@europeum-ebsi/cli 0.0.0 → 1.0.0-rc.0

package/dist/tui/CommandPalette.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CommandPalette.js","sourceRoot":"","sources":["../../src/tui/CommandPalette.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAC1C,OAAO,SAAS,MAAM,gBAAgB,CAAC;AACvC,OAAO,KAAK,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAI7D,OAAO,EACL,WAAW,EACX,QAAQ,EACR,YAAY,EACZ,UAAU,GACX,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,GAAG,CAAC,CAAC;AACtB,MAAM,UAAU,GAAG,MAAM,CAAC;AAC1B,MAAM,WAAW,GAAG,MAAM,CAAC;AAC3B,MAAM,SAAS,GAAG,QAAQ,CAAC;AAC3B,MAAM,WAAW,GAAG,MAAM,CAAC;AAe3B,MAAM,UAAU,cAAc,CAAC,EAC7B,QAAQ,GACY;IACpB,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IACvC,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACtD,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAGpD,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAE5C,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,CAC1E,CAAC,CAAoB,EAAE,CAAoB,EAAE,EAAE,CAC7C,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,CAC9C,CAAC;IACF,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,YAAY,EAAE,YAAY,GAAG,WAAW,CAAC,CAAC;IAKzE,MAAM,aAAa,GAAG,MAAM,CAAgB,IAAI,CAAC,CAAC;IAElD,MAAM,YAAY,GAAG,WAAW,CAAC,CAAC,KAAa,EAAE,EAAE;QACjD,IAAI,aAAa,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YACnC,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC;YAEvC,aAAa,CAAC,OAAO,GAAG,IAAI,CAAC;YAC7B,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACnB,gBAAgB,CAAC,CAAC,CAAC,CAAC;YACpB,eAAe,CAAC,CAAC,CAAC,CAAC;YACnB,OAAO;QACT,CAAC;QACD,QAAQ,CAAC,KAAK,CAAC,CAAC;QAChB,gBAAgB,CAAC,CAAC,CAAC,CAAC;QACpB,eAAe,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,QAAQ,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAGrB,IAAI,IAAI,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YAC7B,aAAa,CAAC,OAAO,GAAG,EAAE,CAAC;YAC3B,QAAQ,CAAC,EAAE,CAAC,CAAC;YACb,gBAAgB,CAAC,CAAC,CAAC,CAAC;YACpB,eAAe,CAAC,CAAC,CAAC,CAAC;YACnB,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1B,OAAO;QACT,CAAC;QAKD,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3D,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrB,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;gBAC9C,aAAa,CAAC,OAAO,GAAG,QAAQ,CAAC;gBACjC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACnB,gBAAgB,CAAC,CAAC,CAAC,CAAC;gBACpB,eAAe,CAAC,CAAC,CAAC,CAAC;gBACnB,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5B,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAElC,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YAChB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,aAAa,GAAG,CAAC,CAAC,CAAC;YAC5C,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAEvB,eAAe,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAChD,CAAC;aAAM,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,aAAa,GAAG,CAAC,CAAC,CAAC;YAC9D,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAEvB,eAAe,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,GAAG,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC;QAClE,CAAC;aAAM,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;YAEnB,MAAM,QAAQ,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC;YACzC,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;gBAC7B,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC;gBAGhC,IAAI,WAAW,GAAG,CAAC,CAAC;gBACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;oBACtC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBAC/C,IAAI,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;wBACnC,WAAW,GAAG,CAAC,GAAG,CAAC,CAAC;wBACpB,MAAM;oBACR,CAAC;oBACD,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;wBACvB,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;oBAC9C,CAAC;gBACH,CAAC;gBACD,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC;gBACtD,gBAAgB,CAAC,CAAC,CAAC,CAAC;gBACpB,eAAe,CAAC,CAAC,CAAC,CAAC;gBACnB,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,WAAW,CAC9B,CAAC,KAAa,EAAE,EAAE;QAChB,MAAM,QAAQ,GAAG,QAAQ,CAAC,aAAa,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC;QACxD,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC,EACD,CAAC,QAAQ,EAAE,QAAQ,EAAE,aAAa,CAAC,CACpC,CAAC;IAEF,MAAM,UAAU,GAAG,YAAY,CAAC;IAChC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,GAAG,YAAY,GAAG,WAAW,CAAC,CAAC;IAE7E,OAAO,CACL,MAAC,GAAG,IAAC,aAAa,EAAC,QAAQ,EAAC,QAAQ,EAAE,CAAC,aAErC,MAAC,GAAG,IAAC,YAAY,EAAE,CAAC,aAClB,KAAC,IAAI,IAAC,IAAI,QAAC,KAAK,EAAE,WAAW,YAC1B,IAAI,GACA,EACP,KAAC,SAAS,IAER,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,YAAY,EACtB,WAAW,EAAC,gFAAiE,EAC7E,KAAK,EAAE,KAAK,IAJP,QAAQ,CAKb,IACE,EAGL,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CACvB,KAAC,IAAI,IAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,sGAE1B,CACR,CAAC,CAAC,CAAC,CACF,MAAC,GAAG,IAAC,aAAa,EAAC,QAAQ,aAEzB,KAAC,IAAI,IAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,kBAC9B,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,UAAU,OAAO,CAAC,CAAC,CAAC,GAAG,GAC3C,EAEN,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;wBACtB,MAAM,aAAa,GAAG,YAAY,GAAG,CAAC,CAAC;wBACvC,MAAM,UAAU,GAAG,aAAa,KAAK,aAAa,CAAC;wBACnD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;wBAC9B,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI;6BACtB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;6BACxD,IAAI,CAAC,GAAG,CAAC,CAAC;wBAEb,OAAO,CACL,MAAC,GAAG,IAAc,QAAQ,EAAE,CAAC,aAC3B,MAAC,IAAI,OACC,CAAC,UAAU,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,CAAC,EACpD,IAAI,EAAE,UAAU,EAChB,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,aAExC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,EACjC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IACf,EACN,QAAQ,IAAI,CACX,KAAC,IAAI,IAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,kBAC9B,QAAQ,GAAG,GAAG,GACV,CACR,EACD,KAAC,IAAI,IAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,kBAC7B,IAAI,GAAG,GAAG,CAAC,OAAO,GACd,KAhBC,GAAG,CAAC,EAAE,CAiBV,CACP,CAAC;oBACJ,CAAC,CAAC,EAGF,KAAC,IAAI,IAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,kBAC9B,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,UAAU,OAAO,CAAC,CAAC,CAAC,GAAG,GAC3C,IACH,CACP,EAGD,KAAC,GAAG,IAAC,SAAS,EAAE,CAAC,YACf,KAAC,IAAI,IAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,kBAE7B,sEAAsE,GAEnE,GACH,IACF,CACP,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,121 +1,79 @@
 {
   "name": "@europeum-ebsi/cli",
-  "version": "0.0.0",
-  "description": "EBSI Command Line Interface",
+  "version": "1.0.0-rc.0",
+  "description": "EBSI CLI",
   "license": "EUPL-1.2",
-  "type": "module",
-  "main": "dist/index.js",
-  "types": "dist/index.d.ts",
-  "files": [
-    "bin",
-    "dist"
-  ],
-  "publishConfig": {
-    "access": "public"
+  "repository": {
+    "type": "git",
+    "url": "git+https://gitlab.com/europeum/public/core.git",
+    "directory": "cli"
   },
+  "type": "module",
   "bin": {
