@thirtified/eudi-dev 0.0.0-stage → 0.1.0

package/src/commands/registrar.ts

@@ -0,0 +1,243 @@
+import type { FileInput } from '../input.js';
+import { ArgList, type Runner, type RunOptions, Scratch } from '../runner.js';
+import type {
+  AccessCertificateResult,
+  DcqlQuery,
+  Enrolment,
+  EnrolmentResult,
+  RegistrationCertificateResult,
+  RegistrationExtensionResult,
+  RelyingParty,
+} from '../types.js';
+import type { CallOptions } from './credentials.js';
+
+function runOpts(opts: CallOptions, stdin?: string): RunOptions {
+  const r: RunOptions = {};
+  if (opts.timeoutMs !== undefined) r.timeoutMs = opts.timeoutMs;
+  if (opts.signal !== undefined) r.signal = opts.signal;
+  if (stdin !== undefined) r.stdin = stdin;
+  return r;
+}
+
+/** Registration fields shared by verifiers and issuers. */
+export interface PartyOptions {
+  /** Trade name. Required for a new registration. */
+  name: string;
+  /** An EUID or an organizationIdentifier. Default: an assigned EUID. */
+  identifier?: string;
+  /** Default `name`. */
+  legalName?: string;
+  /** Country code. Default the identifier's country. */
+  country?: string;
+  /** Web or email address. */
+  supportUri?: string;
+  /** Service identifier (the OU in access certificates). */
+  serviceId?: string;
+}
+
+export interface IntendedUseOptions {
+  /** Shown in the consent dialog. */
+  purpose: string;
+  /** DCQL query with the credentials and claims to register. */
+  dcql: DcqlQuery | FileInput;
+  /** Privacy policy URL. Default a placeholder page on the wallet. */
+  privacyPolicy?: string;
+}
+
+export type AddVerifierOptions = PartyOptions & IntendedUseOptions & CallOptions;
+export type ExtendVerifierOptions = IntendedUseOptions &
+  CallOptions & {
+    /** Identifier of the registered relying party to add the intended use to. */
+    to: string;
+  };
+
+export interface AttestationOptions {
+  /** `format:type`, e.g. `dc+sd-jwt:urn:eudi:pid:1` or `mso_mdoc:eu.europa.ec.eudi.pid.1`. */
+  attestations: string[];
+  /** Provider entitlement categories: pid, qeaa, pub-eaa, eaa. Default from the catalogue. */
+  categories?: string[];
+}
+
+export type AddIssuerOptions = PartyOptions & AttestationOptions & CallOptions;
+export type ExtendIssuerOptions = AttestationOptions & CallOptions & { to: string };
+
+export interface AccessCertOptions extends CallOptions {
+  /** Identifier of the registered relying party. */
+  identifier: string;
+  /** PEM certificate signing request. */
+  csr: FileInput;
+  serviceId?: string;
+  /** Extra DNS names for the x509_san_dns client identifier. */
+  dns?: string[];
+  /** Go duration, at most one year. */
+  validity?: string;
+}
+
+export interface RegistrationCertOptions extends CallOptions {
+  identifier: string;
+  serviceId?: string;
+  /** Default the relying party's only intended use. */
+  intendedUse?: string;
+  /** Certify the attestation provider service instead of an intended use. */
+  provider?: boolean;
+  /** Issue a new certificate and revoke the current one (`--new`). */
+  renew?: boolean;
+  /** Validity of a new certificate as a Go duration. Requires `renew` when one exists. */
