@eudiplo/cli 9.1.0-main.e7a42e0 → 9.1.0-main.ea0dcd8

package/dist/services/url.d.ts

@@ -0,0 +1,21 @@
+/** Throws unless `value` is an absolute HTTP(S) URL, as config loading requires. */
+export declare function validateHttpUrl(value: string, label: string): void;
+/** True when a URL carries user info such as `user:password@`. */
+export declare function hasUserInfo(value: string): boolean;
+/**
+ * Hides user info such as `user:password@` in a URL before it is printed.
+ * URLs without user info are returned exactly as configured. The masked form
+ * is built from the parsed URL, so spellings the URL parser accepts without
+ * `//`, such as `https:user:secret@host`, are masked too. A value that is not
+ * a URL is hidden entirely if it could contain user info.
+ */
+export declare function redactUrl(value: string): string;
+/** Returns the URL without user info, for handing it to another program. */
+export declare function stripUserInfo(url: URL): URL;
+/**
+ * Describes a failed request without the user info of its URL. Node's fetch
+ * repeats the full URL in some errors, for example "Request cannot be
+ * constructed from a URL that includes credentials: <url>".
+ */
+export declare function describeRequestError(error: unknown, url: URL): string;
+//# sourceMappingURL=url.d.ts.map

package/dist/services/url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url.d.ts","sourceRoot":"","sources":["../../src/services/url.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CASlE;AAED,kEAAkE;AAClE,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAOlD;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAa/C;AAED,4EAA4E;AAC5E,wBAAgB,aAAa,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,CAK3C;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,MAAM,CAGrE"}

package/dist/services/url.js

@@ -0,0 +1,61 @@
+/** Throws unless `value` is an absolute HTTP(S) URL, as config loading requires. */
+export function validateHttpUrl(value, label) {
+    try {
+        const url = new URL(value);
+        if (url.protocol !== "http:" && url.protocol !== "https:") {
+            throw new Error("Unsupported URL protocol.");
+        }
+    }
+    catch {
+        throw new Error(`${label} must be an absolute HTTP(S) URL.`);
+    }
+}
+/** True when a URL carries user info such as `user:password@`. */
+export function hasUserInfo(value) {
+    try {
+        const url = new URL(value);
+        return url.username !== "" || url.password !== "";
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Hides user info such as `user:password@` in a URL before it is printed.
+ * URLs without user info are returned exactly as configured. The masked form
+ * is built from the parsed URL, so spellings the URL parser accepts without
+ * `//`, such as `https:user:secret@host`, are masked too. A value that is not
+ * a URL is hidden entirely if it could contain user info.
+ */
+export function redactUrl(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        return value.includes("@") ? "***" : value;
+    }
+    if (url.username === "" && url.password === "") {
+        return value;
+    }
+    url.username = "***";
+    url.password = "";
+    return url.href;
+}
+/** Returns the URL without user info, for handing it to another program. */
+export function stripUserInfo(url) {
+    const stripped = new URL(url.href);
+    stripped.username = "";
+    stripped.password = "";
+    return stripped;
+}
+/**
+ * Describes a failed request without the user info of its URL. Node's fetch
+ * repeats the full URL in some errors, for example "Request cannot be
+ * constructed from a URL that includes credentials: <url>".
+ */
+export function describeRequestError(error, url) {
+    const message = error instanceof Error ? error.message : String(error);
+    return message.replaceAll(url.href, redactUrl(url.href));
+}
+//# sourceMappingURL=url.js.map

