@europeum-ebsi/cli 0.0.0 → 1.0.0-rc.0

package/dist/api/client.d.ts

@@ -0,0 +1,4 @@
+import type { paths } from "@europeum-ebsi/api-contract/types";
+export type ApiClient = ReturnType<typeof makeClient>;
+export declare function makeClient(baseUrl: string, token?: string): import("openapi-fetch").Client<paths, `${string}/${string}`>;
+//# sourceMappingURL=client.d.ts.map

package/dist/api/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mCAAmC,CAAC;AAI/D,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC;AAUtD,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,gEAWzD"}

package/dist/api/client.js

@@ -0,0 +1,14 @@
+import createClient from "openapi-fetch";
+export function makeClient(baseUrl, token) {
+    const client = createClient({ baseUrl });
+    if (token) {
+        client.use({
+            onRequest({ request }) {
+                request.headers.set("Authorization", `Bearer ${token}`);
+                return request;
+            },
+        });
+    }
+    return client;
+}
+//# sourceMappingURL=client.js.map

package/dist/api/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAEA,OAAO,YAAY,MAAM,eAAe,CAAC;AAYzC,MAAM,UAAU,UAAU,CAAC,OAAe,EAAE,KAAc;IACxD,MAAM,MAAM,GAAG,YAAY,CAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IAChD,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,CAAC,GAAG,CAAC;YACT,SAAS,CAAC,EAAE,OAAO,EAAE;gBACnB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;gBACxD,OAAO,OAAO,CAAC;YACjB,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/api/fetch.d.ts

@@ -0,0 +1,13 @@
+import type { CliConfig } from "../config/config.ts";
+export declare class ApiError extends Error {
+    readonly detail: unknown;
+    readonly status: number;
+    constructor(status: number, detail: unknown);
+}
+export declare function getClient(config: CliConfig): import("openapi-fetch").Client<import("@europeum-ebsi/api-contract/types").paths, `${string}/${string}`>;
+export declare function unwrap<T>({ data, error, response, }: {
+    data?: T;
+    error?: unknown;
+    response: Response;
+}): T;
+//# sourceMappingURL=fetch.d.ts.map

package/dist/api/fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../../src/api/fetch.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAYrD,qBAAa,QAAS,SAAQ,KAAK;IACjC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO;CAU5C;AAED,wBAAgB,SAAS,CAAC,MAAM,EAAE,SAAS,4GAO1C;AAMD,wBAAgB,MAAM,CAAC,CAAC,EAAE,EACxB,IAAI,EACJ,KAAK,EACL,QAAQ,GACT,EAAE;IACD,IAAI,CAAC,EAAE,CAAC,CAAC;IACT,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,QAAQ,CAAC;CACpB,GAAG,CAAC,CAGJ"}

package/dist/api/fetch.js

@@ -0,0 +1,30 @@
+import { makeClient } from "./client.js";
+const clients = new Map();
+export class ApiError extends Error {
+    detail;
+    status;
+    constructor(status, detail) {
+        const message = typeof detail === "object" && detail !== null && "title" in detail
+            ? String(detail["title"])
+            : `HTTP ${status}`;
+        super(message);
+        this.name = "ApiError";
+        this.status = status;
+        this.detail = detail;
+    }
+}
+export function getClient(config) {
+    const cacheKey = `${config.baseUrl}\0${config.token ?? ""}`;
+    const existing = clients.get(cacheKey);
+    if (existing)
+        return existing;
+    const client = makeClient(config.baseUrl, config.token);
+    clients.set(cacheKey, client);
+    return client;
+}
+export function unwrap({ data, error, response, }) {
+    if (data !== undefined)
+        return data;
+    throw new ApiError(response.status, error);
+}
+//# sourceMappingURL=fetch.js.map

package/dist/api/fetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch.js","sourceRoot":"","sources":["../../src/api/fetch.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAKzC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAyC,CAAC;AAKjE,MAAM,OAAO,QAAS,SAAQ,KAAK;IACxB,MAAM,CAAU;IAChB,MAAM,CAAS;IAExB,YAAY,MAAc,EAAE,MAAe;QACzC,MAAM,OAAO,GACX,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,IAAI,MAAM;YAChE,CAAC,CAAC,MAAM,CAAE,MAAkC,CAAC,OAAO,CAAC,CAAC;YACtD,CAAC,CAAC,QAAQ,MAAM,EAAE,CAAC;QACvB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,MAAM,UAAU,SAAS,CAAC,MAAiB;IACzC,MAAM,QAAQ,GAAG,GAAG,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;IAC5D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IACxD,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC9B,OAAO,MAAM,CAAC;AAChB,CAAC;AAMD,MAAM,UAAU,MAAM,CAAI,EACxB,IAAI,EACJ,KAAK,EACL,QAAQ,GAKT;IACC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAC7C,CAAC"}

package/dist/api/params.d.ts

@@ -0,0 +1,4 @@
+export declare function q<T extends Record<string, unknown>>(obj: T): {
+    [K in keyof T]?: NonNullable<T[K]>;
+};
+//# sourceMappingURL=params.d.ts.map

