api-auth.d.ts.map +1 -1
  27. package/dist/services/api-auth.js +3 -2
  28. package/dist/services/api-auth.js.map +1 -1
  29. package/dist/services/browser.d.ts.map +1 -1
  30. package/dist/services/browser.js +3 -2
  31. package/dist/services/browser.js.map +1 -1
  32. package/dist/services/cli-config.d.ts +41 -1
  33. package/dist/services/cli-config.d.ts.map +1 -1
  34. package/dist/services/cli-config.js +217 -29
  35. package/dist/services/cli-config.js.map +1 -1
  36. package/dist/services/diagnostics.d.ts.map +1 -1
  37. package/dist/services/diagnostics.js +8 -7
  38. package/dist/services/diagnostics.js.map +1 -1
  39. package/dist/services/instance-selection.d.ts.map +1 -1
  40. package/dist/services/instance-selection.js +2 -5
  41. package/dist/services/instance-selection.js.map +1 -1
  42. package/dist/services/url.d.ts +21 -0
  43. package/dist/services/url.d.ts.map +1 -0
  44. package/dist/services/url.js +61 -0
  45. package/dist/services/url.js.map +1 -0
  46. package/package.json +4 -3
  47. package/templates/demo-config/key-chains/status-list.json +3 -3
  48. package/templates/docker-compose.yml +2 -2
  49. package/templates/schemas/CreateFederationTrustAnchorDto.schema.json +82 -0
  50. package/templates/schemas/CreateRegistrarConfigDto.schema.json +29 -0
  51. package/templates/schemas/FederationTrustAnchorConfigFile.schema.json +60 -0
  52. package/templates/schemas/ImportTenantDto.schema.json +12 -0
  53. package/templates/schemas/IssuanceConfig.schema.json +120 -2
  54. package/templates/schemas/IssuanceConfigFile.schema.json +1434 -1
  55. package/templates/schemas/KeyChainConfigFile.schema.json +370 -1
  56. package/templates/schemas/KeyChainCreateDto.schema.json +10 -0
  57. package/templates/schemas/KeyChainImportDto.schema.json +1 -0
  58. package/templates/schemas/KmsConfigDto.schema.json +186 -0
  59. package/templates/schemas/KmsConfigFile.schema.json +1026 -1
  60. package/templates/schemas/RegistrarConfigFile.schema.json +101 -1
  61. package/templates/schemas/TenantConfigFile.schema.json +281 -0
  62. package/templates/schemas/UpdateFederationTrustAnchorDto.schema.json +70 -0
  63. package/templates/schemas/UpdateTenantDto.schema.json +20 -0
  64. package/templates/schemas.manifest.json +3 -0
package/templates/schemas/KeyChainConfigFile.schema.json CHANGED
@@ -9,7 +9,7 @@
9
9
  "properties": {
10
10
  "$schema": {
11
11
  "type": "string",
12
- "const": "https://eudiplo.dev/schemas/v2/KeyChainConfigFile.schema.json"
12
+ "const": "https://eudiplo.dev/schemas/v3/KeyChainConfigFile.schema.json"
13
13
  },
14
14
  "metadata": {
15
15
  "type": "object",
@@ -45,6 +45,7 @@
45
45
  "attestation",
46
46
  "trustList",
47
47
  "statusList",
48
+ "federation",
48
49
  "encrypt"
49
50
  ]
50
51
  },
@@ -727,6 +728,373 @@
727
728
  ],
728
729
  "additionalProperties": false
729
730
  },
731
+ {
732
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
733
+ "$id": "https://eudiplo.dev/schemas/v2/KeyChainConfigFile.schema.json",
734
+ "title": "KeyChainConfigFile",
735
+ "type": "object",
736
+ "properties": {
737
+ "$schema": {
738
+ "type": "string",
739
