@eudiplo/cli 9.1.0-main.cd87b41 → 9.1.0-main.d547bae

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (14) hide show
  1. package/dist/commands/config/portability/migrations.spec.js +2 -1
  2. package/dist/commands/config/portability/migrations.spec.js.map +1 -1
  3. package/dist/commands/config/tenant/action.d.ts.map +1 -1
  4. package/dist/commands/config/tenant/action.js +2 -1
  5. package/dist/commands/config/tenant/action.js.map +1 -1
  6. package/dist/index.js +1380 -94
  7. package/package.json +1 -1
  8. package/templates/schemas/CreateTenantDto.schema.json +2 -2
  9. package/templates/schemas/IssuanceConfig.schema.json +3 -8
  10. package/templates/schemas/IssuanceConfigFile.schema.json +814 -1
  11. package/templates/schemas/KeyChainConfigFile.schema.json +371 -1
  12. package/templates/schemas/KeyChainCreateDto.schema.json +1 -0
  13. package/templates/schemas/KeyChainDefaultsConfigFile.schema.json +58 -0
  14. package/templates/schemas/KeyChainImportDto.schema.json +1 -0
package/templates/schemas/IssuanceConfigFile.schema.json CHANGED
@@ -9,7 +9,7 @@
9
9
  "properties": {
10
10
  "$schema": {
11
11
  "type": "string",
12
- "const": "https://eudiplo.dev/schemas/v5/IssuanceConfigFile.schema.json"
12
+ "const": "https://eudiplo.dev/schemas/v6/IssuanceConfigFile.schema.json"
13
13
  },
14
14
  "metadata": {
15
15
  "type": "object",
@@ -2809,6 +2809,819 @@
2809
2809
  "title": "IssuanceConfig"
2810
2810
  }
2811
2811
  }
2812
+ },
2813
+ {
2814
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
2815
+ "$id": "https://eudiplo.dev/schemas/v5/IssuanceConfigFile.schema.json",
2816
+ "title": "IssuanceConfigFile",
2817
+ "type": "object",
2818
+ "properties": {
2819
+ "$schema": {
2820
+ "type": "string",
2821
+ "const": "https://eudiplo.dev/schemas/v5/IssuanceConfigFile.schema.json"
2822
+ },
2823
+ "metadata": {
2824
+ "type": "object",
2825
+ "properties": {
2826
+ "generation": {
2827
+ "type": "integer",
2828
+ "minimum": 1,
2829
+ "description": "Monotonically increasing configuration generation."
2830
+ },
2831
+ "ownership": {
2832
+ "type": "string",
2833
+ "enum": [
2834
+ "unmanaged",
2835
+ "file-managed"
2836
+ ],
2837
+ "description": "Requested ownership recorded when the document is applied."
2838
+ }
2839
+ },
2840
+ "additionalProperties": false
2841
+ },
2842
+ "spec": {
2843
+ "$ref": "#/$defs/IssuanceConfig"
2844
+ }
2845
+ },
2846
+ "required": [
2847
+ "$schema",
2848
+ "spec"
2849
+ ],
2850
+ "additionalProperties": false,
2851
+ "$defs": {
2852
+ "IssuanceConfig": {
2853
+ "type": "object",
2854
+ "properties": {
2855
+ "batchSize": {
2856
+ "description": "Optional issuance batch size.",
2857
+ "type": "integer",
2858
+ "minimum": 1,
2859
+ "maximum": 9007199254740991
2860
+ },
2861
+ "dPopRequired": {
2862
+ "description": "Require DPoP proofs for issuance endpoints.",
2863
+ "type": "boolean"
2864
+ },
2865
+ "walletAttestationRequired": {
2866
+ "description": "Default wallet attestation requirement for managed authorization servers.",
2867
+ "type": "boolean"
2868
+ },
2869
+ "walletProviderTrustLists": {
2870
+ "description": "Shared wallet provider trust lists for key attestations and default authorization server wallet authentication.",
2871
+ "type": "array",
2872
+ "items": {
2873
+ "type": "object",
2874
+ "properties": {
2875
+ "trustListId": {
2876
+ "type": "string",
2877
+ "minLength": 1
2878
+ },
2879
+ "url": {
2880
+ "description": "URL of the wallet provider trust list.",