package/dist/api/params.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"params.d.ts","sourceRoot":"","sources":["../../src/api/params.ts"],"names":[],"mappings":"AAQA,wBAAgB,CAAC,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjD,GAAG,EAAE,CAAC,GACL;KAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CAAE,CAMxC"}

package/dist/api/params.js

@@ -0,0 +1,9 @@
+export function q(obj) {
+    const result = {};
+    for (const [k, v] of Object.entries(obj)) {
+        if (v !== undefined && v !== "")
+            result[k] = v;
+    }
+    return result;
+}
+//# sourceMappingURL=params.js.map

package/dist/api/params.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"params.js","sourceRoot":"","sources":["../../src/api/params.ts"],"names":[],"mappings":"AAQA,MAAM,UAAU,CAAC,CACf,GAAM;IAEN,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE;YAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,MAAgD,CAAC;AAC1D,CAAC"}

package/dist/auth/dcql.d.ts

@@ -0,0 +1,5 @@
+import type { KeyMaterial } from "../crypto/wallet.ts";
+export { dcqlCredentialQueryId } from "@europeum-ebsi/api-contract/scopes";
+export declare function buildDcqlVpToken(credentialQueryId: string, vpJwt: string): string;
+export declare function createSelfAttestationVcJwt(signingKey: KeyMaterial): string;
+//# sourceMappingURL=dcql.d.ts.map

package/dist/auth/dcql.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dcql.d.ts","sourceRoot":"","sources":["../../src/auth/dcql.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAMvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAQ3E,wBAAgB,gBAAgB,CAC9B,iBAAiB,EAAE,MAAM,EACzB,KAAK,EAAE,MAAM,GACZ,MAAM,CAER;AAmBD,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,WAAW,GAAG,MAAM,CAwC1E"}

package/dist/auth/dcql.js

@@ -0,0 +1,41 @@
+import { SELF_ATTESTATION_VC_TYPE } from "@europeum-ebsi/api-contract/scopes";
+import { createJWT } from "@europeum-ebsi/did-jwt";
+import { metadata as attestationMetadata } from "@europeum-ebsi/vcdm1.1-attestation-schema";
+import { randomUUID } from "node:crypto";
+export { dcqlCredentialQueryId } from "@europeum-ebsi/api-contract/scopes";
+export function buildDcqlVpToken(credentialQueryId, vpJwt) {
+    return JSON.stringify({ [credentialQueryId]: [vpJwt] });
+}
+export function createSelfAttestationVcJwt(signingKey) {
+    const { alg, did, kid, signer } = signingKey.issuer;
+    const issuanceDate = new Date();
+    const issued = `${issuanceDate.toISOString().slice(0, -5)}Z`;
+    const iat = Math.floor(issuanceDate.getTime() / 1000);
+    const id = `urn:uuid:${randomUUID()}`;
+    return createJWT({
+        iat,
+        iss: did,
+        jti: id,
+        nbf: iat,
+        sub: did,
+        vc: {
+            "@context": ["https://www.w3.org/2018/credentials/v1"],
+            credentialSchema: {
+                id: `https://schemas-registry.example/schemas/${attestationMetadata.id.base16}`,
+                type: "FullJsonSchemaValidator2021",
+            },
+            credentialSubject: { id: did },
+            id,
+            issuanceDate: issued,
+            issued,
+            issuer: did,
+            type: [
+                "VerifiableCredential",
+                "VerifiableAttestation",
+                SELF_ATTESTATION_VC_TYPE,
+            ],
+            validFrom: issued,
+        },
+    }, { signer }, { alg, kid, typ: "JWT" });
+}
+//# sourceMappingURL=dcql.js.map

package/dist/auth/dcql.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dcql.js","sourceRoot":"","sources":["../../src/auth/dcql.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAC9E,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,QAAQ,IAAI,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAC5F,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAQzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAQ3E,MAAM,UAAU,gBAAgB,CAC9B,iBAAyB,EACzB,KAAa;IAEb,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAC1D,CAAC;AAmBD,MAAM,UAAU,0BAA0B,CAAC,UAAuB;IAChE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC;IACpD,MAAM,YAAY,GAAG,IAAI,IAAI,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IACtD,MAAM,EAAE,GAAG,YAAY,UAAU,EAAE,EAAE,CAAC;IAEtC,OAAO,SAAS,CACd;QACE,GAAG;QACH,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,EAAE;QACP,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG;QACR,EAAE,EAAE;YACF,UAAU,EAAE,CAAC,wCAAwC,CAAC;YACtD,gBAAgB,EAAE;gBAKhB,EAAE,EAAE,4CAA4C,mBAAmB,CAAC,EAAE,CAAC,MAAM,EAAE;gBAC/E,IAAI,EAAE,6BAA6B;aACpC;YACD,iBAAiB,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE;YAC9B,EAAE;YACF,YAAY,EAAE,MAAM;YACpB,MAAM;YACN,MAAM,EAAE,GAAG;YACX,IAAI,EAAE;gBACJ,sBAAsB;gBACtB,uBAAuB;gBACvB,wBAAwB;aACzB;YACD,SAAS,EAAE,MAAM;SAClB;KACF,EACD,EAAE,MAAM,EAAE,EACV,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CACzB,CAAC;AACJ,CAAC"}

