@eudiplo/cli 9.1.0-main.cd87b41 → 9.1.0-main.d547bae

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (14) hide show
  1. package/dist/commands/config/portability/migrations.spec.js +2 -1
  2. package/dist/commands/config/portability/migrations.spec.js.map +1 -1
  3. package/dist/commands/config/tenant/action.d.ts.map +1 -1
  4. package/dist/commands/config/tenant/action.js +2 -1
  5. package/dist/commands/config/tenant/action.js.map +1 -1
  6. package/dist/index.js +1380 -94
  7. package/package.json +1 -1
  8. package/templates/schemas/CreateTenantDto.schema.json +2 -2
  9. package/templates/schemas/IssuanceConfig.schema.json +3 -8
  10. package/templates/schemas/IssuanceConfigFile.schema.json +814 -1
  11. package/templates/schemas/KeyChainConfigFile.schema.json +371 -1
  12. package/templates/schemas/KeyChainCreateDto.schema.json +1 -0
  13. package/templates/schemas/KeyChainDefaultsConfigFile.schema.json +58 -0
  14. package/templates/schemas/KeyChainImportDto.schema.json +1 -0
package/dist/index.js CHANGED
@@ -21768,11 +21768,11 @@ var CONFIG_FORMATS = {
21768
21768
  Tenant: { slug: "tenant", file: "TenantConfigFile", version: 4 },
21769
21769
  Client: { slug: "client", file: "ClientConfigFile", version: 2 },
21770
21770
  KmsConfig: { slug: "kms-config", file: "KmsConfigFile", version: 2 },
21771
- KeyChain: { slug: "key-chain", file: "KeyChainConfigFile", version: 3 },
21771
+ KeyChain: { slug: "key-chain", file: "KeyChainConfigFile", version: 4 },
21772
21772
  KeyChainDefaults: {
21773
21773
  slug: "key-chain-defaults",
21774
21774
  file: "KeyChainDefaultsConfigFile",
21775
- version: 1
21775
+ version: 2
21776
21776
  },
21777
21777
  RegistrarConfig: {
21778
21778
  slug: "registrar-config",
@@ -21782,7 +21782,7 @@ var CONFIG_FORMATS = {
21782
21782
  IssuanceConfig: {
21783
21783
  slug: "issuance-config",
21784
21784
  file: "IssuanceConfigFile",
21785
- version: 5
21785
+ version: 6
21786
21786
  },
21787
21787
  CredentialConfig: {
21788
21788
  slug: "credential-config",
@@ -21839,12 +21839,16 @@ function resourceId(input) {
21839
21839
  }
21840
21840
  function bareFileVersion(kind, spec) {
21841
21841
  if (kind === "KeyChain") {
21842
+ if (spec.usageType === "accessToken")
21843
+ return 4;
21842
21844
  if (spec.usageType === "federation")
21843
21845
  return 3;
21844
21846
  return "type" in spec ? 2 : 1;
21845
21847
  }
21846
21848
  if (kind === "RegistrarConfig")
21847
21849
  return "relyingPartyContact" in spec ? 2 : 1;
21850
+ if (kind === "KeyChainDefaults")
21851
+ return "accessToken" in spec ? 2 : 1;
21848
21852
  if (kind === "Tenant") {
21849
21853
  if ("defaultKeyChains" in spec)
21850
21854
  return 3;
@@ -21881,6 +21885,7 @@ var issuanceConfigV4ToV5 = {
21881
21885
  };
21882
21886
  }
21883
21887
  };
21888
+ var TENANT_ID_PATTERN = /^[a-z0-9][a-z0-9_-]{0,62}$/;
21884
21889
  function federationEntityIdProblem(entityId, options) {
21885
21890
  const value = `federation.entityId '${JSON.stringify(entityId).slice(1, -1)}'`;
21886
21891
  if (/[\s\u0000-\u001f\u007f]/.test(entityId)) {
@@ -21930,6 +21935,37 @@ var presentationConfigV1ToV2 = {
21930
21935
  };
21931
21936
  }
21932
21937
  };
21938
+ var issuanceConfigV5ToV6 = {
21939
+ id: "issuance-config-v6-access-token-signing-key",
21940
+ kind: "IssuanceConfig",
21941
+ from: 5,
21942
+ to: 6,
21943
+ migrate(spec) {
21944
+ const issues = [];
21945
+ const { signingKeyId, ...rest } = spec;
21946
+ if (typeof signingKeyId === "string" && signingKeyId !== "") {
21947
+ issues.push({
21948
+ severity: "warning",
21949
+ code: "ISSUANCE_SIGNING_KEY_ID_REMOVED",
21950
+ path: "/spec/signingKeyId",
21951
+ message: `signingKeyId ${JSON.stringify(signingKeyId)} was removed. The built-in authorization server now signs access tokens with the tenant's access token key chain (usage type "accessToken"); to choose one, set token.signingKeyId of its entry.`
21952
+ });
21953
+ }
21954
+ const servers = Array.isArray(rest.authorizationServers) ? rest.authorizationServers : [];
21955
+ servers.forEach((server, index) => {
21956
+ const keyChainId = object(server) && object(server.token) ? server.token.signingKeyId : void 0;
21957
+ if (typeof keyChainId !== "string" || keyChainId === "")
21958
+ return;
21959
+ issues.push({
21960
+ severity: "warning",
21961
+ code: "ACCESS_TOKEN_KEY_CHAIN_REQUIRED",
21962
+ path: `/spec/authorizationServers/${index}/token/signingKeyId`,
21963
+ message: `token.signingKeyId ${JSON.stringify(keyChainId)} must name a key chain with usage type "accessToken" from now on, else the import is refused. Remove it to use the tenant's access token key chain, or point it to such a key chain.`
21964
+ });
21965
+ });
21966
+ return { spec: "signingKeyId" in spec ? rest : spec, issues };
21967
+ }
21968
+ };
21933
21969
  var tenantConfigV3ToV4 = {
21934
21970
  id: "tenant-v4-key-chain-defaults",
21935
21971
  kind: "Tenant",
@@ -22017,6 +22053,7 @@ var CONFIG_MIGRATIONS = [
22017
22053
  migrate: (spec) => ({ spec })
22018
22054
  },
22019
22055
  issuanceConfigV4ToV5,
22056
+ issuanceConfigV5ToV6,
22020
22057
  {
22021
22058
  id: "client-v2-read-and-status-roles",
22022
22059
  kind: "Client",
@@ -22094,6 +22131,25 @@ var CONFIG_MIGRATIONS = [
22094
22131
  // spec.
22095
22132
  migrate: (spec) => ({ spec })
22096
22133
  },
22134
+ {
22135
+ id: "key-chain-v4-access-token-usage",
22136
+ kind: "KeyChain",
22137
+ from: 3,
22138
+ to: 4,
22139
+ // v4 only adds the usage type `accessToken`: a v3 spec is a valid v4
22140
+ // spec.
22141
+ migrate: (spec) => ({ spec })
22142
+ },
22143
+ {
22144
+ id: "key-chain-defaults-v2-access-token",
22145
+ kind: "KeyChainDefaults",
22146
+ from: 1,
22147
+ to: 2,
22148
+ // v2 only adds the optional accessToken entry: a v1 spec is a valid
22149
+ // v2 spec, whose tenant keeps using its oldest access token key
22150
+ // chain.