+ "const": "https://eudiplo.dev/schemas/v2/KeyChainConfigFile.schema.json"
740
+ },
741
+ "metadata": {
742
+ "type": "object",
743
+ "properties": {
744
+ "generation": {
745
+ "type": "integer",
746
+ "minimum": 1,
747
+ "maximum": 9007199254740991
748
+ },
749
+ "ownership": {
750
+ "type": "string",
751
+ "enum": [
752
+ "unmanaged",
753
+ "file-managed"
754
+ ]
755
+ }
756
+ },
757
+ "additionalProperties": false
758
+ },
759
+ "spec": {
760
+ "type": "object",
761
+ "properties": {
762
+ "id": {
763
+ "type": "string"
764
+ },
765
+ "description": {
766
+ "type": "string"
767
+ },
768
+ "usageType": {
769
+ "type": "string",
770
+ "enum": [
771
+ "access",
772
+ "attestation",
773
+ "trustList",
774
+ "statusList",
775
+ "encrypt"
776
+ ]
777
+ },
778
+ "type": {
779
+ "description": "Key chain type. For a `private-jwk` key source without `activeJwk`, `standalone` makes `jwk` the signing key and `crt` its chain, leaf first; `internalChain` makes `jwk` a CA key and the last `crt` entry its CA certificate (created if `crt` is omitted), and the import generates a new signing key with a certificate issued by it. Without `type`, `jwk` is a CA key only if `rotationPolicy.enabled` is true and `crt` is not a single self-signed certificate that is not a CA. For `regenerate`, it is the type of the new key chain and must equal `keySource.keyChainType` if both are set. For the other key sources, it must match the key chain they describe.",
780
+ "type": "string",
781
+ "enum": [
782
+ "standalone",
783
+ "internalChain"
784
+ ]
785
+ },
786
+ "keySource": {
787
+ "oneOf": [
788
+ {
789
+ "type": "object",
790
+ "properties": {
791
+ "type": {
792
+ "type": "string",
793
+ "const": "private-jwk"
794
+ },
795
+ "jwk": {
796
+ "type": "object",
797
+ "properties": {
798
+ "kty": {
799
+ "type": "string",
800
+ "description": "Key type (for example EC)."
801
+ },
802
+ "x": {
803
+ "type": "string",
804
+ "description": "Elliptic curve public x coordinate."
805
+ },
806
+ "y": {
807
+ "type": "string",
808
+ "description": "Elliptic curve public y coordinate."
809
+ },
810
+ "crv": {
811
+ "type": "string",
812
+ "description": "Elliptic curve name."
813
+ },
814
+ "d": {
815
+ "type": "string",
816
+ "description": "Private key value."
817
+ },
818
+ "alg": {
819
+ "description": "Optional algorithm hint.",
820
+ "type": "string"
821
+ },
822
+ "kid": {
823
+ "description": "Optional key identifier.",
824
+ "type": "string"
825
+ }
826
+ },
827
+ "required": [
828
+ "kty",
829
+ "x",
830
+ "y",
831
+ "crv",
832
+ "d"
833
+ ],
834
+ "additionalProperties": false
835
+ },
836
+ "activeJwk": {
837
+ "type": "object",
838
+ "properties": {
839
+ "kty": {
840
+ "type": "string",
841
+ "description": "Key type (for example EC)."
842
+ },
843
+ "x": {
844
+ "type": "string",
845
+ "description": "Elliptic curve public x coordinate."
846
+ },
847
+ "y": {
848
+ "type": "string",
849
+ "description": "Elliptic curve public y coordinate."
850
+ },
851
+ "crv": {
852
+ "type": "string",
853
+ "description": "Elliptic curve name."
854
+ },
855
+ "d": {
856
+ "type": "string",
857
+ "description": "Private key value."