+  validity?: string;
+}
+
+export interface RegistrationScopeOptions extends CallOptions {
+  identifier: string;
+  intendedUse?: string;
+  serviceId?: string;
+}
+
+function isDcqlObject(v: unknown): v is DcqlQuery {
+  return typeof v === 'object' && v !== null && !(v instanceof Uint8Array) && Array.isArray((v as { credentials?: unknown }).credentials);
+}
+
+function partyArgs(args: ArgList, p: PartyOptions): ArgList {
+  return args
+    .value('name', p.name)
+    .value('identifier', p.identifier)
+    .value('legal-name', p.legalName)
+    .value('country', p.country)
+    .value('support-uri', p.supportUri)
+    .value('service-id', p.serviceId);
+}
+
+async function intendedUseArgs(args: ArgList, u: IntendedUseOptions, scratch: Scratch): Promise<ArgList> {
+  const dcql = isDcqlObject(u.dcql) ? JSON.stringify(u.dcql) : u.dcql;
+  return args
+    .value('purpose', u.purpose)
+    .value('dcql', await scratch.file(dcql, 'dcql.json'))
+    .value('privacy-policy', u.privacyPolicy);
+}
+
+function attestationArgs(args: ArgList, a: AttestationOptions): ArgList {
+  return args.repeat('attestation', a.attestations).repeat('category', a.categories);
+}
+
+export class PartyCommands<AddOpts, ExtendOpts> {
+  constructor(
+    protected readonly runner: Runner,
+    private readonly role: 'verifiers' | 'issuers',
+    private readonly build: (args: ArgList, opts: AddOpts | ExtendOpts, scratch: Scratch) => Promise<ArgList>,
+  ) {}
+
+  /** `registrar <role> list`. */
+  async list(opts: CallOptions = {}): Promise<RelyingParty[]> {
+    const { document } = await this.runner.run<RelyingParty[]>(['registrar', this.role, 'list', ...(opts.extraArgs ?? [])], runOpts(opts));
+    return document;
+  }
+
+  /** `registrar <role> add`: register a new relying party. */
+  async add(opts: AddOpts & CallOptions): Promise<RelyingParty> {
+    return this.runAdd<RelyingParty>(opts);
+  }
+
+  /** `registrar <role> add --to`: extend an existing registration. */
+  async extend(opts: ExtendOpts & CallOptions & { to: string }): Promise<RegistrationExtensionResult> {
+    return this.runAdd<RegistrationExtensionResult>(opts);
+  }
+
+  /** `registrar <role> rm <identifier>`: remove it and revoke its registration certificates. */
+  async remove(identifier: string, opts: CallOptions = {}): Promise<{ removed: string }> {
+    const { document } = await this.runner.run<{ removed: string }>(
+      ['registrar', this.role, 'rm', ...(opts.extraArgs ?? []), identifier],
+      runOpts(opts),
+    );
+    return document;
+  }
+
+  private async runAdd<T>(opts: (AddOpts | ExtendOpts) & CallOptions & { to?: string }): Promise<T> {
+    const scratch = new Scratch();
+    try {
+      const args = await this.build(new ArgList('registrar', this.role, 'add'), opts, scratch);
+      args.value('to', opts.to).push(...(opts.extraArgs ?? []));
+      const { document } = await this.runner.run<T>(args.args, runOpts(opts));
+      return document;
+    } finally {
+      await scratch.cleanup();
+    }
+  }
+}
+
+/**
+ * `eudi registrar ...` against the wallet in this instance's EUDI_DEV_HOME.
+ * Registrations persist there between calls.
