@thirtified/eudi-dev 0.0.0-stage → 0.1.0

package/dist/commands/credentials.d.ts

@@ -0,0 +1,151 @@
+import { type FileInput, type Input } from '../input.js';
+import { type Runner, type RunOptions } from '../runner.js';
+import type { DcqlQuery, DecodeCredentialResult, DecodeResult, JsonObject, ValidateReport, VersionInfo } from '../types.js';
+/** Per-call options shared by every wrapper. */
+export type CallOptions = Pick<RunOptions, 'timeoutMs' | 'signal'> & {
+    /** Appended to the generated arguments, for flags this package doesn't wrap. */
+    extraArgs?: string[];
+};
+export declare function version(runner: Runner, opts?: CallOptions): Promise<VersionInfo>;
+export type DecodeFormat = 'sdjwt' | 'jwt' | 'mdoc' | 'vci' | 'vp' | 'trusted-list' | 'x509';
+export interface DecodeOptions extends CallOptions {
+    /** Skip auto-detection (`--format`). */
+    format?: DecodeFormat;
+}
+/**
+ * `eudi decode`: inspects a credential, certificate, OpenID4VCI offer,
+ * OpenID4VP request or trusted list. For credentials and certificates the
+ * document also holds the decoder's checks under `validation.checks`.
+ */
+export declare function decode(runner: Runner, input: Input, opts?: DecodeOptions): Promise<DecodeResult>;
+/** True when a decode result is a credential or certificate (it carries `validation`). */
+export declare function isDecodedCredential(doc: DecodeResult): doc is DecodeCredentialResult;
+export interface ValidateOptions extends CallOptions {
+    /** Issuer public key, PEM or JWK (`--key`). A JWK object is serialised. */
+    key?: FileInput | JsonObject;
+    /** ETSI trusted list JWT: content, `{ path }` or `{ url }` (`--trusted-list`). */
+    trustedList?: FileInput;
+    /** Check the status list when the credential references one. Default `true` upstream. */
+    statusList?: boolean;
+    /** Don't fail on a credential outside its validity period. */
+    allowExpired?: boolean;
+    /** Also report HAIP 1.0 findings (informational, they don't fail validation). */
+    haip?: boolean;
+}
+export interface ValidateResult {
+    /** False when a type, expiry, integrity, signature, certificate revocation or status check failed. */
+    valid: boolean;
+    /** The first failing check as `"<name>: <detail>"`, as eudi-dev reports it. */
+    error?: string;
+    report: ValidateReport;
+    stderr: string;
+}
+/**
+ * `eudi validate`. A failing check does not throw: the result has
+ * `valid: false` and the full report. It throws {@link EudiDevError} when
+ * there is no report, for example for input that doesn't parse.
+ */
+export declare function validate(runner: Runner, input: Input, opts?: ValidateOptions): Promise<ValidateResult>;
+/** `eudi dcql`: a DCQL query asking for every claim of the credential. */
+export declare function dcql(runner: Runner, input: Input, opts?: CallOptions): Promise<DcqlQuery>;
+export type CredentialCategory = 'pid' | 'qeaa' | 'pub-eaa' | 'eaa' | 'unlisted';
+/** Card display flags, used with `wallet: true`. */
+export interface IssueDisplayOptions {
+    name?: string;
+    description?: string;
+    backgroundColor?: string;
+    textColor?: string;
+    /** File path, data URI or http(s) URL. */
+    logo?: string;
+    logoAlt?: string;
+    /** File path, data URI or http(s) URL. */
+    backgroundImage?: string;
+    /** Take unset display values from this template. */
+    template?: string;
+}
+/** Trust and issuer metadata stored for the credential type with `wallet: true`. */
+export interface IssueRegistrationOptions {
+    category?: CredentialCategory;
+    entitlements?: string[];
+    trustedListType?: string;
+    statusDeterminationApproach?: string;
+    schemeCommunityRule?: string;
+    schemeTerritory?: string;
+    trustedEntityName?: string;
+    issuanceServiceType?: string;
+    revocationServiceType?: string;
+    issuanceServiceName?: string;
+    revocationServiceName?: string;
+}
+export interface IssueCommonOptions extends CallOptions {
+    /** Claims as an object (written to a temp file) or `{ path }` to a JSON file. Overrides top-level template claims. */
+    claims?: JsonObject | {
+        path: string;
+    };
+    /** Private signing key, PEM or JWK. Ephemeral P-256 if omitted. */
+    key?: FileInput | JsonObject;
+    /** Certificate chain PEM, leaf first, embedded as x5c / x5chain. Requires `key`. */
+    cert?: FileInput;
+    /** Expiration as a Go duration, default `720h`. */
+    exp?: string;