858
+ },
859
+ "alg": {
860
+ "description": "Optional algorithm hint.",
861
+ "type": "string"
862
+ },
863
+ "kid": {
864
+ "description": "Optional key identifier.",
865
+ "type": "string"
866
+ }
867
+ },
868
+ "required": [
869
+ "kty",
870
+ "x",
871
+ "y",
872
+ "crv",
873
+ "d"
874
+ ],
875
+ "additionalProperties": false
876
+ }
877
+ },
878
+ "required": [
879
+ "type",
880
+ "jwk"
881
+ ],
882
+ "additionalProperties": false
883
+ },
884
+ {
885
+ "type": "object",
886
+ "properties": {
887
+ "type": {
888
+ "type": "string",
889
+ "const": "external-reference"
890
+ },
891
+ "provider": {
892
+ "type": "string"
893
+ },
894
+ "externalKeyId": {
895
+ "type": "string"
896
+ },
897
+ "publicJwk": {
898
+ "type": "object",
899
+ "properties": {
900
+ "kty": {
901
+ "type": "string"
902
+ },
903
+ "x": {
904
+ "type": "string"
905
+ },
906
+ "y": {
907
+ "type": "string"
908
+ },
909
+ "crv": {
910
+ "type": "string"
911
+ },
912
+ "alg": {
913
+ "type": "string"
914
+ },
915
+ "kid": {
916
+ "type": "string"
917
+ }
918
+ },
919
+ "required": [
920
+ "kty",
921
+ "x",
922
+ "y",
923
+ "crv"
924
+ ],
925
+ "additionalProperties": false
926
+ },
927
+ "activeExternalKeyId": {
928
+ "type": "string"
929
+ },
930
+ "activePublicJwk": {
931
+ "type": "object",
932
+ "properties": {
933
+ "kty": {
934
+ "type": "string"
935
+ },
936
+ "x": {
937
+ "type": "string"
938
+ },
939
+ "y": {
940
+ "type": "string"
941
+ },
942
+ "crv": {
943
+ "type": "string"
944
+ },
945
+ "alg": {
946
+ "type": "string"
947
+ },
948
+ "kid": {
949
+ "type": "string"
950
+ }
951
+ },
952
+ "required": [
953
+ "kty",
954
+ "x",
955
+ "y",
956
+ "crv"
957
+ ],
958
+ "additionalProperties": false
959
+ }
960
+ },
961
+ "required": [
962
+ "type",
963
+ "provider",
964
+ "externalKeyId",
965
+ "publicJwk"
966
+ ],
967
+ "additionalProperties": false
968
+ },
969
+ {
970
+ "type": "object",
971
+ "properties": {
972
+ "type": {
973
+ "type": "string",
974
+ "const": "required"
975
+ },
976
+ "publicJwk": {
977
+ "type": "object",
978
+ "properties": {
979
+ "kty": {
980
+ "type": "string"
981
+ },
982
+ "x": {
983
+ "type": "string"
984
+ },
985
+ "y": {
986
+ "type": "string"
987
+ },
988
+ "crv": {
989
+ "type": "string"
990
+ },
991
+ "alg": {
992
+ "type": "string"
993
+ },
994
+ "kid": {
995
+ "type": "string"
996
+ }
997
+ },
998
+ "required": [
999
+ "kty",
1000
+ "x",
1001
+ "y",
1002
+ "crv"
1003
+ ],
1004
+ "additionalProperties": false
1005
+ }
1006
+ },
1007
+ "required": [
1008
+ "type"
1009
+ ],
1010
+ "additionalProperties": false
1011
+ },
1012
+ {
1013
+ "type": "object",
1014
+ "properties": {
1015
+ "type": {
1016
+ "type": "string",
1017
+ "const": "regenerate"
1018
+ },
1019
+ "keyChainType": {
1020
+ "type": "string",