-    "cli": "bin/cli.js"
+    "ebsi": "./dist/index.js"
   },
-  "scripts": {
-    "audit": "audit-ci --config audit-ci.jsonc",
-    "build": "rimraf dist && tsc --project tsconfig.build.json && cpy . ../../dist/scripts --cwd=src/scripts",
-    "dev": "node --loader ts-node/esm src/cli.ts",
-    "lint-staged": "lint-staged",
-    "lint": "pnpm run lint:eslint && pnpm run lint:tsc && pnpm run lint:prettier",
-    "lint:eslint": "eslint . --ext .js,.mjs,.cjs,.ts",
-    "lint:tsc": "tsc --noEmit --incremental false",
-    "lint:prettier": "prettier . --check",
-    "prepare": "husky && pnpm run build",
-    "prepare:release": "release-it --ci",
-    "program:migrate": "ts-node --esm src/programs/migrateDids.ts",
-    "program:migrateTsr": "node --loader ts-node/esm src/programs/migrateTsr.ts",
-    "start": "node dist/cli",
-    "test": "vitest --run",
-    "test:ci": "vitest --run unit",
-    "test:authorisation": "vitest --run authorisation.spec.ts",
-    "test:did": "vitest --run did.spec.ts",
-    "test:essentials": "vitest --run essentials.spec.ts",
-    "test:ledger": "vitest --run ledger.spec.ts",
-    "test:tar": "vitest --run tar.spec.ts",
-    "test:timestamp": "vitest --run timestamp.spec.ts",
-    "test:tir": "vitest --run tir.spec.ts",
-    "test:tnt": "vitest --run tnt.spec.ts",
-    "test:tpr": "vitest --run tpr.spec.ts",
-    "test:tsr": "vitest --run tsr.spec.ts",
-    "test:accredit-and-authorize": "vitest --run accredit-and-authorize.spec.ts",
-    "test:holder-wallet": "vitest --run holder-wallet.spec.ts",
-    "test:issue-to-holder": "vitest --run issue-to-holder.spec.ts",
-    "test:verifier": "vitest --run verifier.spec.ts",
-    "test:pda1": "vitest --run pda1.spec.ts",
-    "test:trust-model": "vitest --run trust-model-vcdm2.spec.ts",
-    "knip": "knip"
+  "publishConfig": {
+    "access": "public"
   },
+  "files": [
+    "dist",
+    "LICENSES.txt",
+    "src"
+  ],
+  "keywords": [
+    "europeum",
+    "ebsi",
+    "cli"
+  ],
   "dependencies": {
-    "@apidevtools/json-schema-ref-parser": "11.5.4",
-    "@europeum-ebsi/did-jwt": "0.0.0",
-    "@europeum-ebsi/ebsi-did-resolver": "0.0.1",
-    "@europeum-ebsi/key-did-resolver": "0.0.0",
-    "@europeum-ebsi/verifiable-credential": "0.1.0",
-    "@europeum-ebsi/verifiable-presentation": "0.1.0",
-    "@europeum-ebsi/wallet-lib": "0.0.1",
-    "@noble/curves": "2.0.1",
-    "asn1js": "3.0.7",
-    "axios": "1.15.0",
-    "canonicalize": "2.1.0",
-    "chalk": "5.6.2",
-    "did-resolver": "4.1.0",
-    "dotenv": "17.4.1",
-    "ethers": "6.16.0",
-    "form-data": "4.0.5",
-    "https-proxy-agent": "9.0.0",
-    "joi": "18.1.2",
-    "jose": "6.2.2",
-    "lodash.set": "4.3.2",
-    "multiformats": "13.4.2",
-    "pkijs": "3.4.0",
-    "qs": "6.15.0"
-  },
-  "optionalDependencies": {
-    "graphene-pk11": "2.3.6"
+    "@europeum-ebsi/api-contract": "1.0.0-rc.0",
+    "@europeum-ebsi/did-jwt": "1.0.0-rc.0",
+    "@europeum-ebsi/did-registry-contract": "1.0.0-rc.0",
+    "@europeum-ebsi/ebsi-uri": "1.0.0-rc.0",
+    "@europeum-ebsi/issuers-registry-contract": "1.0.0-rc.0",
+    "@europeum-ebsi/policies-registry-contract": "1.0.0-rc.0",
+    "@europeum-ebsi/schemas-registry-contract": "1.0.0-rc.0",
+    "@europeum-ebsi/timestamp-contract": "1.0.0-rc.0",
+    "@europeum-ebsi/track-and-trace-contract": "1.0.0-rc.0",
+    "@europeum-ebsi/vcdm1.1-attestation-schema": "0.0.0",