+ */
+export class RegistrarCommands {
+  readonly verifiers: PartyCommands<AddVerifierOptions, ExtendVerifierOptions>;
+  readonly issuers: PartyCommands<AddIssuerOptions, ExtendIssuerOptions>;
+
+  constructor(private readonly runner: Runner) {
+    this.verifiers = new PartyCommands(runner, 'verifiers', async (args, opts, scratch) => {
+      if (!('to' in opts && opts.to)) partyArgs(args, opts as PartyOptions);
+      return intendedUseArgs(args, opts, scratch);
+    });
+    this.issuers = new PartyCommands(runner, 'issuers', async (args, opts) => {
+      if (!('to' in opts && opts.to)) partyArgs(args, opts as PartyOptions);
+      return attestationArgs(args, opts);
+    });
+  }
+
+  /** `registrar enrol`: register a relying party and issue its certificates in one step. */
+  async enrol(enrolment: Enrolment, opts: CallOptions & { update?: boolean } = {}): Promise<EnrolmentResult> {
+    const args = new ArgList('registrar', 'enrol').on('update', opts.update).push(...(opts.extraArgs ?? []), '-');
+    const { document } = await this.runner.run<EnrolmentResult>(args.args, runOpts(opts, JSON.stringify(enrolment)));
+    return document;
+  }
+
+  /** `registrar access-cert`: issue an access certificate for a CSR. */
+  async accessCert(opts: AccessCertOptions): Promise<AccessCertificateResult> {
+    const scratch = new Scratch();
+    try {
+      const args = new ArgList('registrar', 'access-cert')
+        .value('identifier', opts.identifier)
+        .value('csr', await scratch.file(opts.csr, 'request.csr'))
+        .value('service-id', opts.serviceId)
+        .repeat('dns', opts.dns)
+        .value('validity', opts.validity)
+        .push(...(opts.extraArgs ?? []));
+      const { document } = await this.runner.run<AccessCertificateResult>(args.args, runOpts(opts));
+      return document;
+    } finally {
+      await scratch.cleanup();
+    }
+  }
+
+  /** `registrar registration-cert`: the current registration certificate, issuing one if needed. */
+  async registrationCert(opts: RegistrationCertOptions): Promise<RegistrationCertificateResult> {
+    const args = new ArgList('registrar', 'registration-cert')
+      .value('identifier', opts.identifier)
+      .value('service-id', opts.serviceId)
+      .value('intended-use', opts.intendedUse)
+      .on('provider', opts.provider)
+      .on('new', opts.renew)
+      .value('validity', opts.validity)
+      .push(...(opts.extraArgs ?? []));
+    const { document } = await this.runner.run<RegistrationCertificateResult>(args.args, runOpts(opts));
+    return document;
+  }
+
+  /** `registrar revoke`: revoke registration certificates. Returns how many changed. */
+  async revoke(opts: RegistrationScopeOptions): Promise<{ changed: number }> {
+    return this.setStatus('revoke', opts);
+  }
+
+  /** `registrar activate`: reactivate revoked registration certificates. */
+  async activate(opts: RegistrationScopeOptions): Promise<{ changed: number }> {
+    return this.setStatus('activate', opts);
+  }
+
+  private async setStatus(cmd: 'revoke' | 'activate', opts: RegistrationScopeOptions): Promise<{ changed: number }> {
+    const args = new ArgList('registrar', cmd)
+      .value('identifier', opts.identifier)
+      .value('intended-use', opts.intendedUse)
+      .value('service-id', opts.serviceId)
+      .push(...(opts.extraArgs ?? []));
+    const { document } = await this.runner.run<{ changed: number }>(args.args, runOpts(opts));
+    return document;
+  }
+}

package/src/commands/trust.ts

@@ -0,0 +1,123 @@
+import type { FileInput } from '../input.js';
+import { ArgList, type Runner, type RunOptions, Scratch } from '../runner.js';
+import type { Jwks, TrustEntity, TrustListLink, TrustOverview } from '../types.js';
+import type { CallOptions } from './credentials.js';
+
+function runOpts(opts: CallOptions): RunOptions {
+  const r: RunOptions = {};
+  if (opts.timeoutMs !== undefined) r.timeoutMs = opts.timeoutMs;
+  if (opts.signal !== undefined) r.signal = opts.signal;
+  return r;
+}
+
+/** The wallet's own lists, or the `tl-` id of a custom list. */
+export type TrustListId = 'pid' | 'qeaa' | 'pub-eaa' | 'eaa' | 'wallet-provider' | 'access-ca' | 'registrar' | 'lists' | (string & {});
+
+export interface TrustShowOptions extends CallOptions {
+  /** List id. Default: the PID provider list. */
+  list?: TrustListId;
+  /** Select the list covering this SD-JWT VCT. */
+  vct?: string;
+  /** Select the list covering this mdoc docType. */
+  doctype?: string;
+}
+
+export interface TrustUrlOptions extends TrustShowOptions {
+  /** Wallet server port the URL is built for. Default 8085 upstream. */
+  port?: number;
+  /** Use host.docker.internal instead of localhost. */
+  docker?: boolean;
+}
+
+export interface TrustAddCaOptions extends CallOptions {
+  /** One of `TrustOverview.entity_lists`, e.g. `pid`, `eaa`, `trusted-list-ca`. */
+  list: string;
+  /** PEM with the CA certificates. */
+  ca: FileInput;
+  /** Provider name on the list. Default the CA's common name. */
+  name?: string;
+}
+
+/**
+ * `eudi trust ...` against the wallet in this instance's EUDI_DEV_HOME. The
+ * wallet (with its CA) is created on first use.