1021
+ "enum": [
1022
+ "standalone",
1023
+ "internalChain"
1024
+ ]
1025
+ }
1026
+ },
1027
+ "required": [
1028
+ "type"
1029
+ ],
1030
+ "additionalProperties": false
1031
+ }
1032
+ ]
1033
+ },
1034
+ "crt": {
1035
+ "type": "array",
1036
+ "items": {
1037
+ "type": "string"
1038
+ }
1039
+ },
1040
+ "activeCertificate": {
1041
+ "description": "Active certificate for an internal key chain.",
1042
+ "type": "string"
1043
+ },
1044
+ "kmsProvider": {
1045
+ "type": "string"
1046
+ },
1047
+ "rotationPolicy": {
1048
+ "type": "object",
1049
+ "properties": {
1050
+ "enabled": {
1051
+ "type": "boolean"
1052
+ },
1053
+ "intervalDays": {
1054
+ "anyOf": [
1055
+ {
1056
+ "type": "number",
1057
+ "minimum": 1,
1058
+ "maximum": 3650
1059
+ },
1060
+ {
1061
+ "type": "null"
1062
+ }
1063
+ ]
1064
+ },
1065
+ "certValidityDays": {
1066
+ "anyOf": [
1067
+ {
1068
+ "type": "number",
1069
+ "minimum": 1,
1070
+ "maximum": 3650
1071
+ },
1072
+ {
1073
+ "type": "null"
1074
+ }
1075
+ ]
1076
+ }
1077
+ },
1078
+ "required": [
1079
+ "enabled"
1080
+ ],
1081
+ "additionalProperties": false
1082
+ }
1083
+ },
1084
+ "required": [
1085
+ "usageType",
1086
+ "keySource"
1087
+ ],
1088
+ "additionalProperties": false
1089
+ }
1090
+ },
1091
+ "required": [
1092
+ "$schema",
1093
+ "metadata",
1094
+ "spec"
1095
+ ],
1096
+ "additionalProperties": false
1097
+ },
730
1098
  {
731
1099
  "type": "object",
732
1100
  "properties": {
@@ -792,6 +1160,7 @@
792
1160
  "attestation",
793
1161
  "trustList",
794
1162
  "statusList",
1163
+ "federation",
795
1164
  "encrypt"
796
1165
  ],
797
1166
  "description": "Key usage category for the imported key chain."
package/templates/schemas/KeyChainCreateDto.schema.json CHANGED
@@ -9,6 +9,7 @@
9
9
  "attestation",
10
10
  "trustList",
11
11
  "statusList",
12
+ "federation",
12
13
  "encrypt"
13
14
  ],
14
15
  "description": "Key usage category for the key chain."
@@ -29,6 +30,15 @@
29
30
  "description": "Optional KMS provider id for key storage operations.",
30
31
  "type": "string"
31
32
  },
33
+ "alg": {
34
+ "description": "Signing algorithm, which also selects the curve: ES256 (P-256), ES384 (P-384) or ES512 (P-521). Must be one of the KMS provider's supportedAlgs; defaults to its defaultAlg. Rotation keeps it.",
35
+ "type": "string",
36
+ "enum": [
37
+ "ES256",
38
+ "ES384",
39
+ "ES512"
40
+ ]
41
+ },
32
42
  "rotationPolicy": {
33
43
  "description": "Optional rotation policy.",
34
44
  "type": "object",
package/templates/schemas/KeyChainImportDto.schema.json CHANGED
@@ -64,6 +64,7 @@
64
64
  "attestation",
65
65
  "trustList",
66
66
  "statusList",
67
+ "federation",
67
68
  "encrypt"
68
69
  ],
69
70
  "description": "Key usage category for the imported key chain."