+    "@europeum-ebsi/verifiable-credential": "1.0.0-rc.0",
+    "@europeum-ebsi/verifiable-presentation": "1.0.0-rc.0",
+    "@europeum-ebsi/wallet": "1.0.0-rc.0",
+    "commander": "15.0.0",
+    "env-paths": "4.0.0",
+    "ethers": "6.17.0",
+    "ink": "7.1.1",
+    "ink-text-input": "6.0.0",
+    "jose": "5.10.0",
+    "openapi-fetch": "0.17.0",
+    "picocolors": "1.1.1",
+    "react": "19.3.0"
   },
   "devDependencies": {
-    "@commitlint/cli": "20.5.0",
-    "@commitlint/config-conventional": "20.5.0",
-    "@eslint/js": "10.0.1",
-    "@release-it/conventional-changelog": "10.0.6",
-    "@sphereon/pex-models": "2.3.2",
-    "@total-typescript/ts-reset": "0.6.1",
-    "@tsconfig/node24": "24.0.4",
+    "@nomicfoundation/hardhat-ethers": "4.1.0",
+    "@tsconfig/node24": "24.0.5",
     "@tsconfig/strictest": "2.0.8",
-    "@types/lodash.set": "4.3.9",
-    "@types/node": "24.12.0",
-    "@types/qs": "6.15.0",
-    "@typescript-eslint/eslint-plugin": "8.58.0",
-    "@typescript-eslint/parser": "8.58.0",
-    "@vitest/eslint-plugin": "1.6.14",
-    "audit-ci": "7.1.0",
-    "cpy-cli": "7.0.0",
-    "eslint": "10.2.0",
-    "eslint-config-prettier": "10.1.8",
-    "eslint-import-resolver-typescript": "4.4.4",
-    "eslint-plugin-import-x": "4.16.2",
-    "eslint-plugin-perfectionist": "5.8.0",
-    "eslint-plugin-prettier": "5.5.5",
-    "eslint-plugin-regexp": "3.1.0",
-    "eslint-plugin-unicorn": "64.0.0",
-    "globals": "17.4.0",
-    "husky": "9.1.7",
-    "knip": "6.3.0",
-    "lint-staged": "16.4.0",
-    "prettier": "3.8.1",
-    "read-pkg": "10.1.0",
-    "release-it": "19.2.4",
+    "@types/node": "24.13.6",
+    "@types/react": "19.3.0",
+    "@vitest/coverage-v8": "5.0.1",
+    "get-port": "7.2.0",
+    "hardhat": "3.17.0",
     "rimraf": "6.1.3",
-    "spdx-license-list": "6.11.0",
-    "ts-node": "10.9.2",
-    "typescript": "6.0.2",
-    "typescript-eslint": "8.58.0",
-    "vitest": "4.1.2"
+    "typescript": "6.0.3",
+    "vite": "8.3.0",
+    "vitest": "5.0.1"
   },
-  "packageManager": "pnpm@10.33.0+sha512.10568bb4a6afb58c9eb3630da90cc9516417abebd3fabbe6739f0ae795728da1491e9db5a544c76ad8eb7570f5c4bb3d6c637b2cb41bfdcdb47fa823c8649319"
-}
+  "scripts": {
+    "build": "tsc -p tsconfig/tsconfig.build.esm.json",
+    "clean": "rimraf coverage dist",
+    "coverage": "pnpm run test:unit --coverage --reporter=default",
+    "lint": "pnpm run lint:tsc",
+    "lint:tsc": "tsc --noEmit --incremental false",
+    "setup": "exit 0",
+    "test": "vitest --run",
+    "test:ci": "pnpm run coverage && pnpm run test:integration",
+    "test:e2e": "echo \"Info: there's no e2e tests for @europeum-ebsi/cli\" && exit 0",
+    "test:integration": "pnpm run test integration",
+    "test:unit": "pnpm run test unit"
+  }
+}

package/src/api/client.ts

@@ -0,0 +1,26 @@
+import type { paths } from "@europeum-ebsi/api-contract/types";
+
+import createClient from "openapi-fetch";
+
+export type ApiClient = ReturnType<typeof makeClient>;
+
+/**
+ * Creates a type-safe openapi-fetch client bound to the given base URL.
+ * The base URL must already include the `/v1` prefix (e.g. "https://api-test.testnode02.ebsi.eu/v1").
+ *
+ * When a Bearer `token` is provided every request will include an
+ * `Authorization: Bearer <token>` header. This is needed for write methods on
+ * `POST /ledger` (e.g. `eth_sendRawTransaction`).