+ */
+export class TrustCommands {
+  constructor(private readonly runner: Runner) {}
+
+  /** `trust list`: the wallet's trusted lists and the CAs and lists you added. */
+  async list(opts: CallOptions = {}): Promise<TrustOverview> {
+    const { document } = await this.runner.run<TrustOverview>(['trust', 'list', ...(opts.extraArgs ?? [])], runOpts(opts));
+    return document;
+  }
+
+  /** `trust show`: one of the wallet's trusted lists as a signed JWT. */
+  async show(opts: TrustShowOptions = {}): Promise<string> {
+    const args = new ArgList('trust', 'show')
+      .value('vct', opts.vct)
+      .value('doctype', opts.doctype)
+      .push(...(opts.extraArgs ?? []));
+    if (opts.list) args.push(opts.list);
+    const { document } = await this.runner.run<{ trust_list: string }>(args.args, runOpts(opts));
+    return document.trust_list;
+  }
+
+  /** `trust show --url`: where a wallet server on `port` would serve the list. */
+  async url(opts: TrustUrlOptions = {}): Promise<string> {
+    const args = new ArgList('trust', 'show', '--url')
+      .value('port', opts.port)
+      .on('docker', opts.docker)
+      .value('vct', opts.vct)
+      .value('doctype', opts.doctype)
+      .push(...(opts.extraArgs ?? []));
+    if (opts.list) args.push(opts.list);
+    const { document } = await this.runner.run<{ url: string }>(args.args, runOpts(opts));
+    return document.url;
+  }
+
+  /** `trust ca-cert`: the shared wallet CA as PEM. */
+  async caCert(opts: CallOptions = {}): Promise<string> {
+    const { document } = await this.runner.run<{ pem: string }>(['trust', 'ca-cert', ...(opts.extraArgs ?? [])], runOpts(opts));
+    return document.pem;
+  }
+
+  /** `trust ca-cert --jwks`: the shared wallet CA as a JWKS with x5c. */
+  async caJwks(opts: CallOptions = {}): Promise<Jwks> {
+    const { document } = await this.runner.run<Jwks>(['trust', 'ca-cert', '--jwks', ...(opts.extraArgs ?? [])], runOpts(opts));
+    return document;
+  }
+
+  /** `trust add-ca`: put a CA on one of the wallet's lists. */
+  async addCa(opts: TrustAddCaOptions): Promise<TrustEntity> {
+    const scratch = new Scratch();
+    try {
+      const args = new ArgList('trust', 'add-ca')
+        .value('list', opts.list)
+        .value('ca', await scratch.file(opts.ca, 'ca.pem'))
+        .value('name', opts.name)
+        .push(...(opts.extraArgs ?? []));
+      const { document } = await this.runner.run<TrustEntity>(args.args, runOpts(opts));
+      return document;
+    } finally {
+      await scratch.cleanup();
+    }
+  }
+
+  /** `trust rm-ca <id>`. */
+  async removeCa(id: string, opts: CallOptions = {}): Promise<{ removed: string }> {
+    const { document } = await this.runner.run<{ removed: string }>(['trust', 'rm-ca', ...(opts.extraArgs ?? []), id], runOpts(opts));
+    return document;
+  }
+
+  /** `trust add-list <url>`: add an external list to the list of trusted lists. */
+  async addList(url: string, opts: CallOptions = {}): Promise<TrustListLink> {
+    const { document } = await this.runner.run<TrustListLink>(['trust', 'add-list', ...(opts.extraArgs ?? []), url], runOpts(opts));
+    return document;
+  }
+
+  /** `trust rm-list <url>`. */
+  async removeList(url: string, opts: CallOptions = {}): Promise<{ removed: string }> {
+    const { document } = await this.runner.run<{ removed: string }>(['trust', 'rm-list', ...(opts.extraArgs ?? []), url], runOpts(opts));
+    return document;