+    /** Not-before: RFC 3339 time or a duration such as `-1h`. */
+    nbf?: string;
+    /** Use the full EUDI PID Rulebook claim set. */
+    pid?: boolean;
+    /** Claim names to leave out. */
+    omit?: string[];
+    /** Template name, or `{ path }` to a template file. */
+    template?: string | {
+        path: string;
+    };
+    /** Save the issued claims and settings as a template with this name. */
+    saveTemplate?: string;
+    statusListUri?: string;
+    statusListIdx?: number;
+    /** Import into the wallet under the instance's EUDI_DEV_HOME. */
+    wallet?: boolean;
+    walletDir?: string;
+    templatesDir?: string;
+    /** With `wallet`: `file`, `memory`, `auto` or a `postgres://` URL. */
+    storage?: string;
+    /** With `wallet`: derive generated keys from this string. */
+    seed?: string;
+    display?: IssueDisplayOptions;
+    registration?: IssueRegistrationOptions;
+    /** With `saveTemplate`: add the template to the attestation catalogue with this entry. */
+    catalog?: JsonObject;
+}
+export interface IssueSdJwtOptions extends IssueCommonOptions {
+    iss?: string;
+    vct?: string;
+    /** Claims issued plainly instead of selectively disclosable (dotted paths for nested claims). */
+    alwaysDisclosed?: string[];
+    /** With `wallet`: issue this many copies with separate holder keys (max 8). */
+    batch?: number;
+    /** With `wallet`: issue without a holder key. */
+    unbound?: boolean;
+}
+export interface IssueJwtOptions extends IssueCommonOptions {
+    iss?: string;
+    vct?: string;
+}
+export interface IssueMdocOptions extends IssueCommonOptions {
+    docType?: string;
+    namespace?: string;
+    batch?: number;
+    unbound?: boolean;
+}
+export interface IssueResult {
+    /** The credential: SD-JWT / JWT compact form, or base64url / hex mdoc. */
+    credential: string;
+    /** Wallet credential id, set when `wallet: true` stored it. */
+    id?: string;
+    /** Public JWK of the ephemeral signing key, when no `key` was given. */
+    publicJwk?: JsonObject;
+    stderr: string;
+}
+/** Extracts the ephemeral public JWK that `issue` prints to stderr. Exported for tests. */
+export declare function parseEphemeralJwk(stderr: string): JsonObject | undefined;
+export declare function issueSdJwt(runner: Runner, opts?: IssueSdJwtOptions): Promise<IssueResult>;
+export declare function issueJwt(runner: Runner, opts?: IssueJwtOptions): Promise<IssueResult>;
+export declare function issueMdoc(runner: Runner, opts?: IssueMdocOptions): Promise<IssueResult>;

package/dist/commands/credentials.js

@@ -0,0 +1,234 @@
+import { EudiDevError } from '../errors.js';
+import { isPathInput } from '../input.js';
+import { ArgList, positionalInput, Scratch } from '../runner.js';
+function runOpts(opts, stdin) {
+    const r = {};
+    if (opts.timeoutMs !== undefined)
+        r.timeoutMs = opts.timeoutMs;
+    if (opts.signal !== undefined)
+        r.signal = opts.signal;
+    if (stdin !== undefined)
+        r.stdin = stdin;
+    return r;
+}
+// ── version ───────────────────────────────────────────────────────────────
+export async function version(runner, opts = {}) {
+    const { document } = await runner.run(['version', ...(opts.extraArgs ?? [])], runOpts(opts));
+    return document;
+}
+/**
+ * `eudi decode`: inspects a credential, certificate, OpenID4VCI offer,
+ * OpenID4VP request or trusted list. For credentials and certificates the
+ * document also holds the decoder's checks under `validation.checks`.
+ */
+export async function decode(runner, input, opts = {}) {
+    const { arg, stdin } = await positionalInput(input);
+    const args = new ArgList('decode').value('format', opts.format).push(...(opts.extraArgs ?? []), arg);
+    const { document } = await runner.run(args.args, runOpts(opts, stdin));
+    return document;
+}
+/** True when a decode result is a credential or certificate (it carries `validation`). */
+export function isDecodedCredential(doc) {
+    const format = doc.format;
+    return (typeof doc === 'object' &&
+        doc !== null &&
+        typeof doc.validation === 'object' &&
+        (format === 'dc+sd-jwt' || format === 'jwt' || format === 'mso_mdoc' || format === 'x509'));
+}
+/**
+ * `eudi validate`. A failing check does not throw: the result has
+ * `valid: false` and the full report. It throws {@link EudiDevError} when
+ * there is no report, for example for input that doesn't parse.