+ */
+export function makeClient(baseUrl: string, token?: string) {
+  const client = createClient<paths>({ baseUrl });
+  if (token) {
+    client.use({
+      onRequest({ request }) {
+        request.headers.set("Authorization", `Bearer ${token}`);
+        return request;
+      },
+    });
+  }
+  return client;
+}

package/src/api/fetch.ts

@@ -0,0 +1,53 @@
+import type { CliConfig } from "../config/config.ts";
+
+import { makeClient } from "./client.ts";
+
+/**
+ * Cached client instances keyed by `baseUrl\0token`
+ */
+const clients = new Map<string, ReturnType<typeof makeClient>>();
+
+/**
+ * Represents a failed API response
+ */
+export class ApiError extends Error {
+  readonly detail: unknown;
+  readonly status: number;
+
+  constructor(status: number, detail: unknown) {
+    const message =
+      typeof detail === "object" && detail !== null && "title" in detail
+        ? String((detail as Record<string, unknown>)["title"])
+        : `HTTP ${status}`;
+    super(message);
+    this.name = "ApiError";
+    this.status = status;
+    this.detail = detail;
+  }
+}
+
+export function getClient(config: CliConfig) {
+  const cacheKey = `${config.baseUrl}\0${config.token ?? ""}`;
+  const existing = clients.get(cacheKey);
+  if (existing) return existing;
+  const client = makeClient(config.baseUrl, config.token);
+  clients.set(cacheKey, client);
+  return client;
+}
+
+/**
+ * Unwraps an openapi-fetch result, throwing ApiError on any non-2xx response
+ * or network error.
+ */
+export function unwrap<T>({
+  data,
+  error,
+  response,
+}: {
+  data?: T;
+  error?: unknown;
+  response: Response;
+}): T {
+  if (data !== undefined) return data;
+  throw new ApiError(response.status, error);
+}

package/src/api/params.ts

@@ -0,0 +1,17 @@
+/**
+ * Builds a clean query-params object by removing undefined values.
+ *
+ * With `exactOptionalPropertyTypes: true`, TypeScript disallows explicit
+ * `undefined` values in optional properties. This helper accepts an object
+ * that may contain `undefined` values and returns one that only contains
+ * the defined entries, satisfying the strict type check.
+ */
+export function q<T extends Record<string, unknown>>(
+  obj: T,
+): { [K in keyof T]?: NonNullable<T[K]> } {
+  const result: Record<string, unknown> = {};
+  for (const [k, v] of Object.entries(obj)) {
+    if (v !== undefined && v !== "") result[k] = v;
+  }
+  return result as { [K in keyof T]?: NonNullable<T[K]> };
+}

package/src/auth/dcql.ts

@@ -0,0 +1,84 @@
+import { SELF_ATTESTATION_VC_TYPE } from "@europeum-ebsi/api-contract/scopes";
+import { createJWT } from "@europeum-ebsi/did-jwt";
+import { metadata as attestationMetadata } from "@europeum-ebsi/vcdm1.1-attestation-schema";
+import { randomUUID } from "node:crypto";
+
+import type { KeyMaterial } from "../crypto/wallet.ts";
+
+// `SELF_ATTESTATION_VC_TYPE`/`dcqlCredentialQueryId` are shared with `api`
+// via `@europeum-ebsi/api-contract/scopes` (the single source of truth for
+// both), since the CLI must build a self-attestation credential and address
+// it under the exact same DCQL credential-query id the server expects.
+export { dcqlCredentialQueryId } from "@europeum-ebsi/api-contract/scopes";
+
+/**
+ * Builds the `vp_token` for the OpenID4VP 1.0 (final)/DCQL grant: a
+ * JSON-encoded object keyed by DCQL credential-query id (see
+ * https://openid.net/specs/openid-4-verifiable-presentations-1_0-final.html#section-8.1),
+ * e.g. `{"self_attestation_credential": ["eyJ..."]}`.