+  }
+}

package/src/errors.ts

@@ -0,0 +1,66 @@
+/** Details of a failed eudi-dev invocation. */
+export interface EudiDevErrorDetails {
+  /** Arguments passed to the binary (without the binary path). */
+  args: readonly string[];
+  /** Exit code, or `null` when the process was killed by a signal. */
+  exitCode: number | null;
+  /** Signal that killed the process, if any. */
+  signal: NodeJS.Signals | null;
+  /** Everything the process wrote to stderr. */
+  stderr: string;
+  /** Everything the process wrote to stdout. */
+  stdout: string;
+  /**
+   * The JSON document from stdout, if one was printed. `validate` prints its
+   * report even when a check fails (upstream ADR 0020).
+   */
+  document?: unknown;
+  /** Set when the process did not finish in time. */
+  timedOut?: boolean;
+  /** Underlying error (spawn failure, invalid JSON, ...). */
+  cause?: unknown;
+}
+
+/**
+ * Thrown when eudi-dev exits non-zero, cannot be started, times out, or
+ * breaks the one-JSON-document contract.
+ *
+ * eudi-dev only uses exit codes 0 and 1, so the reason is in {@link stderr}.
+ * {@link message} holds its last non-empty line, which is the error cobra
+ * printed.
+ */
+export class EudiDevError extends Error {
+  override readonly name = 'EudiDevError';
+  readonly args: readonly string[];
+  readonly exitCode: number | null;
+  readonly signal: NodeJS.Signals | null;
+  readonly stderr: string;
+  readonly stdout: string;
+  readonly document: unknown;
+  readonly timedOut: boolean;
+
+  constructor(message: string, details: EudiDevErrorDetails) {
+    super(message, details.cause !== undefined ? { cause: details.cause } : undefined);
+    this.args = details.args;
+    this.exitCode = details.exitCode;
+    this.signal = details.signal;
+    this.stderr = details.stderr;
+    this.stdout = details.stdout;
+    this.document = details.document;
+    this.timedOut = details.timedOut ?? false;
+  }
+}
+
+/** Thrown when the eudi-dev binary cannot be located, is not executable, or has an unsupported version. */
+export class EudiDevBinaryError extends Error {
+  override readonly name = 'EudiDevBinaryError';
+}
+
+/** Returns the last non-empty line of a stderr dump. */
+export function lastLine(text: string): string {
+  const lines = text
+    .split(/\r?\n/)
+    .map((l) => l.trim())
+    .filter(Boolean);
+  return lines.at(-1) ?? '';
+}

package/src/eudi.ts

@@ -0,0 +1,159 @@
+import { mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { type ResolveBinaryOptions, resolveBinary } from './binary.js';
+import {
+  type CallOptions,
+  type DecodeOptions,
+  dcql,
+  decode,
+  type IssueJwtOptions,
+  type IssueMdocOptions,
+  type IssueResult,
+  type IssueSdJwtOptions,
+  issueJwt,
+  issueMdoc,
+  issueSdJwt,
+  type ValidateOptions,
+  type ValidateResult,
+  validate,
+  version,
+} from './commands/credentials.js';
+import { RegistrarCommands } from './commands/registrar.js';
+import { TrustCommands } from './commands/trust.js';
+import { EudiDevBinaryError } from './errors.js';
+import type { Input } from './input.js';
+import { Runner, type RunOptions, type RunResult } from './runner.js';
+import type { DcqlQuery, DecodeResult, VersionInfo } from './types.js';
+import { parseVersion, SUPPORTED_MAJOR } from './version.js';
+
+export interface EudiDevOptions extends ResolveBinaryOptions {
+  /**
+   * EUDI_DEV_HOME for every call: wallet, CA, templates, registrar state.