22151
+ migrate: (spec) => ({ spec })
22152
+ },
22097
22153
  {
22098
22154
  id: "credential-config-v2-x509-trusted-authority",
22099
22155
  kind: "CredentialConfig",
@@ -29343,6 +29399,59 @@ var CONFIG_SCHEMAS = [
29343
29399
  ],
29344
29400
  "additionalProperties": false
29345
29401
  },
29402
+ {
29403
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
29404
+ "$id": "https://eudiplo.dev/schemas/v2/KeyChainDefaultsConfigFile.schema.json",
29405
+ "title": "KeyChainDefaultsConfigFile",
29406
+ "type": "object",
29407
+ "properties": {
29408
+ "$schema": {
29409
+ "type": "string",
29410
+ "const": "https://eudiplo.dev/schemas/v2/KeyChainDefaultsConfigFile.schema.json"
29411
+ },
29412
+ "metadata": {
29413
+ "type": "object",
29414
+ "properties": {
29415
+ "generation": {
29416
+ "type": "integer",
29417
+ "minimum": 1,
29418
+ "maximum": 9007199254740991
29419
+ },
29420
+ "ownership": {
29421
+ "type": "string",
29422
+ "enum": [
29423
+ "unmanaged",
29424
+ "file-managed"
29425
+ ]
29426
+ }
29427
+ },
29428
+ "additionalProperties": false
29429
+ },
29430
+ "spec": {
29431
+ "type": "object",
29432
+ "properties": {
29433
+ "access": {
29434
+ "description": "ID of the access key chain used where no configuration names one: presentation requests of configurations without accessKeyChainId and the signed issuer metadata. Without it, EUDIPLO picks one of the tenant's access key chains by rule.",
29435
+ "type": "string",
29436
+ "minLength": 1
29437
+ },
29438
+ "accessToken": {
29439
+ "description": "ID of the access token key chain (usage type accessToken) that signs the access tokens of authorization servers without token.signingKeyId and is published in their JWKS. Without it, EUDIPLO uses the tenant's oldest access token key chain and creates one with ID access-token when the tenant has none.",
29440
+ "type": "string",
29441
+ "minLength": 1
29442
+ }
29443
+ },
29444
+ "additionalProperties": false,
29445
+ "description": "The tenant's key chain per usage type, used where no configuration names one. A usage type without an entry uses a key chain picked by rule."
29446
+ }
29447
+ },
29448
+ "required": [
29449
+ "$schema",
29450
+ "metadata",
29451
+ "spec"
29452
+ ],
29453
+ "additionalProperties": false
29454
+ },
29346
29455
  {
29347
29456
  "$schema": "https://json-schema.org/draft/2020-12/schema",
29348
29457
  "$id": "https://eudiplo.dev/schemas/v2/KmsConfigFile.schema.json",
@@ -35245,13 +35354,13 @@ var CONFIG_SCHEMAS = [
35245
35354
  },
35246
35355
  {
35247
35356
  "$schema": "https://json-schema.org/draft/2020-12/schema",
35248
- "$id": "https://eudiplo.dev/schemas/v4/TenantConfigFile.schema.json",
35249
- "title": "TenantConfigFile",
35357
+ "$id": "https://eudiplo.dev/schemas/v4/KeyChainConfigFile.schema.json",
35358
+ "title": "KeyChainConfigFile",
35250
35359
  "type": "object",
35251
35360
  "properties": {
35252
35361
  "$schema": {
35253
35362
  "type": "string",
35254
- "const": "https://eudiplo.dev/schemas/v4/TenantConfigFile.schema.json"
35363
+ "const": "https://eudiplo.dev/schemas/v4/KeyChainConfigFile.schema.json"
35255
35364
  },
35256
35365
  "metadata": {
35257
35366
  "type": "object",
@@ -35274,110 +35383,1292 @@ var CONFIG_SCHEMAS = [
35274
35383
  "spec": {
35275
35384
  "type": "object",
35276
35385
  "properties": {
35277
- "name": {
35278
- "default": "EUDIPLO",
35279
- "description": "Display name of the tenant.",
35280
- "type": "string",
35281
- "minLength": 1
35386
+ "id": {
35387
+ "type": "string"
35282
35388
  },
35283
35389
  "description": {
35284
- "description": "Optional tenant description.",
35390
+ "type": "string"
35391
+ },
35392
+ "usageType": {
35285
35393
  "type": "string",
35286
- "minLength": 1
35394
+ "enum": [
35395
+ "access",
35396
+ "accessToken",
35397
+ "attestation",
35398
+ "trustList",
35399
+ "statusList",
35400
+ "federation",
35401
+ "encrypt"
35402
+ ]
35287
35403
  },
35288
- "sessionConfig": {
35289
- "description": "Optional tenant-specific session storage configuration.",
35290
- "type": "object",
35291
- "properties": {
35292
- "ttlSeconds": {
35293
- "description": "Session time-to-live in seconds.",
35294
- "type": "integer",
35295
- "minimum": 60,
35296
- "maximum": 9007199254740991
35297
- },
35298
- "cleanupMode": {
35299
- "description": "Whether to fully delete or anonymize expired sessions.",
35300
- "type": "string",
35301
- "enum": [
35302
- "full",
35303
- "anonymize"
35304
- ]
35305
- }
35306
- },
35307
- "additionalProperties": false
35404
+ "type": {
35405
+ "description": "Key chain type. For a `private-jwk` key source without `activeJwk`, `standalone` makes `jwk` the signing key and `crt` its chain, leaf first; `internalChain` makes `jwk` a CA key and the last `crt` entry its CA certificate (created if `crt` is omitted), and the import generates a new signing key with a certificate issued by it. Without `type`, `jwk` is a CA key only if `rotationPolicy.enabled` is true and `crt` is not a single self-signed certificate that is not a CA. For `regenerate`, it is the type of the new key chain and must equal `keySource.keyChainType` if both are set. For the other key sources, it must match the key chain they describe.",
35406
+ "type": "string",
35407
+ "enum": [
35408
+ "standalone",
35409
+ "internalChain"
35410
+ ]
35308
35411
  },
35309
- "statusListConfig": {
35310
- "description": "Optional tenant-specific status list defaults.",
35311
- "type": "object",
35312
- "properties": {
35313
- "capacity": {
35314
- "description": "Default status list capacity.",
35315
- "type": "integer",
35316
- "minimum": 100,
35317
- "maximum": 9007199254740991
35318
- },
35319
- "bits": {
35320
- "description": "Bits-per-status setting (1, 2, 4, or 8).",
35321
- "anyOf": [
35322
- {
35323
- "type": "number",
35324
- "const": 1
35325
- },
35326
- {
35327
- "type": "number",
35328
- "const": 2
35412
+ "keySource": {
35413
+ "oneOf": [
35414
+ {
35415
+ "type": "object",
35416
+ "properties": {
35417
+ "type": {
35418
+ "type": "string",
35419
+ "const": "private-jwk"
35329
35420
  },
35330
- {
35331
- "type": "number",
35332
- "const": 4
35421
+ "jwk": {
35422
+ "type": "object",
35423
+ "properties": {
35424
+ "kty": {
35425
+ "type": "string",
35426
+ "description": "Key type (for example EC)."
35427
+ },
35428
+ "x": {
35429
+ "type": "string",
35430
+ "description": "Elliptic curve public x coordinate."
35431
+ },
35432
+ "y": {
35433
+ "type": "string",
35434
+ "description": "Elliptic curve public y coordinate."