+ */
+export function buildDcqlVpToken(
+  credentialQueryId: string,
+  vpJwt: string,
+): string {
+  return JSON.stringify({ [credentialQueryId]: [vpJwt] });
+}
+
+/**
+ * Creates and signs the self-issued Verifiable Credential a combinable
+ * scope's DCQL query requires (see `SELF_ATTESTATION_VC_TYPE` above):
+ * `iss`/`vc.issuer` and `sub`/`credentialSubject.id` are both the wallet's
+ * own DID, deliberately with no `termsOfUse`. This carries no trust-chain
+ * meaning of its own, but the server's shared VP/VC verification pipeline
+ * still unconditionally structurally validates every embedded credential
+ * against the EBSI Verifiable Attestation schema, so `id`, `issuanceDate`,
+ * `issued`, `validFrom` and `credentialSchema` are all required even though
+ * this is a placeholder -- hence `createJWT` directly (rather than the full
+ * `createVerifiableCredentialJwt`) to control the `type` array precisely
+ * (DCQL matches on `SELF_ATTESTATION_VC_TYPE`, not `VerifiableAttestation`).
+ * `credentialSchema` references the generic "VerifiableAttestation" schema
+ * itself, bundled with and pre-registered by
+ * `@europeum-ebsi/vcdm1.1-attestation-schema`, so this validates with no
+ * network dependency and no new Schemas Registry entry.
+ */
+export function createSelfAttestationVcJwt(signingKey: KeyMaterial): string {
+  const { alg, did, kid, signer } = signingKey.issuer;
+  const issuanceDate = new Date();
+  const issued = `${issuanceDate.toISOString().slice(0, -5)}Z`;
+  const iat = Math.floor(issuanceDate.getTime() / 1000);
+  const id = `urn:uuid:${randomUUID()}`;
+
+  return createJWT(
+    {
+      iat,
+      iss: did,
+      jti: id,
+      nbf: iat,
+      sub: did,
+      vc: {
+        "@context": ["https://www.w3.org/2018/credentials/v1"],
+        credentialSchema: {
+          // Must be a well-formed URI whose last path segment is the schema
+          // id ajv already has pre-registered (see `validateCredentialSchema`
+          // in `libs/verifiable-credential`) -- the host is never
+          // dereferenced since the lookup succeeds locally first.
+          id: `https://schemas-registry.example/schemas/${attestationMetadata.id.base16}`,
+          type: "FullJsonSchemaValidator2021",
+        },
+        credentialSubject: { id: did },
+        id,
+        issuanceDate: issued,
+        issued,
+        issuer: did,
+        type: [
+          "VerifiableCredential",
+          "VerifiableAttestation",
+          SELF_ATTESTATION_VC_TYPE,
+        ],
+        validFrom: issued,
+      },
+    },
+    { signer },
+    { alg, kid, typ: "JWT" },
+  );
+}

package/src/auth/presentation.ts

@@ -0,0 +1,255 @@
+import {
+  CUSTOM_SCOPES,
+  dcqlCredentialQueryId,
+  mergedPresentationDefinitionId,
+  parseScopeToken as parseSharedScopeToken,
+  COMBINABLE_SCOPES as SHARED_COMBINABLE_SCOPES,
+} from "@europeum-ebsi/api-contract/scopes";
+
+/**
+ * Derives the `presentation_submission` for each EBSI authorisation scope.
+ *
+ * The scope grammar itself -- known families, combinability, and token
+ * parsing -- is shared with the API via `@europeum-ebsi/api-contract/scopes` (the single
+ * source of truth for both, embedded in and exported by the API package).
+ * What's below is CLI-specific: which scopes need a VC in the VP, and how to
+ * build the actual `presentation_submission` payload.
+ *
+ * Rules:
+ * - Scopes that need a VC in the VP: did-registry:invite, ledger:invoke, issuers-registry:invite, track-and-trace:authorise
+ * - All others (write / create scopes): empty VP (verifiableCredential: [], descriptor_map: [])
+ *
+ * A single access token may also combine several "write" scopes (e.g.
+ * `"did-registry:write issuers-registry:write"`), in which case the API returns a merged
+ * Presentation Definition and expects the client to echo its `definition_id`
+ * back — see `mergedDefinitionId` below.
+ *
+ * Every scope may optionally be suffixed with `:<0x-address>` (e.g.