package/dist/services/url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url.js","sourceRoot":"","sources":["../../src/services/url.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,KAAa;IACxD,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACjD,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACL,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,mCAAmC,CAAC,CAAC;IACjE,CAAC;AACL,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,WAAW,CAAC,KAAa;IACrC,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACnC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACD,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IAC/C,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC7C,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,GAAG,CAAC,QAAQ,GAAG,KAAK,CAAC;IACrB,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC;IAClB,OAAO,GAAG,CAAC,IAAI,CAAC;AACpB,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,aAAa,CAAC,GAAQ;IAClC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnC,QAAQ,CAAC,QAAQ,GAAG,EAAE,CAAC;IACvB,QAAQ,CAAC,QAAQ,GAAG,EAAE,CAAC;IACvB,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAc,EAAE,GAAQ;IACzD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC7D,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@eudiplo/cli",
-    "version": "9.1.0-main.e7a42e0",
+    "version": "9.1.0-main.ea0dcd8",
     "description": "Deployment-aware command line tools for EUDIPLO",
     "private": false,
     "type": "module",
@@ -15,11 +15,12 @@
     "scripts": {
         "assets:sync": "node scripts/sync-cli-assets.cjs",
         "assets:check": "node scripts/check-cli-assets.cjs",
+        "build:deps": "pnpm --silent --filter \"@eudiplo/cli^...\" build",
         "build": "pnpm assets:sync && pnpm assets:check && tsc -p tsconfig.json",
         "build:publish": "pnpm build && esbuild src/index.ts --bundle --platform=node --format=esm --target=node22.12 --alias:jsonc-parser=jsonc-parser/lib/esm/main.js --outfile=dist/index.js",
         "build:sea:bundle": "pnpm assets:sync && pnpm assets:check && esbuild src/index.ts --bundle --platform=node --format=esm --target=node22.12 --alias:jsonc-parser=jsonc-parser/lib/esm/main.js --outfile=dist-sea/index.js",
         "build:sea": "node scripts/build-cli-sea.mjs",
-        "dev": "tsx src/index.ts",
+        "dev": "pnpm -s build:deps && tsx src/index.ts",
         "test": "vitest run --root ../.. --project cli",
         "lint": "biome lint .",
         "format": "biome format --write .",
@@ -64,6 +65,6 @@
         "esbuild": "^0.28.2",
         "tsx": "^4.23.15",
         "typescript": "^7.0.2",
-        "vitest": "5.0.3"
+        "vitest": "5.0.4"
     }
 }

package/templates/demo-config/clients/presentation-test.json

@@ -1,5 +1,5 @@
 {
-  "$schema": "https://eudiplo.dev/schemas/v1/ClientConfigFile.schema.json",
+  "$schema": "https://eudiplo.dev/schemas/v2/ClientConfigFile.schema.json",
   "metadata": {
     "generation": 1
   },

package/templates/demo-config/clients/test.json

@@ -1,5 +1,5 @@
 {
-  "$schema": "https://eudiplo.dev/schemas/v1/ClientConfigFile.schema.json",
+  "$schema": "https://eudiplo.dev/schemas/v2/ClientConfigFile.schema.json",
   "metadata": {
     "generation": 1
   },
@@ -12,7 +12,12 @@
       "issuance:offer",
       "issuance:manage",
       "presentation:request",
-      "presentation:manage"
+      "presentation:manage",
+      "registrar:manage",
+      "sessions:read",
+      "credentials:status",
+      "audit:read",
+      "keys:manage"
     ]
   }
 }

package/templates/demo-config/key-chains/attestation.json

@@ -21,7 +21,8 @@
     "kmsProvider": "db",
     "rotationPolicy": {
       "certValidityDays": 30,
-      "enabled": true
+      "enabled": true,
+      "intervalDays": 20
     }
   }
 }

package/templates/demo-config/key-chains/status-list.json

@@ -21,7 +21,8 @@
     "kmsProvider": "db",
     "rotationPolicy": {
       "certValidityDays": 30,
-      "enabled": true
+      "enabled": true,
+      "intervalDays": 20
     }
   }
 }

package/templates/docker-compose.yml

@@ -89,7 +89,7 @@ services:
       - eudiplo-network
 
   rustfs:
-    image: rustfs/rustfs:1.0.0
+    image: rustfs/rustfs:1.0.1
     restart: always
     profiles: ['s3', 'standard', 'full']
     ports:
@@ -114,7 +114,7 @@ services:
 
   # S3 bucket initialization using the AWS CLI
   rustfs-init:
-    image: amazon/aws-cli:2.37.4
+    image: amazon/aws-cli:2.37.10
     profiles: ['s3', 'standard', 'full']
     depends_on:
       rustfs:

package/templates/schemas/ClientConfigFile.schema.json

@@ -9,7 +9,7 @@
       "properties": {
         "$schema": {
           "type": "string",
-          "const": "https://eudiplo.dev/schemas/v1/ClientConfigFile.schema.json"
+          "const": "https://eudiplo.dev/schemas/v2/ClientConfigFile.schema.json"
         },
         "metadata": {
           "type": "object",
@@ -55,6 +55,139 @@
         "spec"
       ],
       "additionalProperties": false
+    },
+    {
+      "$schema": "https://json-schema.org/draft/2020-12/schema",
+      "$id": "https://eudiplo.dev/schemas/v1/ClientConfigFile.schema.json",
+      "title": "ClientConfigFile",
+      "type": "object",
+      "properties": {
+        "$schema": {
+          "type": "string",
+          "const": "https://eudiplo.dev/schemas/v1/ClientConfigFile.schema.json"
+        },
+        "metadata": {
+          "type": "object",
+          "properties": {
+            "generation": {
+              "type": "integer",
+              "minimum": 1,
+              "description": "Monotonically increasing configuration generation."
+            },
+            "ownership": {
+              "type": "string",
+              "enum": [
+                "unmanaged",
+                "file-managed"
+              ],
+              "description": "Requested ownership recorded when the document is applied."
+            }
+          },
+          "additionalProperties": false
+        },
+        "spec": {
+          "allOf": [
+            {
+              "$ref": "#/$defs/CreateClientDto"
+            },
+            {
+              "type": "object",
+              "required": [
+                "clientId"
+              ],
+              "properties": {
+                "clientId": {
+                  "type": "string",
+                  "minLength": 1
+                }
+              }
+            }
+          ]
+        }
+      },
+      "required": [
+        "$schema",
+        "spec"
+      ],
+      "additionalProperties": false,
+      "$defs": {
+        "CreateClientDto": {
+          "type": "object",
+          "properties": {
+            "clientId": {
+              "type": "string",
+              "minLength": 1,
+              "pattern": "^[A-Za-z0-9._:-]+$",
+              "description": "Unique client identifier."
+            },
+            "secret": {
+              "description": "Optional client secret for confidential clients.",
+              "type": "string",
+              "minLength": 1
+            },
+            "description": {
+              "description": "Optional human-readable client description.",
+              "type": "string",
+              "minLength": 1
+            },
+            "roles": {
+              "minItems": 1,
+              "type": "array",
+              "items": {
+                "type": "string",
+                "enum": [
+                  "presentation:manage",
+                  "presentation:request",
+                  "issuance:manage",
+                  "issuance:offer",
+                  "clients:manage",
+                  "users:manage",
+                  "tenants:manage",
+                  "tenant:admin",
+                  "registrar:manage"
+                ]
+              },
+              "description": "Roles assigned to the client. At least one role is required."
+            },
+            "allowedPresentationConfigs": {
+              "description": "Optional allow-list of presentation config ids this client can use.",
+              "anyOf": [
+                {
+                  "type": "array",
+                  "items": {
+                    "type": "string",
+                    "minLength": 1
+                  }
+                },
+                {
+                  "type": "null"
+                }
+              ]
+            },
+            "allowedIssuanceConfigs": {
+              "description": "Optional allow-list of issuance config ids this client can use.",
+              "anyOf": [
+                {
+                  "type": "array",
+                  "items": {
+                    "type": "string",
+                    "minLength": 1
+                  }
+                },
+                {
+                  "type": "null"
+                }
+              ]
+            }
+          },
+          "required": [
+            "clientId",
+            "roles"
+          ],
+          "additionalProperties": false,
+          "title": "CreateClientDto"
+        }
+      }
     }
   ]
 }

package/templates/schemas/CreateClientDto.schema.json

@@ -32,7 +32,11 @@
           "users:manage",
           "tenants:manage",
           "tenant:admin",
-          "registrar:manage"
+          "registrar:manage",
+          "audit:read",
+          "sessions:read",
+          "credentials:status",
+          "keys:manage"
         ]
       },
       "description": "Roles assigned to the client. At least one role is required."