35435
+ },
35436
+ "crv": {
35437
+ "type": "string",
35438
+ "description": "Elliptic curve name."
35439
+ },
35440
+ "d": {
35441
+ "type": "string",
35442
+ "description": "Private key value."
35443
+ },
35444
+ "alg": {
35445
+ "description": "Optional algorithm hint.",
35446
+ "type": "string"
35447
+ },
35448
+ "kid": {
35449
+ "description": "Optional key identifier.",
35450
+ "type": "string"
35451
+ }
35452
+ },
35453
+ "required": [
35454
+ "kty",
35455
+ "x",
35456
+ "y",
35457
+ "crv",
35458
+ "d"
35459
+ ],
35460
+ "additionalProperties": false
35333
35461
  },
35334
- {
35335
- "type": "number",
35336
- "const": 8
35462
+ "activeJwk": {
35463
+ "type": "object",
35464
+ "properties": {
35465
+ "kty": {
35466
+ "type": "string",
35467
+ "description": "Key type (for example EC)."
35468
+ },
35469
+ "x": {
35470
+ "type": "string",
35471
+ "description": "Elliptic curve public x coordinate."
35472
+ },
35473
+ "y": {
35474
+ "type": "string",
35475
+ "description": "Elliptic curve public y coordinate."
35476
+ },
35477
+ "crv": {
35478
+ "type": "string",
35479
+ "description": "Elliptic curve name."
35480
+ },
35481
+ "d": {
35482
+ "type": "string",
35483
+ "description": "Private key value."
35484
+ },
35485
+ "alg": {
35486
+ "description": "Optional algorithm hint.",
35487
+ "type": "string"
35488
+ },
35489
+ "kid": {
35490
+ "description": "Optional key identifier.",
35491
+ "type": "string"
35492
+ }
35493
+ },
35494
+ "required": [
35495
+ "kty",
35496
+ "x",
35497
+ "y",
35498
+ "crv",
35499
+ "d"
35500
+ ],
35501
+ "additionalProperties": false
35337
35502
  }
35338
- ]
35339
- },
35340
- "ttl": {
35341
- "description": "JWT TTL for status list tokens in seconds.",
35342
- "type": "integer",
35343
- "minimum": 60,
35344
- "maximum": 9007199254740991
35503
+ },
35504
+ "required": [
35505
+ "type",
35506
+ "jwk"
35507
+ ],
35508
+ "additionalProperties": false
35345
35509
  },
35346
- "immediateUpdate": {
35347
- "description": "Regenerate status list JWTs immediately after status updates.",
35510
+ {
35511
+ "type": "object",
35512
+ "properties": {
35513
+ "type": {
35514
+ "type": "string",
35515
+ "const": "external-reference"
35516
+ },
35517
+ "provider": {
35518
+ "type": "string"
35519
+ },
35520
+ "externalKeyId": {
35521
+ "type": "string"
35522
+ },
35523
+ "publicJwk": {
35524
+ "type": "object",
35525
+ "properties": {
35526
+ "kty": {
35527
+ "type": "string"
35528
+ },
35529
+ "x": {
35530
+ "type": "string"
35531
+ },
35532
+ "y": {
35533
+ "type": "string"
35534
+ },
35535
+ "crv": {
35536
+ "type": "string"
35537
+ },
35538
+ "alg": {
35539
+ "type": "string"
35540
+ },
35541
+ "kid": {
35542
+ "type": "string"
35543
+ }
35544
+ },
35545
+ "required": [
35546
+ "kty",
35547
+ "x",
35548
+ "y",
35549
+ "crv"
35550
+ ],
35551
+ "additionalProperties": false
35552
+ },
35553
+ "activeExternalKeyId": {
35554
+ "type": "string"
35555
+ },
35556
+ "activePublicJwk": {
35557
+ "type": "object",
35558
+ "properties": {
35559
+ "kty": {
35560
+ "type": "string"
35561
+ },
35562
+ "x": {
35563
+ "type": "string"
35564
+ },
35565
+ "y": {
35566
+ "type": "string"
35567
+ },
35568
+ "crv": {
35569
+ "type": "string"
35570
+ },
35571
+ "alg": {
35572
+ "type": "string"
35573
+ },
35574
+ "kid": {
35575
+ "type": "string"
35576
+ }
35577
+ },
35578
+ "required": [
35579
+ "kty",
35580
+ "x",
35581
+ "y",
35582
+ "crv"
35583
+ ],
35584
+ "additionalProperties": false
35585
+ }
35586
+ },
35587
+ "required": [
35588
+ "type",
35589
+ "provider",
35590
+ "externalKeyId",
35591
+ "publicJwk"
35592
+ ],
35593
+ "additionalProperties": false
35594
+ },
35595
+ {
35596
+ "type": "object",
35597
+ "properties": {
35598
+ "type": {
35599
+ "type": "string",
35600
+ "const": "required"
35601
+ },
35602
+ "publicJwk": {
35603
+ "type": "object",
35604
+ "properties": {
35605
+ "kty": {
35606
+ "type": "string"
35607
+ },
35608
+ "x": {
35609
+ "type": "string"
35610
+ },
35611
+ "y": {
35612
+ "type": "string"
35613
+ },
35614
+ "crv": {
35615
+ "type": "string"
35616
+ },
35617
+ "alg": {
35618
+ "type": "string"
35619
+ },
35620
+ "kid": {
35621
+ "type": "string"
35622
+ }
35623
+ },
35624
+ "required": [
35625
+ "kty",
35626
+ "x",
35627
+ "y",
35628
+ "crv"
35629
+ ],
35630
+ "additionalProperties": false
35631
+ }
35632
+ },
35633
+ "required": [
35634
+ "type"
35635
+ ],
35636
+ "additionalProperties": false
35637
+ },
35638
+ {
35639
+ "type": "object",
35640
+ "properties": {
35641
+ "type": {
35642
+ "type": "string",
35643
+ "const": "regenerate"
35644
+ },
35645
+ "keyChainType": {
35646
+ "type": "string",
35647
+ "enum": [
35648
+ "standalone",
35649
+ "internalChain"
35650
+ ]
35651
+ }
35652
+ },
35653
+ "required": [
35654
+ "type"
35655
+ ],
35656
+ "additionalProperties": false
35657
+ }
35658
+ ]
35659
+ },
35660
+ "crt": {
35661
+ "type": "array",
35662
+ "items": {
35663
+ "type": "string"
35664
+ }
35665
+ },
35666
+ "activeCertificate": {
35667
+ "description": "Active certificate for an internal key chain.",
35668
+ "type": "string"
35669
+ },
35670
+ "kmsProvider": {
35671
+ "type": "string"
35672
+ },
35673
+ "rotationPolicy": {
35674
+ "type": "object",
35675
+ "properties": {
35676
+ "enabled": {
35348
35677
  "type": "boolean"
35349
35678
  },
35350
- "enableAggregation": {
35351
- "description": "Include aggregation_uri in generated status list JWTs.",
35352
- "type": "boolean"
35679
+ "intervalDays": {
35680
+ "anyOf": [
35681
+ {
35682
+ "type": "number",
35683
+ "minimum": 1,
35684
+ "maximum": 3650
35685
+ },
35686
+ {
35687
+ "type": "null"
35688
+ }
35689
+ ]
35690
+ },
35691
+ "certValidityDays": {
35692
+ "anyOf": [
35693
+ {
35694
+ "type": "number",
35695
+ "minimum": 1,
35696
+ "maximum": 3650
35697
+ },
35698
+ {
35699
+ "type": "null"
35700
+ }
35701
+ ]
35702
+ }
35703
+ },
35704
+ "required": [
35705
+ "enabled"
35706
+ ],
35707
+ "additionalProperties": false
35708
+ }
35709
+ },
35710
+ "required": [
35711
+ "usageType",
35712
+ "keySource"
35713
+ ],
35714
+ "additionalProperties": false
35715
+ }
35716
+ },
35717
+ "required": [
35718
+ "$schema",
35719
+ "metadata",
35720
+ "spec"
35721
+ ],
35722
+ "additionalProperties": false
35723
+ },
35724
+ {
35725
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
35726
+ "$id": "https://eudiplo.dev/schemas/v4/TenantConfigFile.schema.json",
35727
+ "title": "TenantConfigFile",
35728
+ "type": "object",
35729
+ "properties": {
35730
+ "$schema": {
35731
+ "type": "string",
35732
+ "const": "https://eudiplo.dev/schemas/v4/TenantConfigFile.schema.json"
35733
+ },
35734
+ "metadata": {
35735
+ "type": "object",
35736
+ "properties": {
35737