+ */
+export async function validate(runner, input, opts = {}) {
+    const scratch = new Scratch();
+    try {
+        const { arg, stdin } = await positionalInput(input);
+        const args = new ArgList('validate');
+        if (opts.key !== undefined) {
+            const key = isJsonObject(opts.key) ? JSON.stringify(opts.key) : opts.key;
+            args.value('key', await scratch.file(key, 'key'));
+        }
+        if (opts.trustedList !== undefined) {
+            args.value('trusted-list', await scratch.file(opts.trustedList, 'trusted-list.jwt', { allowUrl: true }));
+        }
+        args
+            .bool('status-list', opts.statusList)
+            .on('allow-expired', opts.allowExpired)
+            .on('haip', opts.haip)
+            .push(...(opts.extraArgs ?? []), arg);
+        try {
+            const { document, stderr } = await runner.run(args.args, runOpts(opts, stdin));
+            return { valid: true, report: document, stderr };
+        }
+        catch (err) {
+            if (err instanceof EudiDevError && isReport(err.document)) {
+                return { valid: false, error: err.message, report: err.document, stderr: err.stderr };
+            }
+            throw err;
+        }
+    }
+    finally {
+        await scratch.cleanup();
+    }
+}
+function isReport(doc) {
+    return typeof doc === 'object' && doc !== null && Array.isArray(doc.checks);
+}
+function isJsonObject(v) {
+    return (typeof v === 'object' &&
+        v !== null &&
+        !(v instanceof Uint8Array) &&
+        !('path' in v && typeof v.path === 'string') &&
+        !('url' in v && typeof v.url === 'string'));
+}
+// ── dcql ──────────────────────────────────────────────────────────────────
+/** `eudi dcql`: a DCQL query asking for every claim of the credential. */
+export async function dcql(runner, input, opts = {}) {
+    const { arg, stdin } = await positionalInput(input);
+    const { document } = await runner.run(['dcql', ...(opts.extraArgs ?? []), arg], runOpts(opts, stdin));
+    return document;
+}
+const EPHEMERAL_MARKER = 'Ephemeral signing key (public JWK):';
+/** Extracts the ephemeral public JWK that `issue` prints to stderr. Exported for tests. */
+export function parseEphemeralJwk(stderr) {
+    const lines = stderr.split(/\r?\n/);
+    const start = lines.findIndex((l) => l.trim() === EPHEMERAL_MARKER);
+    if (start < 0)
+        return undefined;
+    // Upstream prints the JWK with json.MarshalIndent, so it spans several
+    // lines. Grow the candidate line by line until it parses.
+    let candidate = '';
+    for (const line of lines.slice(start + 1, start + 1 + 64)) {
+        candidate += `${line}\n`;
+        try {
+            const jwk = JSON.parse(candidate);
+            return typeof jwk === 'object' && jwk !== null && !Array.isArray(jwk) ? jwk : undefined;
+        }
+        catch {
+            // incomplete, keep reading
+        }
+    }
+    return undefined;
+}
+async function commonIssueArgs(args, opts, scratch) {
+    if (opts.claims !== undefined) {
+        const path = isPathInput(opts.claims)
+            ? await scratch.file(opts.claims, 'claims.json')
+            : await scratch.write('claims.json', JSON.stringify(opts.claims));
+        args.value('claims', `@${path}`);
+    }
+    if (opts.key !== undefined) {
+        const key = isJsonObject(opts.key) ? JSON.stringify(opts.key) : opts.key;
+        args.value('key', await scratch.file(key, 'key'));
+    }
+    if (opts.cert !== undefined)
+        args.value('cert', await scratch.file(opts.cert, 'cert.pem'));
+    if (opts.template !== undefined) {
+        args.value('template', typeof opts.template === 'string' ? opts.template : await scratch.file(opts.template, 'template.json'));
+    }
+    args
+        .value('exp', opts.exp)
+        .value('nbf', opts.nbf)
+        .on('pid', opts.pid)
+        .csv('omit', opts.omit)
+        .value('save-template', opts.saveTemplate)
+        .value('status-list-uri', opts.statusListUri)
+        .value('status-list-idx', opts.statusListIdx)
+        .on('wallet', opts.wallet)
+        .value('wallet-dir', opts.walletDir)
+        .value('templates-dir', opts.templatesDir)
+        .value('storage', opts.storage)
+        .value('seed', opts.seed);
+    const d = opts.display;
+    if (d) {
+        args
+            .value('display-name', d.name)
+            .value('display-description', d.description)