+ * `"track-and-trace:write:0x61c36a8d610163660E21a8b7359e1Cac0C9133e1"`) to target a
+ * specific deployed beacon-proxy instance of that scope's registry instead of
+ * the environment-configured default. The suffix is part of what gets sent to
+ * the API verbatim (see `getAccessToken` in `./token.ts`), but is stripped
+ * down to its "family" (`<registry>:<action>`) before deriving Presentation
+ * Definition ids and before running the rules below (unknown-scope,
+ * duplicate, combinability).
+ */
+
+/**
+ * The set of scope families that require a real VC in the VP
+ */
+const VC_REQUIRED_SCOPES = new Set([
+  "did-registry:invite",
+  "issuers-registry:invite",
+  "ledger:invoke",
+  "track-and-trace:authorise",
+]);
+
+/**
+ * Scope families that can be combined together in a single access token
+ * request, e.g. `"did-registry:write issuers-registry:write"`. Every scope here uses the empty-VP
+ * pattern and gates an independent registry check, so combining them is a
+ * pure AND with no privilege escalation.
+ */
+export const COMBINABLE_SCOPES = new Set<string>(SHARED_COMBINABLE_SCOPES);
+
+/**
+ * All EBSI authorisation scope families the CLI knows about.
+ */
+export const KNOWN_SCOPES = CUSTOM_SCOPES;
+
+/**
+ * A single parsed scope token, e.g. `"track-and-trace:write:0xAbc..."` -> `{ family: "track-and-trace:write", targetAddress: "0xAbc..." }`.
+ */
+export interface ParsedScope {
+  family: string;
+  targetAddress?: string;
+}
+
+export interface PresentationSubmission {
+  definition_id: string;
+  descriptor_map: PresentationDescriptor[];
+  id: string;
+}
+
+interface PresentationDescriptor {
+  format: string;
+  id: string;
+  path: string;
+  path_nested: {
+    format: string;
+    id: string;
+    path: string;
+  };
+}
+
+/**
+ * Builds the `presentation_submission` object for the given scope (single or
+ * space-separated multi-scope).
+ *
+ * For a single VC-required scope, the descriptor_map contains one entry
+ * pointing to `$.vp.verifiableCredential[0]`. For write/create scopes — and
+ * for any combined multi-scope request, which is always drawn from the
+ * combinable write scopes — the descriptor_map is empty (empty VP pattern).
+ */
+export function buildPresentationSubmission(
+  scope: string,
+  submissionId: string,
+): PresentationSubmission {
+  const families = scopeFamilies(scope);
+  const definitionId = mergedDefinitionId(families);
+
+  if (families.length === 1 && requiresVc(scope)) {
+    const soleFamily = families[0]!;
+    const credentialId = dcqlCredentialQueryId(soleFamily);
+    return {
+      definition_id: definitionId,
+      descriptor_map: [
+        {
+          format: "jwt_vp",
+          id: credentialId,
+          path: "$",
+          path_nested: {
+            format: "jwt_vc",
+            id: credentialId,
+            path: "$.vp.verifiableCredential[0]",
+          },
+        },
+      ],
+      id: submissionId,
+    };
+  }
+
+  // Empty VP pattern (write/create scopes, including combined multi-scope requests)
+  return {
+    definition_id: definitionId,
+    descriptor_map: [],
+    id: submissionId,
+  };
+}
+
+/**
+ * Builds the `definition_id` of the (possibly merged) Presentation Definition
+ * for the given scope families, delegating to the shared
+ * `mergedPresentationDefinitionId`. Scopes are sorted alphabetically so the id
+ * doesn't depend on request order, and colons are mapped to underscores since
+ * Presentation Definition ids stay underscore-form even though scopes are
+ * colon-form (so a target instance address can be appended to a scope without
+ * ever touching the id). For a single scope this is the identity:
+ * `"<scope_with_underscores>_presentation"`.
+ */
+export function mergedDefinitionId(families: string[]): string {
+  return mergedPresentationDefinitionId(
+    families as (typeof CUSTOM_SCOPES)[number][],
+  );
+}
+
+/**
+ * Splits a scope string into its individual scope tokens, e.g.
+ * `"openid did-registry:write issuers-registry:write"` or `"did-registry:write issuers-registry:write"` both yield
+ * `["did-registry:write", "issuers-registry:write"]` — a leading `"openid"` token is dropped when
+ * present. Each token may carry a `:<0x-address>` targeting suffix; this
+ * function does not parse or validate that — see `parseScopeToken` /
+ * `scopeFamilies` for that.