2881
+ "type": "string",
2882
+ "format": "uri"
2883
+ },
2884
+ "verifierKey": {
2885
+ "description": "Optional verifier key material used for trust list verification.",
2886
+ "type": "object",
2887
+ "propertyNames": {
2888
+ "type": "string"
2889
+ },
2890
+ "additionalProperties": {}
2891
+ },
2892
+ "verifierKeyPem": {
2893
+ "description": "Optional verifier public key in SPKI PEM form (-----BEGIN PUBLIC KEY-----).",
2894
+ "type": "string",
2895
+ "pattern": "^\\s*-----BEGIN PUBLIC KEY-----[A-Za-z0-9+/=\\s]+-----END PUBLIC KEY-----\\s*$"
2896
+ },
2897
+ "verifierX509Der": {
2898
+ "description": "Optional verifier certificate in DER/base64 form.",
2899
+ "type": "string"
2900
+ }
2901
+ },
2902
+ "additionalProperties": false
2903
+ }
2904
+ },
2905
+ "walletAttestationStatusCheckMode": {
2906
+ "description": "Default status check mode for wallet attestations at managed authorization servers: strict, best_effort (default) or disabled.",
2907
+ "anyOf": [
2908
+ {
2909
+ "type": "string",
2910
+ "enum": [
2911
+ "strict",
2912
+ "best_effort",
2913
+ "disabled"
2914
+ ]
2915
+ },
2916
+ {
2917
+ "type": "null"
2918
+ }
2919
+ ]
2920
+ },
2921
+ "signingKeyId": {
2922
+ "description": "Default signing key chain id for credential issuance.",
2923
+ "type": "string",
2924
+ "minLength": 1
2925
+ },
2926
+ "authorizationServers": {
2927
+ "minItems": 1,
2928
+ "type": "array",
2929
+ "items": {
2930
+ "oneOf": [
2931
+ {
2932
+ "type": "object",
2933
+ "properties": {
2934
+ "type": {
2935
+ "type": "string",
2936
+ "const": "external",
2937
+ "description": "Use an externally managed authorization server."
2938
+ },
2939
+ "id": {
2940
+ "type": "string",
2941
+ "minLength": 1,
2942
+ "description": "Authorization server identifier."
2943
+ },
2944
+ "issuer": {
2945
+ "type": "string",
2946
+ "format": "uri",
2947
+ "description": "Issuer URL for the external authorization server."
2948
+ },
2949
+ "sessionBinding": {
2950
+ "description": "Explicit mapping from an external access-token claim to an existing issuance session.",
2951
+ "type": "object",
2952
+ "properties": {
2953
+ "method": {
2954
+ "type": "string",
2955
+ "const": "access_token_claim",
2956
+ "description": "Read the correlation value from a configured access-token claim."
2957
+ },
2958
+ "claim": {
2959
+ "type": "string",
2960
+ "minLength": 1,
2961
+ "description": "Claim name that contains the issuance-session correlation value."
2962
+ }
2963
+ },
2964
+ "required": [
2965
+ "method",
2966
+ "claim"
2967
+ ],
2968
+ "additionalProperties": false
2969
+ },
2970
+ "label": {
2971
+ "description": "Optional display label for UI selection.",
2972
+ "type": "string"
2973
+ },
2974
+ "enabled": {
2975
+ "description": "Whether this authorization server entry is enabled.",
2976
+ "type": "boolean"
2977
+ }
2978
+ },
2979
+ "required": [
2980
+ "type",
2981
+ "id",
2982
+ "issuer"
2983
+ ],
2984
+ "additionalProperties": false
2985
+ },
2986
+ {
2987
+ "type": "object",
2988
+ "properties": {
2989
+ "type": {
2990
+ "type": "string",
2991
+ "const": "oid4vp",
2992
+ "description": "Use OID4VP-based authorization server chaining."
2993
+ },
2994
+ "id": {
2995
+ "type": "string",
2996
+ "minLength": 1,
2997
+ "description": "Authorization server identifier."
2998
+ },
2999
+ "presentationConfigId": {
3000
+ "type": "string",
3001
+ "minLength": 1,
3002
+ "description": "Presentation configuration id used during authorization."