+            .value('background-color', d.backgroundColor)
+            .value('text-color', d.textColor)
+            .value('logo', d.logo)
+            .value('logo-alt', d.logoAlt)
+            .value('background-image', d.backgroundImage)
+            .value('display-template', d.template);
+    }
+    const r = opts.registration;
+    if (r) {
+        args
+            .value('category', r.category)
+            .repeat('entitlement', r.entitlements)
+            .value('trusted-list-type', r.trustedListType)
+            .value('status-determination-approach', r.statusDeterminationApproach)
+            .value('scheme-community-rule', r.schemeCommunityRule)
+            .value('scheme-territory', r.schemeTerritory)
+            .value('trusted-entity-name', r.trustedEntityName)
+            .value('issuance-service-type', r.issuanceServiceType)
+            .value('revocation-service-type', r.revocationServiceType)
+            .value('issuance-service-name', r.issuanceServiceName)
+            .value('revocation-service-name', r.revocationServiceName);
+    }
+    if (opts.catalog !== undefined) {
+        args.value('catalog', await scratch.write('catalog.json', JSON.stringify(opts.catalog)));
+    }
+}
+async function runIssue(runner, args, opts, scratch) {
+    try {
+        args.push(...(opts.extraArgs ?? []));
+        const { document, stderr } = await runner.run(args.args, runOpts(opts));
+        const result = { credential: document.credential, stderr };
+        if (document.id !== undefined)
+            result.id = document.id;
+        const jwk = parseEphemeralJwk(stderr);
+        if (jwk)
+            result.publicJwk = jwk;
+        return result;
+    }
+    finally {
+        await scratch.cleanup();
+    }
+}
+export async function issueSdJwt(runner, opts = {}) {
+    const scratch = new Scratch();
+    const args = new ArgList('issue', 'sdjwt');
+    try {
+        await commonIssueArgs(args, opts, scratch);
+    }
+    catch (err) {
+        await scratch.cleanup();
+        throw err;
+    }
+    args
+        .value('iss', opts.iss)
+        .value('vct', opts.vct)
+        .csv('always-disclosed', opts.alwaysDisclosed)
+        .value('batch', opts.batch)
+        .on('unbound', opts.unbound);
+    return runIssue(runner, args, opts, scratch);
+}
+export async function issueJwt(runner, opts = {}) {
+    const scratch = new Scratch();
+    const args = new ArgList('issue', 'jwt');
+    try {
+        await commonIssueArgs(args, opts, scratch);
+    }
+    catch (err) {
+        await scratch.cleanup();
+        throw err;
+    }
+    args.value('iss', opts.iss).value('vct', opts.vct);
+    return runIssue(runner, args, opts, scratch);
+}
+export async function issueMdoc(runner, opts = {}) {
+    const scratch = new Scratch();
+    const args = new ArgList('issue', 'mdoc');
+    try {
+        await commonIssueArgs(args, opts, scratch);
+    }
+    catch (err) {
+        await scratch.cleanup();
+        throw err;
+    }
+    args.value('doc-type', opts.docType).value('namespace', opts.namespace).value('batch', opts.batch).on('unbound', opts.unbound);
+    return runIssue(runner, args, opts, scratch);
+}
+//# sourceMappingURL=credentials.js.map

package/dist/commands/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/commands/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAA8B,WAAW,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAgC,OAAO,EAAE,MAAM,cAAc,CAAC;AAS/F,SAAS,OAAO,CAAC,IAAiB,EAAE,KAA2B;IAC7D,MAAM,CAAC,GAAe,EAAE,CAAC;IACzB,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;QAAE,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IAC/D,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IACtD,IAAI,KAAK,KAAK,SAAS;QAAE,CAAC,CAAC,KAAK,GAAG,KAAK,CAAC;IACzC,OAAO,CAAC,CAAC;AACX,CAAC;AAED,6EAA6E;AAE7E,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,MAAc,EAAE,OAAoB,EAAE;IAClE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,GAAG,CAAc,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1G,OAAO,QAAQ,CAAC;AAClB,CAAC;AAWD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,MAAc,EAAE,KAAY,EAAE,OAAsB,EAAE;IACjF,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IACrG,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,GAAG,CAAe,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IACrF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,mBAAmB,CAAC,GAAiB;IACnD,MAAM,MAAM,GAAI,GAA