+ "generation": {
35738
+ "type": "integer",
35739
+ "minimum": 1,
35740
+ "maximum": 9007199254740991
35741
+ },
35742
+ "ownership": {
35743
+ "type": "string",
35744
+ "enum": [
35745
+ "unmanaged",
35746
+ "file-managed"
35747
+ ]
35748
+ }
35749
+ },
35750
+ "additionalProperties": false
35751
+ },
35752
+ "spec": {
35753
+ "type": "object",
35754
+ "properties": {
35755
+ "name": {
35756
+ "default": "EUDIPLO",
35757
+ "description": "Display name of the tenant.",
35758
+ "type": "string",
35759
+ "minLength": 1
35760
+ },
35761
+ "description": {
35762
+ "description": "Optional tenant description.",
35763
+ "type": "string",
35764
+ "minLength": 1
35765
+ },
35766
+ "sessionConfig": {
35767
+ "description": "Optional tenant-specific session storage configuration.",
35768
+ "type": "object",
35769
+ "properties": {
35770
+ "ttlSeconds": {
35771
+ "description": "Session time-to-live in seconds.",
35772
+ "type": "integer",
35773
+ "minimum": 60,
35774
+ "maximum": 9007199254740991
35775
+ },
35776
+ "cleanupMode": {
35777
+ "description": "Whether to fully delete or anonymize expired sessions.",
35778
+ "type": "string",
35779
+ "enum": [
35780
+ "full",
35781
+ "anonymize"
35782
+ ]
35783
+ }
35784
+ },
35785
+ "additionalProperties": false
35786
+ },
35787
+ "statusListConfig": {
35788
+ "description": "Optional tenant-specific status list defaults.",
35789
+ "type": "object",
35790
+ "properties": {
35791
+ "capacity": {
35792
+ "description": "Default status list capacity.",
35793
+ "type": "integer",
35794
+ "minimum": 100,
35795
+ "maximum": 9007199254740991
35796
+ },
35797
+ "bits": {
35798
+ "description": "Bits-per-status setting (1, 2, 4, or 8).",
35799
+ "anyOf": [
35800
+ {
35801
+ "type": "number",
35802
+ "const": 1
35803
+ },
35804
+ {
35805
+ "type": "number",
35806
+ "const": 2
35807
+ },
35808
+ {
35809
+ "type": "number",
35810
+ "const": 4
35811
+ },
35812
+ {
35813
+ "type": "number",
35814
+ "const": 8
35815
+ }
35816
+ ]
35817
+ },
35818
+ "ttl": {
35819
+ "description": "JWT TTL for status list tokens in seconds.",
35820
+ "type": "integer",
35821
+ "minimum": 60,
35822
+ "maximum": 9007199254740991
35823
+ },
35824
+ "immediateUpdate": {
35825
+ "description": "Regenerate status list JWTs immediately after status updates.",
35826
+ "type": "boolean"
35827
+ },
35828
+ "enableAggregation": {
35829
+ "description": "Include aggregation_uri in generated status list JWTs.",
35830
+ "type": "boolean"
35831
+ }
35832
+ },
35833
+ "additionalProperties": false
35834
+ }
35835
+ },
35836
+ "required": [
35837
+ "name"
35838
+ ],
35839
+ "additionalProperties": false,
35840
+ "description": "Payload used when importing tenant metadata from config files."
35841
+ }
35842
+ },
35843
+ "required": [
35844
+ "$schema",
35845
+ "metadata",
35846
+ "spec"
35847
+ ],
35848
+ "additionalProperties": false
35849
+ },
35850
+ {
35851
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
35852
+ "$id": "https://eudiplo.dev/schemas/v5/IssuanceConfigFile.schema.json",
35853
+ "title": "IssuanceConfigFile",
35854
+ "type": "object",
35855
+ "properties": {
35856
+ "$schema": {
35857
+ "type": "string",
35858
+ "const": "https://eudiplo.dev/schemas/v5/IssuanceConfigFile.schema.json"
35859
+ },
35860
+ "metadata": {
35861
+ "type": "object",
35862
+ "properties": {
35863
+ "generation": {
35864
+ "type": "integer",
35865
+ "minimum": 1,
35866
+ "description": "Monotonically increasing configuration generation."
35867
+ },
35868
+ "ownership": {
35869
+ "type": "string",
35870
+ "enum": [
35871
+ "unmanaged",
35872
+ "file-managed"
35873
+ ],
35874
+ "description": "Requested ownership recorded when the document is applied."
35875
+ }
35876
+ },
35877
+ "additionalProperties": false
35878
+ },
35879
+ "spec": {
35880
+ "$ref": "#/$defs/IssuanceConfig"
35881
+ }
35882
+ },
35883
+ "required": [
35884
+ "$schema",
35885
+ "spec"
35886
+ ],
35887
+ "additionalProperties": false,
35888
+ "$defs": {
35889
+ "IssuanceConfig": {
35890
+ "type": "object",
35891
+ "properties": {
35892
+ "batchSize": {
35893
+ "description": "Optional issuance batch size.",
35894
+ "type": "integer",
35895
+ "minimum": 1,
35896
+ "maximum": 9007199254740991
35897
+ },
35898
+ "dPopRequired": {
35899
+ "description": "Require DPoP proofs for issuance endpoints.",
35900
+ "type": "boolean"
35901
+ },
35902
+ "walletAttestationRequired": {
35903
+ "description": "Default wallet attestation requirement for managed authorization servers.",
35904
+ "type": "boolean"
35905
+ },
35906
+ "walletProviderTrustLists": {
35907
+ "description": "Shared wallet provider trust lists for key attestations and default authorization server wallet authentication.",
35908
+ "type": "array",
35909
+ "items": {
35910
+ "type": "object",
35911
+ "properties": {
35912
+ "trustListId": {
35913
+ "type": "string",
35914
+ "minLength": 1
35915
+ },
35916
+ "url": {
35917
+ "description": "URL of the wallet provider trust list.",
35918
+ "type": "string",
35919
+ "format": "uri"
35920
+ },
35921
+ "verifierKey": {
35922
+ "description": "Optional verifier key material used for trust list verification.",
35923
+ "type": "object",
35924
+ "propertyNames": {
35925
+ "type": "string"
35926
+ },
35927
+ "additionalProperties": {}
35928
+ },
35929
+ "verifierKeyPem": {
35930
+ "description": "Optional verifier public key in SPKI PEM form (-----BEGIN PUBLIC KEY-----).",
35931
+ "type": "string",
35932
+ "pattern": "^\\s*-----BEGIN PUBLIC KEY-----[A-Za-z0-9+/=\\s]+-----END PUBLIC KEY-----\\s*$"
35933
+ },
35934
+ "verifierX509Der": {
35935
+ "description": "Optional verifier certificate in DER/base64 form.",
35936
+ "type": "string"
35937
+ }
35938
+ },
35939
+ "additionalProperties": false
35940
+ }
35941
+ },
35942
+ "walletAttestationStatusCheckMode": {
35943
+ "description": "Default status check mode for wallet attestations at managed authorization servers: strict, best_effort (default) or disabled.",
35944
+ "anyOf": [
35945
+ {
35946
+ "type": "string",
35947
+ "enum": [
35948
+ "strict",
35949
+ "best_effort",
35950
+ "disabled"
35951
+ ]
35952
+ },
35953
+ {
35954
+ "type": "null"
35955
+ }
35956
+ ]
35957
+ },
35958
+ "signingKeyId": {
35959
+ "description": "Default signing key chain id for credential issuance.",
35960
+ "type": "string",
35961
+ "minLength": 1
35962
+ },
35963
+ "authorizationServers": {
35964
+ "minItems": 1,
35965
+ "type": "array",
35966
+ "items": {
35967
+ "oneOf": [
35968
+ {
35969
+ "type": "object",
35970
+ "properties": {
35971
+ "type": {
35972
+ "type": "string",
35973
+ "const": "external",
35974
+ "description": "Use an externally managed authorization server."