package/dist/auth/presentation.d.ts

@@ -0,0 +1,30 @@
+export declare const COMBINABLE_SCOPES: Set<string>;
+export declare const KNOWN_SCOPES: readonly ["did-registry:invite", "did-registry:write", "ledger:invoke", "issuers-registry:invite", "issuers-registry:write", "timestamp:write", "track-and-trace:authorise", "track-and-trace:create", "track-and-trace:write", "policies-registry:write", "schemas-registry:write"];
+export interface ParsedScope {
+    family: string;
+    targetAddress?: string;
+}
+export interface PresentationSubmission {
+    definition_id: string;
+    descriptor_map: PresentationDescriptor[];
+    id: string;
+}
+interface PresentationDescriptor {
+    format: string;
+    id: string;
+    path: string;
+    path_nested: {
+        format: string;
+        id: string;
+        path: string;
+    };
+}
+export declare function buildPresentationSubmission(scope: string, submissionId: string): PresentationSubmission;
+export declare function mergedDefinitionId(families: string[]): string;
+export declare function parseScopes(scope: string): string[];
+export declare function parseScopeToken(token: string): ParsedScope | undefined;
+export declare function requiresVc(scope: string): boolean;
+export declare function scopeFamilies(scope: string): string[];
+export declare function validateScope(scope: string): void;
+export {};
+//# sourceMappingURL=presentation.d.ts.map

package/dist/auth/presentation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"presentation.d.ts","sourceRoot":"","sources":["../../src/auth/presentation.ts"],"names":[],"mappings":"AAoDA,eAAO,MAAM,iBAAiB,aAA4C,CAAC;AAK3E,eAAO,MAAM,YAAY,sRAAgB,CAAC;AAK1C,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,sBAAsB,EAAE,CAAC;IACzC,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,UAAU,sBAAsB;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE;QACX,MAAM,EAAE,MAAM,CAAC;QACf,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;CACH;AAWD,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,GACnB,sBAAsB,CA+BxB;AAYD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAI7D;AAUD,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAGnD;AASD,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAUtE;AAQD,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAOjD;AAQD,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAYrD;AAaD,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CA+BjD"}

package/dist/auth/presentation.js

@@ -0,0 +1,99 @@
+import { CUSTOM_SCOPES, dcqlCredentialQueryId, mergedPresentationDefinitionId, parseScopeToken as parseSharedScopeToken, COMBINABLE_SCOPES as SHARED_COMBINABLE_SCOPES, } from "@europeum-ebsi/api-contract/scopes";
+const VC_REQUIRED_SCOPES = new Set([
+    "did-registry:invite",
+    "issuers-registry:invite",
+    "ledger:invoke",
+    "track-and-trace:authorise",
+]);
+export const COMBINABLE_SCOPES = new Set(SHARED_COMBINABLE_SCOPES);
+export const KNOWN_SCOPES = CUSTOM_SCOPES;
+export function buildPresentationSubmission(scope, submissionId) {
+    const families = scopeFamilies(scope);
+    const definitionId = mergedDefinitionId(families);
+    if (families.length === 1 && requiresVc(scope)) {
+        const soleFamily = families[0];
+        const credentialId = dcqlCredentialQueryId(soleFamily);
+        return {
+            definition_id: definitionId,
+            descriptor_map: [
+                {
+                    format: "jwt_vp",
+                    id: credentialId,
+                    path: "$",
+                    path_nested: {
+                        format: "jwt_vc",
+                        id: credentialId,
+                        path: "$.vp.verifiableCredential[0]",
+                    },
+                },
+            ],
+            id: submissionId,
+        };
+    }
+    return {
+        definition_id: definitionId,
+        descriptor_map: [],
+        id: submissionId,
+    };
+}
+export function mergedDefinitionId(families) {
+    return mergedPresentationDefinitionId(families);
+}
+export function parseScopes(scope) {
+    const tokens = scope.trim().split(/\s+/).filter(Boolean);
+    return tokens[0] === "openid" ? tokens.slice(1) : tokens;
+}
+export function parseScopeToken(token) {
+    const parsed = parseSharedScopeToken(token);
+    if (!parsed) {
+        return undefined;
+    }
+    return {
+        family: parsed.scope,
+        ...(parsed.targetAddress && { targetAddress: parsed.targetAddress }),
+    };
+}
+export function requiresVc(scope) {
+    const tokens = parseScopes(scope);
+    if (tokens.length !== 1) {
+        return false;
+    }
+    const parsed = parseScopeToken(tokens[0]);
+    return parsed !== undefined && VC_REQUIRED_SCOPES.has(parsed.family);
+}
+export function scopeFamilies(scope) {
+    return parseScopes(scope).map((token) => {
+        const parsed = parseScopeToken(token);
+        if (!parsed) {
+            throw new Error(`Invalid scope token "${token}". Expected "<registry>:<action>", optionally ` +
+                `suffixed with ":<0x-address>" to target a specific contract instance. ` +
+                `Known scopes: ${KNOWN_SCOPES.join(", ")}`);
+        }
+        return parsed.family;
+    });
+}
+export function validateScope(scope) {
+    const tokens = parseScopes(scope);
+    if (tokens.length === 0) {
+        throw new Error(`Missing scope. Provide one of: ${KNOWN_SCOPES.join(", ")}`);
+    }
+    const families = scopeFamilies(scope);
+    const seen = new Set();
+    const duplicates = new Set();
+    for (const family of families) {
+        if (seen.has(family))
+            duplicates.add(family);
+        seen.add(family);
+    }
+    if (duplicates.size > 0) {
+        throw new Error(`Duplicate scope(s): ${[...duplicates].join(", ")}`);
+    }
+    if (families.length <= 1)
+        return;
+    const nonCombinable = families.filter((f) => !COMBINABLE_SCOPES.has(f));
+    if (nonCombinable.length > 0) {
+        throw new Error(`Scope(s) "${nonCombinable.join(", ")}" cannot be combined with other scopes. ` +
+            `Only these scopes may be combined in a single token: ${[...COMBINABLE_SCOPES].join(", ")}.`);
+    }
+}
+//# sourceMappingURL=presentation.js.map