3003
+ },
3004
+ "immediateWalletRedirect": {
3005
+ "description": "Redirect wallets immediately after authorization response creation.",
3006
+ "type": "boolean"
3007
+ },
3008
+ "token": {
3009
+ "description": "Optional token issuance settings.",
3010
+ "type": "object",
3011
+ "properties": {
3012
+ "lifetimeSeconds": {
3013
+ "description": "Access token lifetime in seconds.",
3014
+ "type": "number",
3015
+ "minimum": 60
3016
+ },
3017
+ "signingKeyId": {
3018
+ "description": "Optional key chain id used to sign issued tokens.",
3019
+ "type": "string",
3020
+ "minLength": 1
3021
+ },
3022
+ "refreshTokenEnabled": {
3023
+ "description": "Enable issuing refresh tokens.",
3024
+ "type": "boolean"
3025
+ },
3026
+ "refreshTokenExpiresInSeconds": {
3027
+ "description": "Refresh token lifetime in seconds.",
3028
+ "type": "number",
3029
+ "minimum": 60
3030
+ }
3031
+ },
3032
+ "additionalProperties": false
3033
+ },
3034
+ "requireDPoP": {
3035
+ "description": "Require DPoP proofs for token/credential requests.",
3036
+ "type": "boolean"
3037
+ },
3038
+ "walletAttestationRequired": {
3039
+ "description": "Require wallet attestation for this authorization server.",
3040
+ "type": "boolean"
3041
+ },
3042
+ "walletProviderTrustLists": {
3043
+ "description": "Optional wallet provider trust list references for this authorization server.",
3044
+ "type": "array",
3045
+ "items": {
3046
+ "type": "object",
3047
+ "properties": {
3048
+ "trustListId": {
3049
+ "type": "string",
3050
+ "minLength": 1
3051
+ },
3052
+ "url": {
3053
+ "description": "URL of the wallet provider trust list.",
3054
+ "type": "string",
3055
+ "format": "uri"
3056
+ },
3057
+ "verifierKey": {
3058
+ "description": "Optional verifier key material used for trust list verification.",
3059
+ "type": "object",
3060
+ "propertyNames": {
3061
+ "type": "string"
3062
+ },
3063
+ "additionalProperties": {}
3064
+ },
3065
+ "verifierKeyPem": {
3066
+ "description": "Optional verifier public key in SPKI PEM form (-----BEGIN PUBLIC KEY-----).",
3067
+ "type": "string",
3068
+ "pattern": "^\\s*-----BEGIN PUBLIC KEY-----[A-Za-z0-9+/=\\s]+-----END PUBLIC KEY-----\\s*$"
3069
+ },
3070
+ "verifierX509Der": {
3071
+ "description": "Optional verifier certificate in DER/base64 form.",
3072
+ "type": "string"
3073
+ }
3074
+ },
3075
+ "additionalProperties": false
3076
+ }
3077
+ },
3078
+ "walletAttestationStatusCheckMode": {
3079
+ "description": "Status check mode for wallet attestations at this authorization server. Omit to inherit the issuance default.",
3080
+ "type": "string",
3081
+ "enum": [
3082
+ "strict",
3083
+ "best_effort",
3084
+ "disabled"
3085
+ ]
3086
+ },
3087
+ "label": {
3088
+ "description": "Optional display label for UI selection.",
3089
+ "type": "string"
3090
+ },
3091
+ "enabled": {
3092
+ "description": "Whether this authorization server entry is enabled.",
3093
+ "type": "boolean"
3094
+ }
3095
+ },
3096
+ "required": [
3097
+ "type",
3098
+ "id",
3099
+ "presentationConfigId"
3100
+ ],
3101
+ "additionalProperties": false
3102
+ },
3103
+ {
3104
+ "type": "object",
3105
+ "properties": {
3106
+ "type": {
3107
+ "type": "string",
3108
+ "const": "chained",
3109
+ "description": "Use upstream OIDC as authorization source."
3110
+ },
3111
+ "id": {
3112
+ "type": "string",
3113
+ "minLength": 1,
3114
+ "description": "Authorization server identifier."
3115
+ },
3116
+ "upstream": {
3117
+ "type": "object",
3118
+ "properties": {
3119
+ "issuer": {
3120
+ "type": "string",
3121
+ "format": "uri",
3122
+ "description": "Upstream OIDC issuer URL."
3123
+ },
3124
+ "clientId": {
3125
+ "type": "string",
3126
+ "minLength": 1,
3127
+ "description": "Client id for upstream OIDC authentication."