35975
+ },
35976
+ "id": {
35977
+ "type": "string",
35978
+ "minLength": 1,
35979
+ "description": "Authorization server identifier."
35980
+ },
35981
+ "issuer": {
35982
+ "type": "string",
35983
+ "format": "uri",
35984
+ "description": "Issuer URL for the external authorization server."
35985
+ },
35986
+ "sessionBinding": {
35987
+ "description": "Explicit mapping from an external access-token claim to an existing issuance session.",
35988
+ "type": "object",
35989
+ "properties": {
35990
+ "method": {
35991
+ "type": "string",
35992
+ "const": "access_token_claim",
35993
+ "description": "Read the correlation value from a configured access-token claim."
35994
+ },
35995
+ "claim": {
35996
+ "type": "string",
35997
+ "minLength": 1,
35998
+ "description": "Claim name that contains the issuance-session correlation value."
35999
+ }
36000
+ },
36001
+ "required": [
36002
+ "method",
36003
+ "claim"
36004
+ ],
36005
+ "additionalProperties": false
36006
+ },
36007
+ "label": {
36008
+ "description": "Optional display label for UI selection.",
36009
+ "type": "string"
36010
+ },
36011
+ "enabled": {
36012
+ "description": "Whether this authorization server entry is enabled.",
36013
+ "type": "boolean"
36014
+ }
36015
+ },
36016
+ "required": [
36017
+ "type",
36018
+ "id",
36019
+ "issuer"
36020
+ ],
36021
+ "additionalProperties": false
36022
+ },
36023
+ {
36024
+ "type": "object",
36025
+ "properties": {
36026
+ "type": {
36027
+ "type": "string",
36028
+ "const": "oid4vp",
36029
+ "description": "Use OID4VP-based authorization server chaining."
36030
+ },
36031
+ "id": {
36032
+ "type": "string",
36033
+ "minLength": 1,
36034
+ "description": "Authorization server identifier."
36035
+ },
36036
+ "presentationConfigId": {
36037
+ "type": "string",
36038
+ "minLength": 1,
36039
+ "description": "Presentation configuration id used during authorization."
36040
+ },
36041
+ "immediateWalletRedirect": {
36042
+ "description": "Redirect wallets immediately after authorization response creation.",
36043
+ "type": "boolean"
36044
+ },
36045
+ "token": {
36046
+ "description": "Optional token issuance settings.",
36047
+ "type": "object",
36048
+ "properties": {
36049
+ "lifetimeSeconds": {
36050
+ "description": "Access token lifetime in seconds.",
36051
+ "type": "number",
36052
+ "minimum": 60
36053
+ },
36054
+ "signingKeyId": {
36055
+ "description": "Optional key chain id used to sign issued tokens.",
36056
+ "type": "string",
36057
+ "minLength": 1
36058
+ },
36059
+ "refreshTokenEnabled": {
36060
+ "description": "Enable issuing refresh tokens.",
36061
+ "type": "boolean"
36062
+ },
36063
+ "refreshTokenExpiresInSeconds": {
36064
+ "description": "Refresh token lifetime in seconds.",
36065
+ "type": "number",
36066
+ "minimum": 60
36067
+ }
36068
+ },
36069
+ "additionalProperties": false
36070
+ },
36071
+ "requireDPoP": {
36072
+ "description": "Require DPoP proofs for token/credential requests.",
36073
+ "type": "boolean"
36074
+ },
36075
+ "walletAttestationRequired": {
36076
+ "description": "Require wallet attestation for this authorization server.",
36077
+ "type": "boolean"
36078
+ },
36079
+ "walletProviderTrustLists": {
36080
+ "description": "Optional wallet provider trust list references for this authorization server.",
36081
+ "type": "array",
36082
+ "items": {
36083
+ "type": "object",
36084
+ "properties": {
36085
+ "trustListId": {
36086
+ "type": "string",
36087
+ "minLength": 1
36088
+ },
36089
+ "url": {
36090
+ "description": "URL of the wallet provider trust list.",
36091
+ "type": "string",
36092
+ "format": "uri"
36093
+ },
36094
+ "verifierKey": {
36095
+ "description": "Optional verifier key material used for trust list verification.",
36096
+ "type": "object",
36097
+ "propertyNames": {
36098
+ "type": "string"
36099
+ },
36100
+ "additionalProperties": {}
36101
+ },
36102
+ "verifierKeyPem": {
36103
+ "description": "Optional verifier public key in SPKI PEM form (-----BEGIN PUBLIC KEY-----).",
36104
+ "type": "string",
36105
+ "pattern": "^\\s*-----BEGIN PUBLIC KEY-----[A-Za-z0-9+/=\\s]+-----END PUBLIC KEY-----\\s*$"
36106
+ },
36107
+ "verifierX509Der": {
36108
+ "description": "Optional verifier certificate in DER/base64 form.",
36109
+ "type": "string"
36110
+ }
36111
+ },
36112
+ "additionalProperties": false
36113
+ }
36114
+ },
36115
+ "walletAttestationStatusCheckMode": {
36116
+ "description": "Status check mode for wallet attestations at this authorization server. Omit to inherit the issuance default.",
36117
+ "type": "string",
36118
+ "enum": [
36119
+ "strict",
36120
+ "best_effort",
36121
+ "disabled"
36122
+ ]
36123
+ },
36124
+ "label": {
36125
+ "description": "Optional display label for UI selection.",
36126
+ "type": "string"
36127
+ },
36128
+ "enabled": {
36129
+ "description": "Whether this authorization server entry is enabled.",
36130
+ "type": "boolean"
36131
+ }
36132
+ },
36133
+ "required": [
36134
+ "type",
36135
+ "id",
36136
+ "presentationConfigId"
36137
+ ],
36138
+ "additionalProperties": false
36139
+ },
36140
+ {
36141
+ "type": "object",
36142
+ "properties": {
36143
+ "type": {
36144
+ "type": "string",
36145
+ "const": "chained",
36146
+ "description": "Use upstream OIDC as authorization source."