package/dist/auth/presentation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"presentation.js","sourceRoot":"","sources":["../../src/auth/presentation.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,8BAA8B,EAC9B,eAAe,IAAI,qBAAqB,EACxC,iBAAiB,IAAI,wBAAwB,GAC9C,MAAM,oCAAoC,CAAC;AAiC5C,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,qBAAqB;IACrB,yBAAyB;IACzB,eAAe;IACf,2BAA2B;CAC5B,CAAC,CAAC;AAQH,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAS,wBAAwB,CAAC,CAAC;AAK3E,MAAM,CAAC,MAAM,YAAY,GAAG,aAAa,CAAC;AAoC1C,MAAM,UAAU,2BAA2B,CACzC,KAAa,EACb,YAAoB;IAEpB,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,YAAY,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAElD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,MAAM,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;QAChC,MAAM,YAAY,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;QACvD,OAAO;YACL,aAAa,EAAE,YAAY;YAC3B,cAAc,EAAE;gBACd;oBACE,MAAM,EAAE,QAAQ;oBAChB,EAAE,EAAE,YAAY;oBAChB,IAAI,EAAE,GAAG;oBACT,WAAW,EAAE;wBACX,MAAM,EAAE,QAAQ;wBAChB,EAAE,EAAE,YAAY;wBAChB,IAAI,EAAE,8BAA8B;qBACrC;iBACF;aACF;YACD,EAAE,EAAE,YAAY;SACjB,CAAC;IACJ,CAAC;IAGD,OAAO;QACL,aAAa,EAAE,YAAY;QAC3B,cAAc,EAAE,EAAE;QAClB,EAAE,EAAE,YAAY;KACjB,CAAC;AACJ,CAAC;AAYD,MAAM,UAAU,kBAAkB,CAAC,QAAkB;IACnD,OAAO,8BAA8B,CACnC,QAA4C,CAC7C,CAAC;AACJ,CAAC;AAUD,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACzD,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAC3D,CAAC;AASD,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,KAAK;QACpB,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC;KACrE,CAAC;AACJ,CAAC;AAQD,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC;IAC3C,OAAO,MAAM,KAAK,SAAS,IAAI,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACvE,CAAC;AAQD,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACtC,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,wBAAwB,KAAK,gDAAgD;gBAC3E,wEAAwE;gBACxE,iBAAiB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC7C,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC;AAaD,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAElC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,kCAAkC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC5D,CAAC;IACJ,CAAC;IAGD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAEtC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACnB,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO;IAEjC,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,aAAa,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,0CAA0C;YAC7E,wDAAwD,CAAC,GAAG,iBAAiB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC/F,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/auth/token.d.ts