3128
+ },
3129
+ "clientSecret": {
3130
+ "description": "Optional client secret for upstream OIDC authentication.",
3131
+ "type": "string",
3132
+ "minLength": 1
3133
+ },
3134
+ "scopes": {
3135
+ "description": "Optional scopes requested from the upstream issuer.",
3136
+ "type": "array",
3137
+ "items": {
3138
+ "type": "string",
3139
+ "minLength": 1
3140
+ }
3141
+ }
3142
+ },
3143
+ "required": [
3144
+ "issuer",
3145
+ "clientId"
3146
+ ],
3147
+ "additionalProperties": false,
3148
+ "description": "Upstream OIDC connection settings."
3149
+ },
3150
+ "token": {
3151
+ "description": "Optional token issuance settings.",
3152
+ "type": "object",
3153
+ "properties": {
3154
+ "lifetimeSeconds": {
3155
+ "description": "Access token lifetime in seconds.",
3156
+ "type": "number",
3157
+ "minimum": 60
3158
+ },
3159
+ "signingKeyId": {
3160
+ "description": "Optional key chain id used to sign issued tokens.",
3161
+ "type": "string",
3162
+ "minLength": 1
3163
+ },
3164
+ "refreshTokenEnabled": {
3165
+ "description": "Enable issuing refresh tokens.",
3166
+ "type": "boolean"
3167
+ },
3168
+ "refreshTokenExpiresInSeconds": {
3169
+ "description": "Refresh token lifetime in seconds.",
3170
+ "type": "number",
3171
+ "minimum": 60
3172
+ }
3173
+ },
3174
+ "additionalProperties": false
3175
+ },
3176
+ "requireDPoP": {
3177
+ "description": "Require DPoP proofs for token/credential requests.",
3178
+ "type": "boolean"
3179
+ },
3180
+ "walletAttestationRequired": {
3181
+ "description": "Require wallet attestation for this authorization server.",
3182
+ "type": "boolean"
3183
+ },
3184
+ "walletProviderTrustLists": {
3185
+ "description": "Optional wallet provider trust list references for this authorization server.",
3186
+ "type": "array",
3187
+ "items": {
3188
+ "type": "object",
3189
+ "properties": {
3190
+ "trustListId": {
3191
+ "type": "string",
3192
+ "minLength": 1
3193
+ },
3194
+ "url": {
3195
+ "description": "URL of the wallet provider trust list.",
3196
+ "type": "string",
3197
+ "format": "uri"
3198
+ },
3199
+ "verifierKey": {
3200
+ "description": "Optional verifier key material used for trust list verification.",
3201
+ "type": "object",
3202
+ "propertyNames": {
3203
+ "type": "string"
3204
+ },
3205
+ "additionalProperties": {}
3206
+ },
3207
+ "verifierKeyPem": {
3208
+ "description": "Optional verifier public key in SPKI PEM form (-----BEGIN PUBLIC KEY-----).",
3209
+ "type": "string",
3210
+ "pattern": "^\\s*-----BEGIN PUBLIC KEY-----[A-Za-z0-9+/=\\s]+-----END PUBLIC KEY-----\\s*$"
3211
+ },
3212
+ "verifierX509Der": {
3213
+ "description": "Optional verifier certificate in DER/base64 form.",
3214
+ "type": "string"
3215
+ }
3216
+ },
3217
+ "additionalProperties": false
3218
+ }
3219
+ },
3220
+ "walletAttestationStatusCheckMode": {
3221
+ "description": "Status check mode for wallet attestations at this authorization server. Omit to inherit the issuance default.",
3222
+ "type": "string",
3223
+ "enum": [
3224
+ "strict",
3225
+ "best_effort",
3226
+ "disabled"
3227
+ ]
3228
+ },
3229
+ "label": {
3230
+ "description": "Optional display label for UI selection.",
3231
+ "type": "string"
3232
+ },
3233
+ "enabled": {
3234
+ "description": "Whether this authorization server entry is enabled.",
3235
+ "type": "boolean"
3236
+ }
3237
+ },
3238
+ "required": [
3239
+ "type",
3240
+ "id",
3241
+ "upstream"
3242
+ ],
3243
+ "additionalProperties": false
3244
+ },
3245
+ {
3246
+ "type": "object",
3247
+ "properties": {
3248
+ "type": {
3249
+ "type": "string",
3250
+ "const": "built-in",
3251
+ "description": "Use EUDIPLO built-in authorization server."