package/templates/schemas/KmsConfigDto.schema.json CHANGED
@@ -64,6 +64,37 @@
64
64
  "pattern": "^\\$\\{([A-Z0-9_]+)\\}$"
65
65
  }
66
66
  ]
67
+ },
68
+ "algorithms": {
69
+ "description": "Signing algorithms new key chains of this provider may use: ES256 (P-256), ES384 (P-384), ES512 (P-521). Defaults to all three for db, vault and aws-kms. For pkcs11, http and csc, whose backends may not support every curve, it defaults to defaultAlgorithm (ES256 unless set). Existing keys keep signing with their own algorithm.",
70
+ "examples": [
71
+ [
72
+ "ES256",
73
+ "ES384"
74
+ ]
75
+ ],
76
+ "minItems": 1,
77
+ "type": "array",
78
+ "items": {
79
+ "type": "string",
80
+ "enum": [
81
+ "ES256",
82
+ "ES384",
83
+ "ES512"
84
+ ]
85
+ }
86
+ },
87
+ "defaultAlgorithm": {
88
+ "description": "Algorithm used when a key chain is created without one. Must be in algorithms. Defaults to ES256 if allowed, otherwise the first entry of algorithms.",
89
+ "examples": [
90
+ "ES256"
91
+ ],
92
+ "type": "string",
93
+ "enum": [
94
+ "ES256",
95
+ "ES384",
96
+ "ES512"
97
+ ]
67
98
  }
68
99
  },
69
100
  "required": [
@@ -115,6 +146,37 @@
115
146
  }
116
147
  ]
117
148
  },
149
+ "algorithms": {
150
+ "description": "Signing algorithms new key chains of this provider may use: ES256 (P-256), ES384 (P-384), ES512 (P-521). Defaults to all three for db, vault and aws-kms. For pkcs11, http and csc, whose backends may not support every curve, it defaults to defaultAlgorithm (ES256 unless set). Existing keys keep signing with their own algorithm.",
151
+ "examples": [
152
+ [
153
+ "ES256",
154
+ "ES384"
155
+ ]
156
+ ],
157
+ "minItems": 1,
158
+ "type": "array",
159
+ "items": {
160
+ "type": "string",
161
+ "enum": [
162
+ "ES256",
163
+ "ES384",
164
+ "ES512"
165
+ ]
166
+ }
167
+ },
168
+ "defaultAlgorithm": {
169
+ "description": "Algorithm used when a key chain is created without one. Must be in algorithms. Defaults to ES256 if allowed, otherwise the first entry of algorithms.",
170
+ "examples": [
171
+ "ES256"
172
+ ],
173
+ "type": "string",
174
+ "enum": [
175
+ "ES256",
176
+ "ES384",
177
+ "ES512"
178
+ ]
179
+ },
118
180
  "vaultUrl": {
119
181
  "anyOf": [
120
182
  {
@@ -199,6 +261,37 @@
199
261
  }
200
262
  ]
201
263
  },
264
+ "algorithms": {
265
+ "description": "Signing algorithms new key chains of this provider may use: ES256 (P-256), ES384 (P-384), ES512 (P-521). Defaults to all three for db, vault and aws-kms. For pkcs11, http and csc, whose backends may not support every curve, it defaults to defaultAlgorithm (ES256 unless set). Existing keys keep signing with their own algorithm.",
266
+ "examples": [
267
+ [
268
+ "ES256",
269
+ "ES384"
270
+ ]
271
+ ],
272
+ "minItems": 1,
273
+ "type": "array",
274
+ "items": {
275
+ "type": "string",
276
+ "enum": [
277
+ "ES256",
278
+ "ES384",
279
+ "ES512"
280
+ ]
281
+ }
282
+ },
283
+ "defaultAlgorithm": {
284
+ "description": "Algorithm used when a key chain is created without one. Must be in algorithms. Defaults to ES256 if allowed, otherwise the first entry of algorithms.",
285
+ "examples": [
286
+ "ES256"
287
+ ],
288
+ "type": "string",
289
+ "enum": [
290
+ "ES256",
291
+ "ES384",
292
+ "ES512"
293
+ ]
294
+ },
202
295
  "region": {
203
296