@@ -0,0 +1,11 @@
+import type { CliConfig } from "../config/config.ts";
+import type { WalletDetails } from "../crypto/wallet.ts";
+export interface GetAccessTokenOptions {
+    config: CliConfig;
+    scope: string;
+    spec?: "1.0" | "draft14";
+    vcJwt?: string;
+    wallet: WalletDetails;
+}
+export declare function getAccessToken(opts: GetAccessTokenOptions): Promise<string>;
+//# sourceMappingURL=token.d.ts.map

package/dist/auth/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../src/auth/token.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAgBzD,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,SAAS,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IAOd,IAAI,CAAC,EAAE,KAAK,GAAG,SAAS,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,aAAa,CAAC;CACvB;AAcD,wBAAsB,cAAc,CAClC,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,MAAM,CAAC,CA+HjB"}

package/dist/auth/token.js

@@ -0,0 +1,116 @@
+import { createVerifiablePresentationJwt } from "@europeum-ebsi/verifiable-presentation/vcdm11.js";
+import { decodeJwt } from "jose";
+import { randomUUID } from "node:crypto";
+import { buildEbsiEnvConfig } from "../config/ebsi-env.js";
+import { buildDcqlVpToken, createSelfAttestationVcJwt, dcqlCredentialQueryId, } from "./dcql.js";
+import { buildPresentationSubmission, requiresVc, scopeFamilies, } from "./presentation.js";
+const DID_REGISTRY_INVITE_FAMILY = "did-registry:invite";
+export async function getAccessToken(opts) {
+    const { config, scope, spec = "draft14", vcJwt, wallet } = opts;
+    if (!vcJwt && requiresVc(scope)) {
+        throw new Error(`Scope "${scope}" requires a Verifiable Credential. ` +
+            "Pass --vc <file> with a path to a VC JWT file.");
+    }
+    const signingKey = wallet.signingKey();
+    if (vcJwt && scopeFamilies(scope).includes(DID_REGISTRY_INVITE_FAMILY)) {
+        const { vc } = decodeJwt(vcJwt);
+        const jwkThumbprint = vc?.credentialSubject?.jwkThumbprint;
+        if (!jwkThumbprint) {
+            throw new Error("The Verifiable Credential passed via --vc is missing " +
+                "credentialSubject.jwkThumbprint, which the Authorisation service " +
+                `requires for the "did-registry:invite" scope. Ask the issuer for a VC that ` +
+                `authorises this key (thumbprint: ${signingKey.thumbprint}).`);
+        }
+        if (typeof jwkThumbprint !== "string") {
+            throw new TypeError("The Verifiable Credential passed via --vc has an invalid " +
+                "credentialSubject.jwkThumbprint property (not a string).");
+        }
+        if (jwkThumbprint !== signingKey.thumbprint) {
+            throw new Error("The Verifiable Credential passed via --vc authorises a different " +
+                `key (thumbprint: ${jwkThumbprint}) than the signing key ` +
+                `(thumbprint: ${signingKey.thumbprint}). Use the key the VC was ` +
+                "issued for, request a new VC for this key, or pass --sign-alg to " +
+                "select the intended key.");
+        }
+    }
+    const { issuer, tokenEndpoint } = await discoverAuthEndpoints(config.baseUrl);
+    const ebsiEnvConfig = buildEbsiEnvConfig(config);
+    const nonce = randomUUID();
+    const now = Math.floor(Date.now() / 1000);
+    const dcqlSelfAttestationVc = spec === "1.0" && !vcJwt
+        ? createSelfAttestationVcJwt(signingKey)
+        : undefined;
+    const credential = vcJwt ?? dcqlSelfAttestationVc;
+    const vpPayload = {
+        "@context": ["https://www.w3.org/2018/credentials/v1"],
+        holder: signingKey.issuer.did,
+        type: ["VerifiablePresentation"],
+        verifiableCredential: credential ? [credential] : [],
+    };
+    const vpJwt = await createVerifiablePresentationJwt(vpPayload, signingKey.issuer, issuer, ebsiEnvConfig, {
+        exp: now + 100,
+        ...(scopeFamilies(scope).includes(DID_REGISTRY_INVITE_FAMILY) && {
+            header: { jwk: signingKey.publicKeyJwk },
+        }),
+        nbf: now - 100,
+        nonce,
+        skipValidation: true,
+    });
+    if (spec === "1.0") {
+        const credentialQueryId = dcqlCredentialQueryId(scopeFamilies(scope)[0]);
+        const body = new URLSearchParams({
+            grant_type: "vp_token",
+            scope: `openid ${scope}`,
+            vp_token: buildDcqlVpToken(credentialQueryId, vpJwt),
+        });
+        return submitTokenRequest(tokenEndpoint, body);
+    }
+    const submissionId = randomUUID();
+    const presentationSubmission = buildPresentationSubmission(scope, submissionId);
+    const body = new URLSearchParams({
+        grant_type: "vp_token",
+        presentation_submission: JSON.stringify(presentationSubmission),
+        scope: `openid ${scope}`,
+        vp_token: vpJwt,
+    });
+    return submitTokenRequest(tokenEndpoint, body);
+}
+async function discoverAuthEndpoints(baseUrl) {
+    const discoveryUrl = `${baseUrl}/auth/.well-known/openid-configuration`;
+    const resp = await fetch(discoveryUrl, {
+        headers: { Accept: "application/json" },
+    });
+    if (!resp.ok) {
+        throw new Error(`Failed to fetch OpenID config from ${discoveryUrl}: HTTP ${resp.status.toString()}`);
+    }
+    const body = (await resp.json());
+    const { issuer, token_endpoint: tokenEndpoint } = body;
+    if (!issuer || !tokenEndpoint) {
+        throw new Error(`OpenID config at ${discoveryUrl} is missing 'issuer' or 'token_endpoint'`);
+    }
+    return { issuer, tokenEndpoint };
+}
+async function submitTokenRequest(tokenEndpoint, body) {
+    const resp = await fetch(tokenEndpoint, {
+        body: body.toString(),
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        method: "POST",
+    });
+    if (!resp.ok) {
+        let detail;
+        try {
+            const errBody = await resp.text();
+            detail = errBody;
+        }
+        catch {
+            detail = `HTTP ${resp.status.toString()}`;
+        }
+        throw new Error(`Token request failed (HTTP ${resp.status.toString()}): ${detail}`);
+    }
+    const data = (await resp.json());
+    if (!data.access_token) {
+        throw new Error("Token response did not contain 'access_token'");
+    }
+    return data.access_token;
+}
+//# sourceMappingURL=token.js.map