36147
+ },
36148
+ "id": {
36149
+ "type": "string",
36150
+ "minLength": 1,
36151
+ "description": "Authorization server identifier."
36152
+ },
36153
+ "upstream": {
36154
+ "type": "object",
36155
+ "properties": {
36156
+ "issuer": {
36157
+ "type": "string",
36158
+ "format": "uri",
36159
+ "description": "Upstream OIDC issuer URL."
36160
+ },
36161
+ "clientId": {
36162
+ "type": "string",
36163
+ "minLength": 1,
36164
+ "description": "Client id for upstream OIDC authentication."
36165
+ },
36166
+ "clientSecret": {
36167
+ "description": "Optional client secret for upstream OIDC authentication.",
36168
+ "type": "string",
36169
+ "minLength": 1
36170
+ },
36171
+ "scopes": {
36172
+ "description": "Optional scopes requested from the upstream issuer.",
36173
+ "type": "array",
36174
+ "items": {
36175
+ "type": "string",
36176
+ "minLength": 1
36177
+ }
36178
+ }
36179
+ },
36180
+ "required": [
36181
+ "issuer",
36182
+ "clientId"
36183
+ ],
36184
+ "additionalProperties": false,
36185
+ "description": "Upstream OIDC connection settings."
36186
+ },
36187
+ "token": {
36188
+ "description": "Optional token issuance settings.",
36189
+ "type": "object",
36190
+ "properties": {
36191
+ "lifetimeSeconds": {
36192
+ "description": "Access token lifetime in seconds.",
36193
+ "type": "number",
36194
+ "minimum": 60
36195
+ },
36196
+ "signingKeyId": {
36197
+ "description": "Optional key chain id used to sign issued tokens.",
36198
+ "type": "string",
36199
+ "minLength": 1
36200
+ },
36201
+ "refreshTokenEnabled": {
36202
+ "description": "Enable issuing refresh tokens.",
36203
+ "type": "boolean"
36204
+ },
36205
+ "refreshTokenExpiresInSeconds": {
36206
+ "description": "Refresh token lifetime in seconds.",
36207
+ "type": "number",
36208
+ "minimum": 60
36209
+ }
36210
+ },
36211
+ "additionalProperties": false
36212
+ },
36213
+ "requireDPoP": {
36214
+ "description": "Require DPoP proofs for token/credential requests.",
36215
+ "type": "boolean"
36216
+ },
36217
+ "walletAttestationRequired": {
36218
+ "description": "Require wallet attestation for this authorization server.",
36219
+ "type": "boolean"
36220
+ },
36221
+ "walletProviderTrustLists": {
36222
+ "description": "Optional wallet provider trust list references for this authorization server.",
36223
+ "type": "array",
36224
+ "items": {
36225
+ "type": "object",
36226
+ "properties": {
36227
+ "trustListId": {
36228
+ "type": "string",
36229
+ "minLength": 1
36230
+ },
36231
+ "url": {
36232
+ "description": "URL of the wallet provider trust list.",
36233
+ "type": "string",
36234
+ "format": "uri"
36235
+ },
36236
+ "verifierKey": {
36237
+ "description": "Optional verifier key material used for trust list verification.",
36238
+ "type": "object",
36239
+ "propertyNames": {
36240
+ "type": "string"
36241
+ },
36242
+ "additionalProperties": {}
36243
+ },
36244
+ "verifierKeyPem": {
36245
+ "description": "Optional verifier public key in SPKI PEM form (-----BEGIN PUBLIC KEY-----).",
36246
+ "type": "string",
36247
+ "pattern": "^\\s*-----BEGIN PUBLIC KEY-----[A-Za-z0-9+/=\\s]+-----END PUBLIC KEY-----\\s*$"
36248
+ },
36249
+ "verifierX509Der": {
36250
+ "description": "Optional verifier certificate in DER/base64 form.",
36251
+ "type": "string"
36252
+ }
36253
+ },
36254
+ "additionalProperties": false
36255
+ }
36256
+ },
36257
+ "walletAttestationStatusCheckMode": {
36258
+ "description": "Status check mode for wallet attestations at this authorization server. Omit to inherit the issuance default.",
36259
+ "type": "string",
36260
+ "enum": [
36261
+ "strict",
36262
+ "best_effort",
36263
+ "disabled"
36264
+ ]
36265
+ },
36266
+ "label": {
36267
+ "description": "Optional display label for UI selection.",
36268
+ "type": "string"
36269
+ },
36270
+ "enabled": {
36271
+ "description": "Whether this authorization server entry is enabled.",
36272
+ "type": "boolean"
36273
+ }
36274
+ },
36275
+ "required": [
36276
+ "type",
36277
+ "id",
36278
+ "upstream"
36279
+ ],
36280
+ "additionalProperties": false
36281
+ },
36282
+ {
36283
+ "type": "object",
36284
+ "properties": {
36285
+ "type": {
36286
+ "type": "string",
36287
+ "const": "built-in",
36288
+ "description": "Use EUDIPLO built-in authorization server."
36289
+ },
36290
+ "id": {
36291
+ "type": "string",
36292
+ "minLength": 1,
36293
+ "description": "Authorization server identifier."
36294
+ },
36295
+ "token": {
36296
+ "description": "Optional token issuance settings.",
36297
+ "type": "object",
36298
+ "properties": {
36299
+ "lifetimeSeconds": {
36300
+ "description": "Access token lifetime in seconds.",
36301
+ "type": "number",
36302
+ "minimum": 60
36303
+ },
36304
+ "signingKeyId": {
36305
+ "description": "Optional key chain id used to sign issued tokens.",
36306
+ "type": "string",
36307
+ "minLength": 1
36308
+ },
36309
+ "refreshTokenEnabled": {
36310
+ "description": "Enable issuing refresh tokens.",
36311
+ "type": "boolean"
36312
+ },
36313
+ "refreshTokenExpiresInSeconds": {
36314
+ "description": "Refresh token lifetime in seconds.",
36315
+ "type": "number",
36316
+ "minimum": 60
36317
+ }
36318
+ },
36319
+ "additionalProperties": false
36320
+ },
36321
+ "requireDPoP": {
36322
+ "description": "Require DPoP proofs for token/credential requests.",
36323
+ "type": "boolean"
36324
+ },
36325
+ "walletAttestationRequired": {
36326
+ "description": "Require wallet attestation for this authorization server.",
36327
+ "type": "boolean"
36328
+ },
36329
+ "walletProviderTrustLists": {
36330
+ "description": "Optional wallet provider trust list references for this authorization server.",
36331
+ "type": "array",
36332
+ "items": {
36333
+ "type": "object",
36334
+ "properties": {
36335
+ "trustListId": {
36336
+ "type": "string",
36337
+ "minLength": 1
36338
+ },
36339
+ "url": {
36340
+ "description": "URL of the wallet provider trust list.",
36341
+ "type": "string",
36342
+ "format": "uri"
36343
+ },
36344
+ "verifierKey": {
36345
+ "description": "Optional verifier key material used for trust list verification.",
36346
+ "type": "object",
36347
+ "propertyNames": {
36348
+ "type": "string"
36349
+ },
36350
+ "additionalProperties": {}
36351
+ },
36352
+ "verifierKeyPem": {
36353
+ "description": "Optional verifier public key in SPKI PEM form (-----BEGIN PUBLIC KEY-----).",
36354
+ "type": "string",
36355
+ "pattern": "^\\s*-----BEGIN PUBLIC KEY-----[A-Za-z0-9+/=\\s]+-----END PUBLIC KEY-----\\s*$"
36356
+ },
36357
+ "verifierX509Der": {
36358
+ "description": "Optional verifier certificate in DER/base64 form.",
36359
+ "type": "string"
36360
+ }
36361
+ },
36362
+ "additionalProperties": false
36363
+ }
36364
+ },
36365
+ "walletAttestationStatusCheckMode": {
36366
+ "description": "Status check mode for wallet attestations at this authorization server. Omit to inherit the issuance default.",
36367
+ "type": "string",
36368
+ "enum": [
36369
+ "strict",
36370
+ "best_effort",
36371
+ "disabled"
36372
+ ]
36373
+ },
36374
+ "label": {
36375
+ "description": "Optional display label for UI selection.",
36376
+ "type": "string"
36377
+ },
36378
+ "enabled": {
36379
+ "description": "Whether this authorization server entry is enabled.",
36380
+ "type": "boolean"
36381
+ }
36382
+ },
36383
+ "required": [
36384
+ "type",
36385
+ "id"
36386
+ ],
36387
+ "additionalProperties": false
36388
+ }
36389
+ ],
36390
+ "description": "Supported authorization server configurations."