package/templates/schemas/CreateFederationTrustAnchorDto.schema.json

@@ -0,0 +1,82 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "properties": {
+    "id": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 255,
+      "pattern": "^[A-Za-z0-9._-]+$",
+      "description": "Unique identifier of the trust anchor in the tenant."
+    },
+    "entityId": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 2048,
+      "description": "Entity identifier of the trust anchor, exactly as configured in `federation.trustAnchors` and DCQL `openid_federation` values."
+    },
+    "description": {
+      "anyOf": [
+        {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 1000
+        },
+        {
+          "type": "null"
+        }
+      ],
+      "description": "Optional description of the trust anchor."
+    },
+    "jwks": {
+      "type": "object",
+      "properties": {
+        "keys": {
+          "minItems": 1,
+          "maxItems": 20,
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "kty": {
+                "type": "string",
+                "enum": [
+                  "EC",
+                  "RSA",
+                  "OKP"
+                ],
+                "description": "Key type of the public federation key."
+              },
+              "kid": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 256,
+                "description": "Key ID. Federation statements name their signing key with `kid`."
+              }
+            },
+            "required": [
+              "kty",
+              "kid"
+            ],
+            "additionalProperties": {},
+            "description": "Public federation key of the trust anchor as a JWK."
+          },
+          "description": "The trust anchor's federation keys."
+        }
+      },
+      "required": [
+        "keys"
+      ],
+      "additionalProperties": false,
+      "description": "JWK set with the federation keys of the trust anchor, obtained out of band (OpenID Federation 1.0 Section 10.2)."
+    }
+  },
+  "required": [
+    "id",
+    "entityId",
+    "jwks"
+  ],
+  "additionalProperties": false,
+  "$id": "./CreateFederationTrustAnchorDto.schema.json",
+  "title": "CreateFederationTrustAnchorDto"
+}

package/templates/schemas/CreateRegistrarConfigDto.schema.json

@@ -46,6 +46,35 @@
           "type": "null"
         }
       ]
+    },
+    "relyingPartyContact": {
+      "description": "Contact of the relying party, sent when EUDIPLO registers the relying party at the registrar. The registrar needs at least one contact value to issue access certificates. A relying party that is already registered keeps its contact.",
+      "anyOf": [
+        {
+          "type": "object",
+          "properties": {
+            "supportUri": {
+              "description": "https URL where the relying party can be contacted.",
+              "type": "string",
+              "format": "uri"
+            },
+            "email": {
+              "description": "Email address of the relying party.",
+              "type": "string",
+              "pattern": "^[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}$"
+            },
+            "phone": {
+              "description": "Phone number of the relying party.",
+              "type": "string",
+              "pattern": "^[+0-9()\\-\\s]{5,40}$"
+            }
+          },
+          "additionalProperties": false
+        },
+        {
+          "type": "null"
+        }
+      ]
     }
   },
   "required": [

package/templates/schemas/CreateTenantDto.schema.json

@@ -19,7 +19,7 @@
       "minLength": 1
     },
     "roles": {
-      "description": "Optional default role assignments for the tenant.",
+      "description": "Roles of the tenant's admin client `<id>-admin`, which also gets clients:manage. They are all that client can grant, unless they include tenant:admin. Without roles, no admin client is created.",
       "type": "array",
       "items": {
         "type": "string",
@@ -32,7 +32,11 @@
           "clients:manage",
           "users:manage",
           "registrar:manage",
-          "tenant:admin"
+          "tenant:admin",
+          "audit:read",
+          "sessions:read",
+          "credentials:status",
+          "keys:manage"
         ]
       }
     },

package/templates/schemas/CredentialConfigCreate.schema.json

@@ -209,7 +209,7 @@
       ]
     },
     "webhookEndpointId": {
-      "description": "Optional webhook endpoint id notified during issuance events.",
+      "description": "Not used for notifications: they go to the webhook endpoint of the offer.",
       "type": [
         "string",
         "null"
@@ -303,7 +303,7 @@
       ]
     },
     "iaeActions": {
-      "description": "Optional in-app experience actions for wallet flows.",
+      "description": "Interactive authorization steps (a presentation or a web flow) that the wallet completes, in order, before the credential is issued.",
       "anyOf": [
         {
           "type": "array",
@@ -479,16 +479,17 @@
                     "type": "string"
                   },
                   "frameworkType": {
-                    "description": "Trust framework type.",
+                    "description": "Trust framework type. `x509` takes a root certificate in `value` and no `verificationMethod`.",
                     "type": "string",
                     "enum": [
                       "aki",
                       "etsi_tl",
-                      "openid_federation"
+                      "openid_federation",
+                      "x509"
                     ]
                   },
                   "value": {
-                    "description": "Framework-specific authority value.",
+                    "description": "Framework-specific authority value, for example the trust list URL for `etsi_tl` or the root certificate (base64 DER or PEM) for `x509`.",
                     "type": "string"
                   },
                   "verificationMethod": {