package/dist/auth/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../src/auth/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,kDAAkD,CAAC;AACnG,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAKzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EACL,gBAAgB,EAChB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,2BAA2B,EAC3B,UAAU,EACV,aAAa,GACd,MAAM,mBAAmB,CAAC;AAE3B,MAAM,0BAA0B,GAAG,qBAAqB,CAAC;AA4BzD,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAA2B;IAE3B,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAEhE,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,UAAU,KAAK,sCAAsC;YACnD,gDAAgD,CACnD,CAAC;IACJ,CAAC;IAID,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAOvC,IAAI,KAAK,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,0BAA0B,CAAC,EAAE,CAAC;QACvE,MAAM,EAAE,EAAE,EAAE,GAAG,SAAS,CAAC,KAAK,CAE7B,CAAC;QACF,MAAM,aAAa,GAAG,EAAE,EAAE,iBAAiB,EAAE,aAAa,CAAC;QAE3D,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,uDAAuD;gBACrD,mEAAmE;gBACnE,6EAA6E;gBAC7E,oCAAoC,UAAU,CAAC,UAAU,IAAI,CAChE,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,SAAS,CACjB,2DAA2D;gBACzD,0DAA0D,CAC7D,CAAC;QACJ,CAAC;QAED,IAAI,aAAa,KAAK,UAAU,CAAC,UAAU,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CACb,mEAAmE;gBACjE,oBAAoB,aAAa,yBAAyB;gBAC1D,gBAAgB,UAAU,CAAC,UAAU,4BAA4B;gBACjE,mEAAmE;gBACnE,0BAA0B,CAC7B,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,qBAAqB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9E,MAAM,aAAa,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAO1C,MAAM,qBAAqB,GACzB,IAAI,KAAK,KAAK,IAAI,CAAC,KAAK;QACtB,CAAC,CAAC,0BAA0B,CAAC,UAAU,CAAC;QACxC,CAAC,CAAC,SAAS,CAAC;IAIhB,MAAM,UAAU,GAAG,KAAK,IAAI,qBAAqB,CAAC;IAElD,MAAM,SAAS,GAAG;QAChB,UAAU,EAAE,CAAC,wCAAwC,CAAC;QACtD,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,GAAG;QAC7B,IAAI,EAAE,CAAC,wBAAwB,CAAC;QAChC,oBAAoB,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE;KACrD,CAAC;IAEF,MAAM,KAAK,GAAG,MAAM,+BAA+B,CACjD,SAAS,EACT,UAAU,CAAC,MAAM,EACjB,MAAM,EACN,aAAa,EACb;QACE,GAAG,EAAE,GAAG,GAAG,GAAG;QAKd,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,0BAA0B,CAAC,IAAI;YAC/D,MAAM,EAAE,EAAE,GAAG,EAAE,UAAU,CAAC,YAAY,EAAE;SACzC,CAAC;QACF,GAAG,EAAE,GAAG,GAAG,GAAG;QACd,KAAK;QACL,cAAc,EAAE,IAAI;KACrB,CACF,CAAC;IAEF,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QAInB,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;QAE1E,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,UAAU;YACtB,KAAK,EAAE,UAAU,KAAK,EAAE;YACxB,QAAQ,EAAE,gBAAgB,CAAC,iBAAiB,EAAE,KAAK,CAAC;SACrD,CAAC,CAAC;QAEH,OAAO,kBAAkB,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,YAAY,GAAG,UAAU,EAAE,CAAC;IAClC,MAAM,sBAAsB,GAAG,2BAA2B,CACxD,KAAK,EACL,YAAY,CACb,CAAC;IAEF,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,UAAU;QACtB,uBAAuB,EAAE,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC;QAC/D,KAAK,EAAE,UAAU,KAAK,EAAE;QACxB,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAC;IAEH,OAAO,kBAAkB,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;AACjD,CAAC;AAQD,KAAK,UAAU,qBAAqB,CAClC,OAAe;IAEf,MAAM,YAAY,GAAG,GAAG,OAAO,wCAAwC,CAAC;IACxE,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE;QACrC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;KACxC,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,sCAAsC,YAAY,UAAU,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CACrF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAG9B,CAAC;IACF,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;IACvD,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,oBAAoB,YAAY,0CAA0C,CAC3E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;AACnC,CAAC;AAQD,KAAK,UAAU,kBAAkB,CAC/B,aAAqB,EACrB,IAAqB;IAErB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;QACtC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;QACrB,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,MAAM,EAAE,MAAM;KACf,CAAC,CAAC;IAEH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAClC,MAAM,GAAG,OAAO,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC5C,CAAC;QACD,MAAM,IAAI,KAAK,CACb,8BAA8B,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,MAAM,EAAE,CACnE,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA8B,CAAC;IAC9D,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,IAAI,CAAC,YAAY,CAAC;AAC3B,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+import { Command } from "commander";
+export declare function buildProgram(): Command;
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAapC,wBAAgB,YAAY,IAAI,OAAO,CA8EtC"}