4B,CAAC,MAAM,CAAC;IACpD,OAAO,CACL,OAAO,GAAG,KAAK,QAAQ;QACvB,GAAG,KAAK,IAAI;QACZ,OAAQ,GAAgC,CAAC,UAAU,KAAK,QAAQ;QAChE,CAAC,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,UAAU,IAAI,MAAM,KAAK,MAAM,CAAC,CAC3F,CAAC;AACJ,CAAC;AA0BD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,MAAc,EAAE,KAAY,EAAE,OAAwB,EAAE;IACrF,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACzE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACnC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3G,CAAC;QACD,IAAI;aACD,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,UAAU,CAAC;aACpC,EAAE,CAAC,eAAe,EAAE,IAAI,CAAC,YAAY,CAAC;aACtC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC;aACrB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QAExC,IAAI,CAAC;YACH,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,GAAG,CAAiB,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;YAC/F,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,YAAY,IAAI,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC1D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;YACxF,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,GAAY;IAC5B,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAE,GAA4B,CAAC,MAAM,CAAC,CAAC;AACxG,CAAC;AAED,SAAS,YAAY,CAAC,CAAU;IAC9B,OAAO,CACL,OAAO,CAAC,KAAK,QAAQ;QACrB,CAAC,KAAK,IAAI;QACV,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC;QAC1B,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,OAAQ,CAAuB,CAAC,IAAI,KAAK,QAAQ,CAAC;QACnE,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,OAAQ,CAAsB,CAAC,GAAG,KAAK,QAAQ,CAAC,CACjE,CAAC;AACJ,CAAC;AAED,6EAA6E;AAE7E,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,MAAc,EAAE,KAAY,EAAE,OAAoB,EAAE;IAC7E,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,GAAG,CAAY,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IACjH,OAAO,QAAQ,CAAC;AAClB,CAAC;AAwGD,MAAM,gBAAgB,GAAG,qCAAqC,CAAC;AAE/D,2FAA2F;AAC3F,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,gBAAgB,CAAC,CAAC;IACpE,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAChC,uEAAuE;IACvE,0DAA0D;IAC1D,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;QAC1D,SAAS,IAAI,GAAG,IAAI,IAAI,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,GAAG,GAAY,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC3C,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,GAAkB,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1G,CAAC;QAAC,MAAM,CAAC;YACP,2BAA2B;QAC7B,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAa,EAAE,IAAwB,EAAE,OAAgB;IACtF,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;YACnC,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC;YAChD,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QACpE,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QACzE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;IAC3F,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC;IACjI,CAAC;IACD,IAAI;SACD,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC;SACtB,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC;SACtB,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC;SACnB,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC;SACtB,KAAK,CAAC,eAAe,EAAE,IAAI,CAAC,YAAY,CAAC;SACzC,KAAK,CAAC,iBAAiB,EAAE,IAAI,CAAC,aAAa,CAAC;SAC5C,KAAK,CAAC,iBAAiB,EAAE,IAAI,CAAC,aAAa,CAAC;SAC5C,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC;SACzB,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC;SACnC,KAAK,CAAC,eAAe,EAAE,IAAI,CAAC,YAAY,CAAC;SACzC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC;SAC9B,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAE5B,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;IACvB,IAAI,CAAC,EAAE,CAAC;QACN,IAAI;aACD,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC;aAC7B,KAAK,CAAC,qBAAqB,EAAE,CAAC,CAAC,WAAW,CAAC;aAC3C,KAAK,CAAC,kBAAkB,EAAE,CAAC,CAAC,eAAe,CAAC;aAC5C,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,SAAS,CAAC;aAChC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC;aACrB,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC;aAC5B,KAAK,CAAC,kBAAkB,EAAE,CAAC,CAAC,eAAe,CAAC;aAC5C,KAAK,CAAC,kBAAkB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC;IAC5B,IAAI,CAAC,EAAE,CAAC;QACN,IAAI;aACD,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC;aAC7B,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,YAAY,CAAC;aACrC,KAAK,CAAC,mBAAmB,EAAE,CAAC,CAAC,eAAe,CAAC;aAC7C,KAAK,CAAC,+BAA+B,EAAE,CAAC,CAAC,2BAA2B,CAAC;aACrE,KAAK,CAAC,uBAAuB,EAAE,CAAC,CAAC,mBAAmB,CAAC;aACrD,KAAK,