3252
+ },
3253
+ "id": {
3254
+ "type": "string",
3255
+ "minLength": 1,
3256
+ "description": "Authorization server identifier."
3257
+ },
3258
+ "token": {
3259
+ "description": "Optional token issuance settings.",
3260
+ "type": "object",
3261
+ "properties": {
3262
+ "lifetimeSeconds": {
3263
+ "description": "Access token lifetime in seconds.",
3264
+ "type": "number",
3265
+ "minimum": 60
3266
+ },
3267
+ "signingKeyId": {
3268
+ "description": "Optional key chain id used to sign issued tokens.",
3269
+ "type": "string",
3270
+ "minLength": 1
3271
+ },
3272
+ "refreshTokenEnabled": {
3273
+ "description": "Enable issuing refresh tokens.",
3274
+ "type": "boolean"
3275
+ },
3276
+ "refreshTokenExpiresInSeconds": {
3277
+ "description": "Refresh token lifetime in seconds.",
3278
+ "type": "number",
3279
+ "minimum": 60
3280
+ }
3281
+ },
3282
+ "additionalProperties": false
3283
+ },
3284
+ "requireDPoP": {
3285
+ "description": "Require DPoP proofs for token/credential requests.",
3286
+ "type": "boolean"
3287
+ },
3288
+ "walletAttestationRequired": {
3289
+ "description": "Require wallet attestation for this authorization server.",
3290
+ "type": "boolean"
3291
+ },
3292
+ "walletProviderTrustLists": {
3293
+ "description": "Optional wallet provider trust list references for this authorization server.",
3294
+ "type": "array",
3295
+ "items": {
3296
+ "type": "object",
3297
+ "properties": {
3298
+ "trustListId": {
3299
+ "type": "string",
3300
+ "minLength": 1
3301
+ },
3302
+ "url": {
3303
+ "description": "URL of the wallet provider trust list.",
3304
+ "type": "string",
3305
+ "format": "uri"
3306
+ },
3307
+ "verifierKey": {
3308
+ "description": "Optional verifier key material used for trust list verification.",
3309
+ "type": "object",
3310
+ "propertyNames": {
3311
+ "type": "string"
3312
+ },
3313
+ "additionalProperties": {}
3314
+ },
3315
+ "verifierKeyPem": {
3316
+ "description": "Optional verifier public key in SPKI PEM form (-----BEGIN PUBLIC KEY-----).",
3317
+ "type": "string",
3318
+ "pattern": "^\\s*-----BEGIN PUBLIC KEY-----[A-Za-z0-9+/=\\s]+-----END PUBLIC KEY-----\\s*$"
3319
+ },
3320
+ "verifierX509Der": {
3321
+ "description": "Optional verifier certificate in DER/base64 form.",
3322
+ "type": "string"
3323
+ }
3324
+ },
3325
+ "additionalProperties": false
3326
+ }
3327
+ },
3328
+ "walletAttestationStatusCheckMode": {
3329
+ "description": "Status check mode for wallet attestations at this authorization server. Omit to inherit the issuance default.",
3330
+ "type": "string",
3331
+ "enum": [
3332
+ "strict",
3333
+ "best_effort",
3334
+ "disabled"
3335
+ ]
3336
+ },
3337
+ "label": {
3338
+ "description": "Optional display label for UI selection.",
3339
+ "type": "string"
3340
+ },
3341
+ "enabled": {
3342
+ "description": "Whether this authorization server entry is enabled.",
3343
+ "type": "boolean"
3344
+ }
3345
+ },
3346
+ "required": [
3347
+ "type",
3348
+ "id"
3349
+ ],
3350
+ "additionalProperties": false
3351
+ }
3352
+ ],
3353
+ "description": "Supported authorization server configurations."
3354
+ },
3355
+ "description": "Configured authorization server entries."