36391
+ },
36392
+ "description": "Configured authorization server entries."
36393
+ },
36394
+ "federation": {
36395
+ "description": "Optional OpenID Federation settings.",
36396
+ "anyOf": [
36397
+ {
36398
+ "type": "object",
36399
+ "properties": {
36400
+ "role": {
36401
+ "description": "Federation role for this issuer.",
36402
+ "type": "string",
36403
+ "enum": [
36404
+ "trust_anchor",
36405
+ "intermediate",
36406
+ "leaf"
36407
+ ]
36408
+ },
36409
+ "mode": {
36410
+ "description": "Federation operation mode.",
36411
+ "type": "string",
36412
+ "enum": [
36413
+ "federation-only",
36414
+ "hybrid"
36415
+ ]
36416
+ },
36417
+ "entityId": {
36418
+ "description": "Entity Identifier of the tenant's federation entity, usually {PUBLIC_URL}/issuers/{tenantId}: an https URL with a host and without query or fragment (OpenID Federation 1.0 Section 1.2). http is accepted only when OUTBOUND_URL_ALLOW_HTTP is true.",
36419
+ "type": "string",
36420
+ "pattern": "^(https?:\\/\\/[^\\s?#]+)?$"
36421
+ },
36422
+ "enforceSigningPolicy": {
36423
+ "description": "Enforce strict signing policy checks.",
36424
+ "type": "boolean"
36425
+ },
36426
+ "cacheTtlSeconds": {
36427
+ "description": "Cache time-to-live for federation metadata in seconds.",
36428
+ "type": "integer",
36429
+ "minimum": 1,
36430
+ "maximum": 9007199254740991
36431
+ },
36432
+ "trustAnchors": {
36433
+ "type": "array",
36434
+ "items": {
36435
+ "type": "object",
36436
+ "properties": {
36437
+ "entityId": {
36438
+ "type": "string",
36439
+ "minLength": 1,
36440
+ "description": "Federation trust anchor entity id."
36441
+ },
36442
+ "entityConfigurationUri": {
36443
+ "type": "string",
36444
+ "format": "uri",
36445
+ "description": "Entity configuration URI for the trust anchor."
36446
+ }
36447
+ },
36448
+ "required": [
36449
+ "entityId",
36450
+ "entityConfigurationUri"
36451
+ ],
36452
+ "additionalProperties": false
36453
+ },
36454
+ "description": "Federation trust anchors."
36455
+ },
36456
+ "entityTypes": {
36457
+ "description": "Roles the entity configuration publishes metadata for. Defaults to openid_credential_issuer.",
36458
+ "minItems": 1,
36459
+ "type": "array",
36460
+ "items": {
36461
+ "type": "string",
36462
+ "enum": [
36463
+ "openid_credential_issuer",
36464
+ "openid_credential_verifier"
36465
+ ]
36466
+ }
36467
+ },
36468
+ "authorityHints": {
36469
+ "description": "authority_hints of the entity configuration: the superiors that issue a subordinate statement about this entity. Defaults to the trust anchor entity ids.",
36470
+ "type": "array",
36471
+ "items": {
36472
+ "type": "string",
36473
+ "format": "uri"
36474
+ }
36475
+ },
36476
+ "entityKeyChainId": {
36477
+ "description": "Key chain with usage type 'federation' that signs the entity configuration. Without it, a federation key chain of the tenant is used; set it when the tenant has several.",
36478
+ "type": "string",
36479
+ "minLength": 1
36480
+ },
36481
+ "entityConfigurationLifetimeSeconds": {
36482
+ "description": "Lifetime (exp - iat) of the entity configuration in seconds. Defaults to 86400.",
36483
+ "type": "integer",
36484
+ "minimum": 60,
36485
+ "maximum": 31536e3
36486
+ },
36487
+ "trustMarks": {
36488
+ "description": "Trust mark JWTs issued to this entity, published in the entity configuration.",
36489
+ "type": "array",
36490
+ "items": {
36491
+ "type": "string",
36492
+ "minLength": 1
36493
+ }
36494
+ },
36495
+ "entityMetadata": {
36496
+ "description": "Informational federation_entity metadata of the entity configuration.",
36497
+ "type": "object",
36498
+ "properties": {
36499
+ "organization_name": {
36500
+ "type": "string",
36501
+ "minLength": 1
36502
+ },
36503
+ "contacts": {
36504
+ "minItems": 1,
36505
+ "type": "array",
36506
+ "items": {
36507
+ "type": "string",
36508
+ "minLength": 1
36509
+ }
36510
+ },
36511
+ "logo_uri": {
36512
+ "type": "string",
36513
+ "format": "uri"
36514
+ },
36515
+ "policy_uri": {
36516
+ "type": "string",
36517
+ "format": "uri"
36518
+ },
36519
+ "homepage_uri": {
36520
+ "type": "string",
36521
+ "format": "uri"
36522
+ }
36523
+ },
36524
+ "additionalProperties": false
36525
+ },
36526
+ "includeTrustChain": {
36527
+ "description": "Add the trust chain of this entity as trust_chain header to federation SD-JWT VCs and OID4VP request objects.",
36528
+ "type": "boolean"
36529
+ }
36530
+ },
36531
+ "required": [
36532
+ "trustAnchors"
36533
+ ],
36534
+ "additionalProperties": false
36535
+ },
36536
+ {
36537
+ "type": "null"
35353
36538
  }
35354
- },
35355
- "additionalProperties": false
36539
+ ]
36540
+ },
36541
+ "registrationCertificate": {
36542
+ "description": "Optional registration certificate settings.",
36543
+ "anyOf": [
36544
+ {
36545
+ "type": "object",
36546
+ "properties": {
36547
+ "enabled": {
36548
+ "description": "Enable issuer registration certificate support.",
36549
+ "type": "boolean"
36550
+ },
36551
+ "mode": {
36552
+ "description": "How registration certificate data is provided.",
36553
+ "type": "string",
36554
+ "enum": [
36555
+ "import",
36556
+ "generate"
36557
+ ]
36558
+ },
36559
+ "jwt": {
36560
+ "description": "Optional registration certificate JWT when using import mode.",
36561
+ "type": "string"
36562
+ },
36563
+ "privacyPolicy": {
36564
+ "description": "Optional privacy policy URI.",
36565
+ "type": "string"
36566
+ },
36567
+ "supportUri": {
36568
+ "description": "Optional support URI.",
36569
+ "type": "string"
36570
+ }
36571
+ },
36572
+ "additionalProperties": false
36573
+ },
36574
+ {
36575
+ "type": "null"
36576
+ }
36577
+ ]
36578
+ },
36579
+ "display": {
36580
+ "description": "Localized issuer metadata shown to wallets.",
36581
+ "type": "array",
36582
+ "items": {
36583
+ "type": "object",
36584
+ "properties": {
36585
+ "name": {
36586
+ "description": "Issuer display name.",
36587
+ "type": "string"
36588
+ },
36589
+ "locale": {
36590
+ "description": "Locale tag for this display entry.",
36591
+ "type": "string"
36592
+ },
36593
+ "logo": {
36594
+ "description": "Optional issuer logo metadata.",
36595
+ "type": "object",
36596
+ "properties": {
36597
+ "uri": {
36598
+ "type": "string",
36599
+ "minLength": 1,
36600
+ "description": "Logo URI."