CAAC,kBAAkB,EAAE,CAAC,CAAC,eAAe,CAAC;aAC5C,KAAK,CAAC,qBAAqB,EAAE,CAAC,CAAC,iBAAiB,CAAC;aACjD,KAAK,CAAC,uBAAuB,EAAE,CAAC,CAAC,mBAAmB,CAAC;aACrD,KAAK,CAAC,yBAAyB,EAAE,CAAC,CAAC,qBAAqB,CAAC;aACzD,KAAK,CAAC,uBAAuB,EAAE,CAAC,CAAC,mBAAmB,CAAC;aACrD,KAAK,CAAC,yBAAyB,EAAE,CAAC,CAAC,qBAAqB,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3F,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,MAAc,EAAE,IAAa,EAAE,IAAwB,EAAE,OAAgB;IAC/F,IAAI,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;QACrC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,GAAG,CAAgB,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACvF,MAAM,MAAM,GAAgB,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QACxE,IAAI,QAAQ,CAAC,EAAE,KAAK,SAAS;YAAE,MAAM,CAAC,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC;QACvD,MAAM,GAAG,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,GAAG;YAAE,MAAM,CAAC,SAAS,GAAG,GAAG,CAAC;QAChC,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAc,EAAE,OAA0B,EAAE;IAC3E,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;QACxB,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI;SACD,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC;SACtB,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC;SACtB,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,eAAe,CAAC;SAC7C,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC;SAC1B,EAAE,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/B,OAAO,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,MAAc,EAAE,OAAwB,EAAE;IACvE,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;QACxB,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACnD,OAAO,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,MAAc,EAAE,OAAyB,EAAE;IACzE,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;QACxB,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/H,OAAO,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AAC/C,CAAC"}

package/dist/commands/registrar.d.ts

@@ -0,0 +1,116 @@
+import type { FileInput } from '../input.js';
+import { ArgList, type Runner, Scratch } from '../runner.js';
+import type { AccessCertificateResult, DcqlQuery, Enrolment, EnrolmentResult, RegistrationCertificateResult, RegistrationExtensionResult, RelyingParty } from '../types.js';
+import type { CallOptions } from './credentials.js';
+/** Registration fields shared by verifiers and issuers. */
+export interface PartyOptions {
+    /** Trade name. Required for a new registration. */
+    name: string;
+    /** An EUID or an organizationIdentifier. Default: an assigned EUID. */
+    identifier?: string;
+    /** Default `name`. */
+    legalName?: string;
+    /** Country code. Default the identifier's country. */
+    country?: string;
+    /** Web or email address. */
+    supportUri?: string;
+    /** Service identifier (the OU in access certificates). */
+    serviceId?: string;
+}
+export interface IntendedUseOptions {
+    /** Shown in the consent dialog. */
+    purpose: string;
+    /** DCQL query with the credentials and claims to register. */
+    dcql: DcqlQuery | FileInput;
+    /** Privacy policy URL. Default a placeholder page on the wallet. */
+    privacyPolicy?: string;
+}
+export type AddVerifierOptions = PartyOptions & IntendedUseOptions & CallOptions;
+export type ExtendVerifierOptions = IntendedUseOptions & CallOptions & {
+    /** Identifier of the registered relying party to add the intended use to. */
+    to: string;
+};
+export interface AttestationOptions {
+    /** `format:type`, e.g. `dc+sd-jwt:urn:eudi:pid:1` or `mso_mdoc:eu.europa.ec.eudi.pid.1`. */
+    attestations: string[];
+    /** Provider entitlement categories: pid, qeaa, pub-eaa, eaa. Default from the catalogue. */
+    categories?: string[];
+}
+export type AddIssuerOptions = PartyOptions & AttestationOptions & CallOptions;
+export type ExtendIssuerOptions = AttestationOptions & CallOptions & {
+    to: string;
+};
+export interface AccessCertOptions extends CallOptions {
+    /** Identifier of the registered relying party. */
+    identifier: string;
+    /** PEM certificate signing request. */
+    csr: FileInput;
+    serviceId?: string;
+    /** Extra DNS names for the x509_san_dns client identifier. */
+    dns?: string[];
+    /** Go duration, at most one year. */
+    validity?: string;
+}
+export interface RegistrationCertOptions extends CallOptions {
+    identifier: string;
+    serviceId?: string;
+    /** Default the relying party's only intended use. */