3356
+ },
3357
+ "federation": {
3358
+ "description": "Optional OpenID Federation settings.",
3359
+ "anyOf": [
3360
+ {
3361
+ "type": "object",
3362
+ "properties": {
3363
+ "role": {
3364
+ "description": "Federation role for this issuer.",
3365
+ "type": "string",
3366
+ "enum": [
3367
+ "trust_anchor",
3368
+ "intermediate",
3369
+ "leaf"
3370
+ ]
3371
+ },
3372
+ "mode": {
3373
+ "description": "Federation operation mode.",
3374
+ "type": "string",
3375
+ "enum": [
3376
+ "federation-only",
3377
+ "hybrid"
3378
+ ]
3379
+ },
3380
+ "entityId": {
3381
+ "description": "Entity Identifier of the tenant's federation entity, usually {PUBLIC_URL}/issuers/{tenantId}: an https URL with a host and without query or fragment (OpenID Federation 1.0 Section 1.2). http is accepted only when OUTBOUND_URL_ALLOW_HTTP is true.",
3382
+ "type": "string",
3383
+ "pattern": "^(https?:\\/\\/[^\\s?#]+)?$"
3384
+ },
3385
+ "enforceSigningPolicy": {
3386
+ "description": "Enforce strict signing policy checks.",
3387
+ "type": "boolean"
3388
+ },
3389
+ "cacheTtlSeconds": {
3390
+ "description": "Cache time-to-live for federation metadata in seconds.",
3391
+ "type": "integer",
3392
+ "minimum": 1,
3393
+ "maximum": 9007199254740991
3394
+ },
3395
+ "trustAnchors": {
3396
+ "type": "array",
3397
+ "items": {
3398
+ "type": "object",
3399
+ "properties": {
3400
+ "entityId": {
3401
+ "type": "string",
3402
+ "minLength": 1,
3403
+ "description": "Federation trust anchor entity id."
3404
+ },
3405
+ "entityConfigurationUri": {
3406
+ "type": "string",
3407
+ "format": "uri",
3408
+ "description": "Entity configuration URI for the trust anchor."
3409
+ }
3410
+ },
3411
+ "required": [
3412
+ "entityId",
3413
+ "entityConfigurationUri"
3414
+ ],
3415
+ "additionalProperties": false
3416
+ },
3417
+ "description": "Federation trust anchors."
3418
+ },
3419
+ "entityTypes": {
3420
+ "description": "Roles the entity configuration publishes metadata for. Defaults to openid_credential_issuer.",
3421
+ "minItems": 1,
3422
+ "type": "array",
3423
+ "items": {
3424
+ "type": "string",
3425
+ "enum": [
3426
+ "openid_credential_issuer",
3427
+ "openid_credential_verifier"
3428
+ ]
3429
+ }
3430
+ },
3431
+ "authorityHints": {
3432
+ "description": "authority_hints of the entity configuration: the superiors that issue a subordinate statement about this entity. Defaults to the trust anchor entity ids.",
3433
+ "type": "array",
3434
+ "items": {
3435
+ "type": "string",
3436
+ "format": "uri"
3437
+ }
3438
+ },
3439
+ "entityKeyChainId": {
3440
+ "description": "Key chain with usage type 'federation' that signs the entity configuration. Without it, a federation key chain of the tenant is used; set it when the tenant has several.",
3441
+ "type": "string",
3442
+ "minLength": 1
3443
+ },
3444
+ "entityConfigurationLifetimeSeconds": {
3445
+ "description": "Lifetime (exp - iat) of the entity configuration in seconds. Defaults to 86400.",
3446
+ "type": "integer",
3447
+ "minimum": 60,
3448
+ "maximum": 31536000
3449
+ },
3450
+ "trustMarks": {
3451
+ "description": "Trust mark JWTs issued to this entity, published in the entity configuration.",
3452
+ "type": "array",
3453
+ "items": {
3454
+ "type": "string",
3455
+ "minLength": 1
3456
+ }
3457
+ },
3458
+ "entityMetadata": {
3459
+ "description": "Informational federation_entity metadata of the entity configuration.",
3460
+ "type": "object",
3461
+ "properties": {
3462
+ "organization_name": {
3463
+ "type": "string",
3464
+ "minLength": 1
3465
+ },
3466
+ "contacts": {
3467
+ "minItems": 1,
3468
+ "type": "array",
3469
+ "items": {
3470
+ "type": "string",
3471
+ "minLength": 1
3472
+ }
3473
+ },
3474
+ "logo_uri": {
3475
+ "type": "string",
3476
+ "format": "uri"
3477
+ },
3478