package/dist/cli.js

@@ -1,11 +1,97 @@
-import { main } from "./app.js";
-main()
-    .then(() => {
-    process.exit(0);
-})
-    // eslint-disable-next-line unicorn/prefer-top-level-await
-    .catch((error) => {
-    console.log(error);
-    process.exit(1);
-});
+import { Command } from "commander";
+import { COMMANDS } from "./commands/registry.js";
+import { resolveConfig } from "./config/config.js";
+import { printError, printResult } from "./output/format.js";
+export function buildProgram() {
+    const program = new Command();
+    program
+        .name("ebsi")
+        .description("EBSI Core CLI — interact with the EBSI Core API")
+        .version("1.0.0-rc.0")
+        .option("--env <env>", "EBSI environment (local, test, pilot, preprod, prod)")
+        .option("--base-url <url>", "Override the API base URL (incl. /v1 prefix)")
+        .option("--output <format>", "Output format: pretty (default), json, table")
+        .option("--token <jwt>", "Bearer access token for authenticated requests (e.g. POST /ledger write methods). " +
+        "Also read from EBSI_ACCESS_TOKEN env var or `ebsi config set token <jwt>`.")
+        .option("--es256k-key <hex>", "Secp256k1 private key (0x-prefixed hex). Mandatory for anything that signs: " +
+        "always signs Ethereum transactions, and signs VCs/VPs unless --sign-alg is ES256. " +
+        "Also read from EBSI_ES256K_PRIVATE_KEY env var or `ebsi config set es256kPrivateKey <hex>`. " +
+        "WARNING: passing keys on the command line may expose them in shell history.")
+        .option("--es256-key <hex>", "P-256 private key (hex), optional — for signing VCs/VPs only (e.g. an `auth token` " +
+        "request). Also read from EBSI_ES256_PRIVATE_KEY env var or " +
+        "`ebsi config set es256PrivateKey <hex>`.")
+        .option("--sign-alg <alg>", 'Which key signs VCs/VPs: "ES256" or "ES256K". Required when both keys are ' +
+        "configured. Also read from EBSI_SIGN_ALG env var or `ebsi config set signAlg <alg>`.")
+        .option("--did <did>", "EBSI DID (did:ebsi:...) to associate with the key(s). " +
+        "Also read from EBSI_DID env var or `ebsi config set did <did>`. " +
+        "If omitted when running `wallet create`, a new random DID is generated.");
+    const nodes = new Map();
+    const configured = new Set();
+    for (const descriptor of COMMANDS) {
+        let parent = program;
+        const path = [];
+        for (const [index, segment] of descriptor.segments.entries()) {
+            path.push(segment);
+            const key = path.join(".");
+            let node = nodes.get(key);
+            if (!node) {
+                node = new Command(segment).description(index === 0
+                    ? `Commands for the ${descriptor.group} API`
+                    : `${descriptor.group} ${path.slice(1).join(" ")} commands`);
+                parent.addCommand(node);
+                nodes.set(key, node);
+            }
+            parent = node;
+        }
+        const leafKey = descriptor.segments.join(".");
+        if (configured.has(leafKey))
+            continue;
+        configured.add(leafKey);
+        configureLeaf(parent, descriptor);
+    }
+    return program;
+}
+function configureLeaf(cmd, descriptor) {
+    cmd.description(descriptor.summary);
+    for (const arg of descriptor.args) {
+        if (arg.required) {
+            cmd.argument(`<${arg.name}>`, arg.description);
+        }
+        else {
+            cmd.argument(`[${arg.name}]`, arg.description);
+        }
+    }
+    for (const opt of descriptor.options) {
+        cmd.option(opt.flags, opt.description, opt.defaultValue);
+    }
+    cmd.action(async (...cmdArgs) => {
+        const commandInstance = cmdArgs.at(-1);
+        const positional = cmdArgs.slice(0, descriptor.args.length);
+        const argMap = {};
+        for (const [i, arg] of descriptor.args.entries()) {
+            argMap[arg.name] = positional[i] ?? "";
+        }
+        const mergedOpts = commandInstance.optsWithGlobals();
+        try {
+            const config = resolveConfig(Object.fromEntries(Object.entries({
+                baseUrl: mergedOpts["baseUrl"],
+                did: mergedOpts["did"],
+                env: mergedOpts["env"],
+                es256Key: mergedOpts["es256Key"],
+                es256kKey: mergedOpts["es256kKey"],
+                output: mergedOpts["output"],
+                signAlg: mergedOpts["signAlg"],