+    intendedUse?: string;
+    /** Certify the attestation provider service instead of an intended use. */
+    provider?: boolean;
+    /** Issue a new certificate and revoke the current one (`--new`). */
+    renew?: boolean;
+    /** Validity of a new certificate as a Go duration. Requires `renew` when one exists. */
+    validity?: string;
+}
+export interface RegistrationScopeOptions extends CallOptions {
+    identifier: string;
+    intendedUse?: string;
+    serviceId?: string;
+}
+export declare class PartyCommands<AddOpts, ExtendOpts> {
+    protected readonly runner: Runner;
+    private readonly role;
+    private readonly build;
+    constructor(runner: Runner, role: 'verifiers' | 'issuers', build: (args: ArgList, opts: AddOpts | ExtendOpts, scratch: Scratch) => Promise<ArgList>);
+    /** `registrar <role> list`. */
+    list(opts?: CallOptions): Promise<RelyingParty[]>;
+    /** `registrar <role> add`: register a new relying party. */
+    add(opts: AddOpts & CallOptions): Promise<RelyingParty>;
+    /** `registrar <role> add --to`: extend an existing registration. */
+    extend(opts: ExtendOpts & CallOptions & {
+        to: string;
+    }): Promise<RegistrationExtensionResult>;
+    /** `registrar <role> rm <identifier>`: remove it and revoke its registration certificates. */
+    remove(identifier: string, opts?: CallOptions): Promise<{
+        removed: string;
+    }>;
+    private runAdd;
+}
+/**
+ * `eudi registrar ...` against the wallet in this instance's EUDI_DEV_HOME.
+ * Registrations persist there between calls.
+ */
+export declare class RegistrarCommands {
+    private readonly runner;
+    readonly verifiers: PartyCommands<AddVerifierOptions, ExtendVerifierOptions>;
+    readonly issuers: PartyCommands<AddIssuerOptions, ExtendIssuerOptions>;
+    constructor(runner: Runner);
+    /** `registrar enrol`: register a relying party and issue its certificates in one step. */
+    enrol(enrolment: Enrolment, opts?: CallOptions & {
+        update?: boolean;
+    }): Promise<EnrolmentResult>;
+    /** `registrar access-cert`: issue an access certificate for a CSR. */
+    accessCert(opts: AccessCertOptions): Promise<AccessCertificateResult>;
+    /** `registrar registration-cert`: the current registration certificate, issuing one if needed. */
+    registrationCert(opts: RegistrationCertOptions): Promise<RegistrationCertificateResult>;
+    /** `registrar revoke`: revoke registration certificates. Returns how many changed. */
+    revoke(opts: RegistrationScopeOptions): Promise<{
+        changed: number;
+    }>;
+    /** `registrar activate`: reactivate revoked registration certificates. */
+    activate(opts: RegistrationScopeOptions): Promise<{
+        changed: number;
+    }>;
+    private setStatus;
+}

package/dist/commands/registrar.js

@@ -0,0 +1,150 @@
+import { ArgList, Scratch } from '../runner.js';
+function runOpts(opts, stdin) {
+    const r = {};
+    if (opts.timeoutMs !== undefined)
+        r.timeoutMs = opts.timeoutMs;
+    if (opts.signal !== undefined)
+        r.signal = opts.signal;
+    if (stdin !== undefined)
+        r.stdin = stdin;
+    return r;
+}
+function isDcqlObject(v) {
+    return typeof v === 'object' && v !== null && !(v instanceof Uint8Array) && Array.isArray(v.credentials);
+}
+function partyArgs(args, p) {
+    return args
+        .value('name', p.name)
+        .value('identifier', p.identifier)
+        .value('legal-name', p.legalName)
+        .value('country', p.country)
+        .value('support-uri', p.supportUri)
+        .value('service-id', p.serviceId);
+}
+async function intendedUseArgs(args, u, scratch) {
+    const dcql = isDcqlObject(u.dcql) ? JSON.stringify(u.dcql) : u.dcql;
+    return args
+        .value('purpose', u.purpose)
+        .value('dcql', await scratch.file(dcql, 'dcql.json'))
+        .value('privacy-policy', u.privacyPolicy);
+}
+function attestationArgs(args, a) {
+    return args.repeat('attestation', a.attestations).repeat('category', a.categories);
+}
+export class PartyCommands {
+    runner;
+    role;
+    build;
+    constructor(runner, role, build) {
+        this.runner = runner;
+        this.role = role;
+        this.build = build;
+    }
+    /** `registrar <role> list`. */
+    async list(opts = {}) {
+        const { document } = await this.runner.run(['registrar', this.role, 'list', ...(opts.extraArgs ?? [])], runOpts(opts));