+ */
+export function parseScopes(scope: string): string[] {
+  const tokens = scope.trim().split(/\s+/).filter(Boolean);
+  return tokens[0] === "openid" ? tokens.slice(1) : tokens;
+}
+
+/**
+ * Parses a single scope token (no leading "openid", no spaces). Delegates the
+ * actual grammar (2-or-3 colon-delimited segments, known family, valid
+ * Ethereum address suffix) to the shared `parseScopeToken`, adapting its
+ * `{ scope, targetAddress }` shape to this module's own `{ family,
+ * targetAddress }` `ParsedScope`.
+ */
+export function parseScopeToken(token: string): ParsedScope | undefined {
+  const parsed = parseSharedScopeToken(token);
+  if (!parsed) {
+    return undefined;
+  }
+
+  return {
+    family: parsed.scope,
+    ...(parsed.targetAddress && { targetAddress: parsed.targetAddress }),
+  };
+}
+
+/**
+ * Returns true when the given scope requires a real VC to be placed in the
+ * VP. Only ever true for a single VC-required scope — a combined multi-scope
+ * request is always drawn from the combinable (empty-VP) write scopes, so it
+ * never requires a VC.
+ */
+export function requiresVc(scope: string): boolean {
+  const tokens = parseScopes(scope);
+  if (tokens.length !== 1) {
+    return false;
+  }
+  const parsed = parseScopeToken(tokens[0]!);
+  return parsed !== undefined && VC_REQUIRED_SCOPES.has(parsed.family);
+}
+
+/**
+ * Splits a scope string into its scope *families* (targeting addresses
+ * stripped), e.g. `"track-and-trace:write:0xAbc..."` -> `"track-and-trace:write"`. Throws a
+ * descriptive `Error` if any token fails to parse (unknown family or a
+ * malformed address suffix).
+ */
+export function scopeFamilies(scope: string): string[] {
+  return parseScopes(scope).map((token) => {
+    const parsed = parseScopeToken(token);
+    if (!parsed) {
+      throw new Error(
+        `Invalid scope token "${token}". Expected "<registry>:<action>", optionally ` +
+          `suffixed with ":<0x-address>" to target a specific contract instance. ` +
+          `Known scopes: ${KNOWN_SCOPES.join(", ")}`,
+      );
+    }
+    return parsed.family;
+  });
+}
+
+/**
+ * Validates a scope string against the same rules enforced by the
+ * Authorisation service's `IsScope` validator: every token must parse (known
+ * family, optionally a valid `:<0x-address>` suffix), no duplicate families
+ * (an address suffix doesn't distinguish a family — `did-registry:write` and
+ * `did-registry:write:0x...` collide), and — when more than one scope is requested —
+ * every family must be in `COMBINABLE_SCOPES` (the invite / `ledger:invoke`
+ * scopes can only ever be requested alone).
+ *
+ * Throws a descriptive `Error` when invalid; returns void otherwise.
+ */
+export function validateScope(scope: string): void {
+  const tokens = parseScopes(scope);
+
+  if (tokens.length === 0) {
+    throw new Error(
+      `Missing scope. Provide one of: ${KNOWN_SCOPES.join(", ")}`,
+    );
+  }
+
+  // Throws with a descriptive message if any token is unknown or malformed.
+  const families = scopeFamilies(scope);
+
+  const seen = new Set<string>();
+  const duplicates = new Set<string>();
+  for (const family of families) {
+    if (seen.has(family)) duplicates.add(family);
+    seen.add(family);
+  }
+  if (duplicates.size > 0) {
+    throw new Error(`Duplicate scope(s): ${[...duplicates].join(", ")}`);
+  }
+
+  if (families.length <= 1) return;
+
+  const nonCombinable = families.filter((f) => !COMBINABLE_SCOPES.has(f));
+  if (nonCombinable.length > 0) {
+    throw new Error(
+      `Scope(s) "${nonCombinable.join(", ")}" cannot be combined with other scopes. ` +
+        `Only these scopes may be combined in a single token: ${[...COMBINABLE_SCOPES].join(", ")}.`,
+    );
+  }
+}