+                token: mergedOpts["token"],
+            }).filter(([, v]) => v !== undefined)), { allowLegacyPrivateKey: descriptor.segments[0] === "config" });
+            const data = await descriptor.handler(argMap, mergedOpts, config);
+            printResult(data, config.output);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : "Unknown error";
+            const detail = error instanceof Error ? error.cause : error;
+            printError(message, detail);
+            process.exitCode = 1;
+        }
+    });
+}
 //# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhC,IAAI,EAAE;KACH,IAAI,CAAC,GAAG,EAAE;IACT,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC;IACF,0DAA0D;KACzD,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACf,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAS7D,MAAM,UAAU,YAAY;IAC1B,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAE9B,OAAO;SACJ,IAAI,CAAC,MAAM,CAAC;SACZ,WAAW,CAAC,iDAAiD,CAAC;SAC9D,OAAO,CAAC,YAAY,CAAC;SAErB,MAAM,CACL,aAAa,EACb,sDAAsD,CACvD;SACA,MAAM,CAAC,kBAAkB,EAAE,8CAA8C,CAAC;SAC1E,MAAM,CAAC,mBAAmB,EAAE,8CAA8C,CAAC;SAC3E,MAAM,CACL,eAAe,EACf,oFAAoF;QAClF,4EAA4E,CAC/E;SACA,MAAM,CACL,oBAAoB,EACpB,8EAA8E;QAC5E,oFAAoF;QACpF,8FAA8F;QAC9F,6EAA6E,CAChF;SACA,MAAM,CACL,mBAAmB,EACnB,qFAAqF;QACnF,6DAA6D;QAC7D,0CAA0C,CAC7C;SACA,MAAM,CACL,kBAAkB,EAClB,4EAA4E;QAC1E,sFAAsF,CACzF;SACA,MAAM,CACL,aAAa,EACb,wDAAwD;QACtD,kEAAkE;QAClE,yEAAyE,CAC5E,CAAC;IAKJ,MAAM,KAAK,GAAG,IAAI,GAAG,EAAmB,CAAC;IACzC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IAErC,KAAK,MAAM,UAAU,IAAI,QAAQ,EAAE,CAAC;QAClC,IAAI,MAAM,GAAG,OAAO,CAAC;QACrB,MAAM,IAAI,GAAa,EAAE,CAAC;QAE1B,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YAC7D,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACnB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC3B,IAAI,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,IAAI,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,CACrC,KAAK,KAAK,CAAC;oBACT,CAAC,CAAC,oBAAoB,UAAU,CAAC,KAAK,MAAM;oBAC5C,CAAC,CAAC,GAAG,UAAU,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAC9D,CAAC;gBACF,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;gBACxB,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACvB,CAAC;YACD,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;QAED,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAE9C,IAAI,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACxB,aAAa,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACpC,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAMD,SAAS,aAAa,CACpB,GAAY,EACZ,UAAqC;IAErC,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAEpC,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YACjB,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;QACjD,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;QACrC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;IAC3D,CAAC;IAED,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,OAAkB,EAAE,EAAE;QAGzC,MAAM,eAAe,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAY,CAAC;QAGlD,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAa,CAAC;QACxE,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;YACjD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,CAAC;QAGD,MAAM,UAAU,GACd,eAAe,CAAC,eAAe,EAA0B,CAAC;QAE5D,IAAI,CAAC;YAOH,MAAM,MAAM,GAAG,aAAa,CAC1B,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC;gBACb,OAAO,EAAE,UAAU,CAAC,SAAS,CAAC;gBAC9B,GAAG,EAAE,UAAU,CAAC,KAAK,CAAC;gBACtB,GAAG,EAAE,UAAU,CAAC,KAAK,CAAC;gBACtB,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC;gBAChC,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC;gBAClC,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC;gBAC5B,OAAO,EAAE,UAAU,CAAC,SAAS,CAAC;gBAC9B,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC;aAC3B,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CACtC,EACD,EAAE,qBAAqB,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAC/D,CAAC;YAEF,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;YAClE,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACzE,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;YAC5D,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/commands/auth.d.ts

@@ -0,0 +1,3 @@
+import type { CommandDescriptor } from "./registry.ts";
+export declare const authCommands: CommandDescriptor[];
+//# sourceMappingURL=auth.d.ts.map

package/dist/commands/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/commands/auth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAOvD,eAAO,MAAM,YAAY,EAAE,iBAAiB,EA6G3C,CAAC"}