+        return document;
+    }
+    /** `registrar <role> add`: register a new relying party. */
+    async add(opts) {
+        return this.runAdd(opts);
+    }
+    /** `registrar <role> add --to`: extend an existing registration. */
+    async extend(opts) {
+        return this.runAdd(opts);
+    }
+    /** `registrar <role> rm <identifier>`: remove it and revoke its registration certificates. */
+    async remove(identifier, opts = {}) {
+        const { document } = await this.runner.run(['registrar', this.role, 'rm', ...(opts.extraArgs ?? []), identifier], runOpts(opts));
+        return document;
+    }
+    async runAdd(opts) {
+        const scratch = new Scratch();
+        try {
+            const args = await this.build(new ArgList('registrar', this.role, 'add'), opts, scratch);
+            args.value('to', opts.to).push(...(opts.extraArgs ?? []));
+            const { document } = await this.runner.run(args.args, runOpts(opts));
+            return document;
+        }
+        finally {
+            await scratch.cleanup();
+        }
+    }
+}
+/**
+ * `eudi registrar ...` against the wallet in this instance's EUDI_DEV_HOME.
+ * Registrations persist there between calls.
+ */
+export class RegistrarCommands {
+    runner;
+    verifiers;
+    issuers;
+    constructor(runner) {
+        this.runner = runner;
+        this.verifiers = new PartyCommands(runner, 'verifiers', async (args, opts, scratch) => {
+            if (!('to' in opts && opts.to))
+                partyArgs(args, opts);
+            return intendedUseArgs(args, opts, scratch);
+        });
+        this.issuers = new PartyCommands(runner, 'issuers', async (args, opts) => {
+            if (!('to' in opts && opts.to))
+                partyArgs(args, opts);
+            return attestationArgs(args, opts);
+        });
+    }
+    /** `registrar enrol`: register a relying party and issue its certificates in one step. */
+    async enrol(enrolment, opts = {}) {
+        const args = new ArgList('registrar', 'enrol').on('update', opts.update).push(...(opts.extraArgs ?? []), '-');
+        const { document } = await this.runner.run(args.args, runOpts(opts, JSON.stringify(enrolment)));
+        return document;
+    }
+    /** `registrar access-cert`: issue an access certificate for a CSR. */
+    async accessCert(opts) {
+        const scratch = new Scratch();
+        try {
+            const args = new ArgList('registrar', 'access-cert')
+                .value('identifier', opts.identifier)
+                .value('csr', await scratch.file(opts.csr, 'request.csr'))
+                .value('service-id', opts.serviceId)
+                .repeat('dns', opts.dns)
+                .value('validity', opts.validity)
+                .push(...(opts.extraArgs ?? []));
+            const { document } = await this.runner.run(args.args, runOpts(opts));
+            return document;
+        }
+        finally {
+            await scratch.cleanup();
+        }
+    }
+    /** `registrar registration-cert`: the current registration certificate, issuing one if needed. */
+    async registrationCert(opts) {
+        const args = new ArgList('registrar', 'registration-cert')
+            .value('identifier', opts.identifier)
+            .value('service-id', opts.serviceId)
+            .value('intended-use', opts.intendedUse)
+            .on('provider', opts.provider)
+            .on('new', opts.renew)
+            .value('validity', opts.validity)
+            .push(...(opts.extraArgs ?? []));
+        const { document } = await this.runner.run(args.args, runOpts(opts));
+        return document;
+    }
+    /** `registrar revoke`: revoke registration certificates. Returns how many changed. */
+    async revoke(opts) {
+        return this.setStatus('revoke', opts);
+    }
+    /** `registrar activate`: reactivate revoked registration certificates. */
+    async activate(opts) {
+        return this.setStatus('activate', opts);
+    }
+    async setStatus(cmd, opts) {
+        const args = new ArgList('registrar', cmd)
+            .value('identifier', opts.identifier)
+            .value('intended-use', opts.intendedUse)
+            .value('service-id', opts.serviceId)
+            .push(...(opts.extraArgs ?? []));
+        const { document } = await this.runner.run(args.args, runOpts(opts));
+        return document;
+    }
+}
+//# sourceMappingURL=registrar.js.map