36601
+ },
36602
+ "alt_text": {
36603
+ "description": "Optional localized alternative text.",
36604
+ "type": "string"
36605
+ }
36606
+ },
36607
+ "required": [
36608
+ "uri"
36609
+ ],
36610
+ "additionalProperties": {}
36611
+ }
36612
+ },
36613
+ "additionalProperties": {}
36614
+ }
36615
+ },
36616
+ "notificationEndpointEnabled": {
36617
+ "description": "Whether the OID4VCI notification endpoint is exposed for this issuance configuration.",
36618
+ "type": "boolean"
36619
+ },
36620
+ "credentialResponseEncryption": {
36621
+ "description": "Enable encrypted credential responses.",
36622
+ "type": "boolean"
36623
+ },
36624
+ "credentialRequestEncryption": {
36625
+ "description": "Require encrypted credential requests.",
36626
+ "type": "boolean"
36627
+ },
36628
+ "txCodeMaxAttempts": {
36629
+ "description": "Maximum verification attempts for transaction codes. Null resets to defaults.",
36630
+ "anyOf": [
36631
+ {
36632
+ "type": "integer",
36633
+ "minimum": 1,
36634
+ "maximum": 9007199254740991
36635
+ },
36636
+ {
36637
+ "type": "null"
36638
+ }
36639
+ ]
36640
+ },
36641
+ "offerLifetimeSeconds": {
36642
+ "description": "Default lifetime of credential offers in seconds. Can be overridden per offer request. Null or unset: offers do not expire.",
36643
+ "anyOf": [
36644
+ {
36645
+ "type": "integer",
36646
+ "minimum": 1,
36647
+ "maximum": 9007199254740991
36648
+ },
36649
+ {
36650
+ "type": "null"
36651
+ }
36652
+ ]
35356
36653
  }
35357
36654
  },
35358
36655
  "required": [
35359
- "name"
36656
+ "authorizationServers"
35360
36657
  ],
35361
36658
  "additionalProperties": false,
35362
- "description": "Payload used when importing tenant metadata from config files."
36659
+ "title": "IssuanceConfig"
35363
36660
  }
35364
- },
35365
- "required": [
35366
- "$schema",
35367
- "metadata",
35368
- "spec"
35369
- ],
35370
- "additionalProperties": false
36661
+ }
35371
36662
  },
35372
36663
  {
35373
36664
  "$schema": "https://json-schema.org/draft/2020-12/schema",
35374
- "$id": "https://eudiplo.dev/schemas/v5/IssuanceConfigFile.schema.json",
36665
+ "$id": "https://eudiplo.dev/schemas/v6/IssuanceConfigFile.schema.json",
35375
36666
  "title": "IssuanceConfigFile",
35376
36667
  "type": "object",
35377
36668
  "properties": {
35378
36669
  "$schema": {
35379
36670
  "type": "string",
35380
- "const": "https://eudiplo.dev/schemas/v5/IssuanceConfigFile.schema.json"
36671
+ "const": "https://eudiplo.dev/schemas/v6/IssuanceConfigFile.schema.json"
35381
36672
  },
35382
36673
  "metadata": {
35383
36674
  "type": "object",
@@ -35477,11 +36768,6 @@ var CONFIG_SCHEMAS = [
35477
36768
  }
35478
36769
  ]
35479
36770
  },
35480
- "signingKeyId": {
35481
- "description": "Default signing key chain id for credential issuance.",
35482
- "type": "string",
35483
- "minLength": 1
35484
- },
35485
36771
  "authorizationServers": {
35486
36772
  "minItems": 1,
35487
36773
  "type": "array",
@@ -35574,7 +36860,7 @@ var CONFIG_SCHEMAS = [
35574
36860
  "minimum": 60
35575
36861
  },
35576
36862
  "signingKeyId": {
35577
- "description": "Optional key chain id used to sign issued tokens.",
36863
+ "description": `ID of a key chain with usage type "accessToken" that signs the issued access tokens. Without it, the tenant's access token key chain signs them.`,
35578
36864
  "type": "string",
35579
36865
  "minLength": 1
35580
36866
  },
@@ -35716,7 +37002,7 @@ var CONFIG_SCHEMAS = [
35716
37002
  "minimum": 60
35717
37003
  },
35718
37004
  "signingKeyId": {
35719
- "description": "Optional key chain id used to sign issued tokens.",
37005
+ "description": `ID of a key chain with usage type "accessToken" that signs the issued access tokens. Without it, the tenant's access token key chain signs them.`,
35720
37006
  "type": "string",
35721
37007
  "minLength": 1
35722
37008
  },
@@ -35824,7 +37110,7 @@ var CONFIG_SCHEMAS = [
35824
37110
  "minimum": 60
35825
37111
  },
35826
37112
  "signingKeyId": {
35827
- "description": "Optional key chain id used to sign issued tokens.",
37113
+ "description": `ID of a key chain with usage type "accessToken" that signs the issued access tokens. Without it, the tenant's access token key chain signs them.`,
35828
37114
  "type": "string",
35829
37115
  "minLength": 1
35830
37116
  },
@@ -37571,7 +38857,7 @@ async function assertTenantTargetIsEmpty(tenantPath) {
37571
38857
  }
37572
38858
  }
37573
38859
  function validateTenantId(tenantId) {
37574
- if (!/^[a-z0-9](?:[a-z0-9_-]{0,62})$/.test(tenantId)) {
38860
+ if (!TENANT_ID_PATTERN.test(tenantId)) {
37575
38861
  throw new Error(
37576
38862
  "Tenant ID must use lowercase letters, numbers, hyphens, or underscores and be at most 63 characters."
37577
38863
  );
@@ -38957,7 +40243,7 @@ function createDeploymentCommands(context, setExitCode) {
38957
40243
  // package.json
38958
40244
  var package_default = {
38959
40245
  name: "@eudiplo/cli",
38960
- version: "9.1.0-main.cd87b41",
40246
+ version: "9.1.0-main.d547bae",
38961
40247
  description: "Deployment-aware command line tools for EUDIPLO",
38962
40248
  private: false,
38963
40249
  type: "module",