+ "policy_uri": {
3479
+ "type": "string",
3480
+ "format": "uri"
3481
+ },
3482
+ "homepage_uri": {
3483
+ "type": "string",
3484
+ "format": "uri"
3485
+ }
3486
+ },
3487
+ "additionalProperties": false
3488
+ },
3489
+ "includeTrustChain": {
3490
+ "description": "Add the trust chain of this entity as trust_chain header to federation SD-JWT VCs and OID4VP request objects.",
3491
+ "type": "boolean"
3492
+ }
3493
+ },
3494
+ "required": [
3495
+ "trustAnchors"
3496
+ ],
3497
+ "additionalProperties": false
3498
+ },
3499
+ {
3500
+ "type": "null"
3501
+ }
3502
+ ]
3503
+ },
3504
+ "registrationCertificate": {
3505
+ "description": "Optional registration certificate settings.",
3506
+ "anyOf": [
3507
+ {
3508
+ "type": "object",
3509
+ "properties": {
3510
+ "enabled": {
3511
+ "description": "Enable issuer registration certificate support.",
3512
+ "type": "boolean"
3513
+ },
3514
+ "mode": {
3515
+ "description": "How registration certificate data is provided.",
3516
+ "type": "string",
3517
+ "enum": [
3518
+ "import",
3519
+ "generate"
3520
+ ]
3521
+ },
3522
+ "jwt": {
3523
+ "description": "Optional registration certificate JWT when using import mode.",
3524
+ "type": "string"
3525
+ },
3526
+ "privacyPolicy": {
3527
+ "description": "Optional privacy policy URI.",
3528
+ "type": "string"
3529
+ },
3530
+ "supportUri": {
3531
+ "description": "Optional support URI.",
3532
+ "type": "string"
3533
+ }
3534
+ },
3535
+ "additionalProperties": false
3536
+ },
3537
+ {
3538
+ "type": "null"
3539
+ }
3540
+ ]
3541
+ },
3542
+ "display": {
3543
+ "description": "Localized issuer metadata shown to wallets.",
3544
+ "type": "array",
3545
+ "items": {
3546
+ "type": "object",
3547
+ "properties": {
3548
+ "name": {
3549
+ "description": "Issuer display name.",
3550
+ "type": "string"
3551
+ },
3552
+ "locale": {
3553
+ "description": "Locale tag for this display entry.",
3554
+ "type": "string"
3555
+ },
3556
+ "logo": {
3557
+ "description": "Optional issuer logo metadata.",
3558
+ "type": "object",
3559
+ "properties": {
3560
+ "uri": {
3561
+ "type": "string",
3562
+ "minLength": 1,
3563
+ "description": "Logo URI."
3564
+ },
3565
+ "alt_text": {
3566
+ "description": "Optional localized alternative text.",
3567
+ "type": "string"
3568
+ }
3569
+ },
3570
+ "required": [
3571
+ "uri"
3572
+ ],
3573
+ "additionalProperties": {}
3574
+ }
3575
+ },
3576
+ "additionalProperties": {}
3577
+ }
3578
+ },
3579
+ "notificationEndpointEnabled": {
3580
+ "description": "Whether the OID4VCI notification endpoint is exposed for this issuance configuration.",
3581
+ "type": "boolean"
3582
+ },
3583
+ "credentialResponseEncryption": {
3584
+ "description": "Enable encrypted credential responses.",
3585
+ "type": "boolean"
3586
+ },
3587
+ "credentialRequestEncryption": {
3588
+ "description": "Require encrypted credential requests.",
3589
+ "type": "boolean"
3590
+ },
3591
+ "txCodeMaxAttempts": {
3592
+ "description": "Maximum verification attempts for transaction codes. Null resets to defaults.",
3593
+ "anyOf": [
3594
+ {
3595
+ "type": "integer",
3596
+ "minimum": 1,
3597
+ "maximum": 9007199254740991
3598
+ },
3599
+ {
3600
+ "type": "null"
3601
+ }
3602
+ ]
3603
+ },
3604
+ "offerLifetimeSeconds": {
3605
+ "description": "Default lifetime of credential offers in seconds. Can be overridden per offer request. Null or unset: offers do not expire.",
3606
+ "anyOf": [
3607
+ {
3608
+ "type": "integer",
3609
+ "minimum": 1,
3610
+ "maximum": 9007199254740991
3611
+ },
3612
+ {
3613
+ "type": "null"
3614
+ }
3615
+ ]
3616
+ }
3617
+ },
3618
+ "required": [
3619
+ "authorizationServers"
3620
+ ],
3621
+ "additionalProperties": false,
3622
+ "title": "IssuanceConfig"
3623
+ }
3624
+ }
2812
3625
  }
2813
3626
  ]
2814
3627
  }