  "anyOf": [
204
297
  {
@@ -298,6 +391,37 @@
298
391
  }
299
392
  ]
300
393
  },
394
+ "algorithms": {
395
+ "description": "Signing algorithms new key chains of this provider may use: ES256 (P-256), ES384 (P-384), ES512 (P-521). Defaults to all three for db, vault and aws-kms. For pkcs11, http and csc, whose backends may not support every curve, it defaults to defaultAlgorithm (ES256 unless set). Existing keys keep signing with their own algorithm.",
396
+ "examples": [
397
+ [
398
+ "ES256",
399
+ "ES384"
400
+ ]
401
+ ],
402
+ "minItems": 1,
403
+ "type": "array",
404
+ "items": {
405
+ "type": "string",
406
+ "enum": [
407
+ "ES256",
408
+ "ES384",
409
+ "ES512"
410
+ ]
411
+ }
412
+ },
413
+ "defaultAlgorithm": {
414
+ "description": "Algorithm used when a key chain is created without one. Must be in algorithms. Defaults to ES256 if allowed, otherwise the first entry of algorithms.",
415
+ "examples": [
416
+ "ES256"
417
+ ],
418
+ "type": "string",
419
+ "enum": [
420
+ "ES256",
421
+ "ES384",
422
+ "ES512"
423
+ ]
424
+ },
301
425
  "library": {
302
426
  "anyOf": [
303
427
  {
@@ -400,6 +524,37 @@
400
524
  }
401
525
  ]
402
526
  },
527
+ "algorithms": {
528
+ "description": "Signing algorithms new key chains of this provider may use: ES256 (P-256), ES384 (P-384), ES512 (P-521). Defaults to all three for db, vault and aws-kms. For pkcs11, http and csc, whose backends may not support every curve, it defaults to defaultAlgorithm (ES256 unless set). Existing keys keep signing with their own algorithm.",
529
+ "examples": [
530
+ [
531
+ "ES256",
532
+ "ES384"
533
+ ]
534
+ ],
535
+ "minItems": 1,
536
+ "type": "array",
537
+ "items": {
538
+ "type": "string",
539
+ "enum": [
540
+ "ES256",
541
+ "ES384",
542
+ "ES512"
543
+ ]
544
+ }
545
+ },
546
+ "defaultAlgorithm": {
547
+ "description": "Algorithm used when a key chain is created without one. Must be in algorithms. Defaults to ES256 if allowed, otherwise the first entry of algorithms.",
548
+ "examples": [
549
+ "ES256"
550
+ ],
551
+ "type": "string",
552
+ "enum": [
553
+ "ES256",
554
+ "ES384",
555
+ "ES512"
556
+ ]
557
+ },
403
558
  "baseUrl": {
404
559
  "anyOf": [
405
560
  {
@@ -713,6 +868,37 @@
713
868
  }
714
869
  ]
715
870
  },
871
+ "algorithms": {
872
+ "description": "Signing algorithms new key chains of this provider may use: ES256 (P-256), ES384 (P-384), ES512 (P-521). Defaults to all three for db, vault and aws-kms. For pkcs11, http and csc, whose backends may not support every curve, it defaults to defaultAlgorithm (ES256 unless set). Existing keys keep signing with their own algorithm.",
873
+ "examples": [
874
+ [
875
+ "ES256",
876
+ "ES384"
877
+ ]
878
+ ],
879
+ "minItems": 1,
880
+ "type": "array",
881
+ "items": {
882
+ "type": "string",
883
+ "enum": [
884
+ "ES256",
885
+ "ES384",
886
+ "ES512"
887
+ ]
888
+ }
889
+ },
890
+ "defaultAlgorithm": {
891
+ "description": "Algorithm used when a key chain is created without one. Must be in algorithms. Defaults to ES256 if allowed, otherwise the first entry of algorithms.",
892
+ "examples": [
893
+ "ES256"
894
+ ],
895
+ "type": "string",
896
+ "enum": [
897
+ "ES256",
898
+ "ES384",
899
+ "ES512"
900
+ ]
901
+ },
716
902
  "baseUrl": {
717
903
  "anyOf": [
718
904
  {