+   * Default: a new temp directory per instance, removed by {@link EudiDev.dispose}.
+   */
+  home?: string;
+  /** Extra environment variables for every call. `undefined` removes one. */
+  env?: Record<string, string | undefined>;
+  /** Pass the caller's EUDI_DEV_* variables through. Default `false`. */
+  inheritEudiEnv?: boolean;
+  /** Default timeout per call in ms. Default 60 000. 0 turns it off. */
+  timeoutMs?: number;
+  /** Working directory of the child process. */
+  cwd?: string;
+  /** Accept a binary whose major version isn't {@link SUPPORTED_MAJOR}. Default `false`. */
+  allowAnyVersion?: boolean;
+}
+
+/**
+ * A handle on the eudi-dev CLI with its own state directory.
+ *
+ * ```ts
+ * await using eudi = await EudiDev.create();
+ * const { credential } = await eudi.issue.sdjwt({ pid: true });
+ * const { valid } = await eudi.validate(credential);
+ * ```
+ */
+export class EudiDev implements AsyncDisposable {
+  /** Path of the binary in use. */
+  readonly bin: string;
+  /** EUDI_DEV_HOME of this instance. */
+  readonly home: string;
+  /** Version reported by the binary. */
+  readonly version: VersionInfo;
+
+  readonly issue: {
+    sdjwt(opts?: IssueSdJwtOptions): Promise<IssueResult>;
+    jwt(opts?: IssueJwtOptions): Promise<IssueResult>;
+    mdoc(opts?: IssueMdocOptions): Promise<IssueResult>;
+  };
+  readonly trust: TrustCommands;
+  readonly registrar: RegistrarCommands;
+
+  private readonly runner: Runner;
+  private readonly ownsHome: boolean;
+  private disposed = false;
+
+  private constructor(runner: Runner, versionInfo: VersionInfo, ownsHome: boolean) {
+    this.runner = runner;
+    this.bin = runner.bin;
+    this.home = runner.home;
+    this.version = versionInfo;
+    this.ownsHome = ownsHome;
+    this.issue = {
+      sdjwt: (opts) => issueSdJwt(this.runner, opts),
+      jwt: (opts) => issueJwt(this.runner, opts),
+      mdoc: (opts) => issueMdoc(this.runner, opts),
+    };
+    this.trust = new TrustCommands(runner);
+    this.registrar = new RegistrarCommands(runner);
+  }
+
+  /** Resolves the binary, checks its version and sets up the home directory. */
+  static async create(options: EudiDevOptions = {}): Promise<EudiDev> {
+    const bin = await resolveBinary(options);
+    const ownsHome = options.home === undefined;
+    const home = options.home ?? (await mkdtemp(join(tmpdir(), 'eudi-dev-home-')));
+    const config: ConstructorParameters<typeof Runner>[0] = { bin, home };
+    if (options.env) config.env = options.env;
+    if (options.inheritEudiEnv !== undefined) config.inheritEudiEnv = options.inheritEudiEnv;
+    if (options.timeoutMs !== undefined) config.timeoutMs = options.timeoutMs;
+    if (options.cwd !== undefined) config.cwd = options.cwd;
+    const runner = new Runner(config);
+
+    try {
+      const info = await version(runner);
+      const parsed = parseVersion(info.version);
+      // A "dev" build has no version to check.
+      if (parsed && parsed.major !== SUPPORTED_MAJOR && !options.allowAnyVersion) {
+        throw new EudiDevBinaryError(
+          `${bin} is eudi-dev ${info.version}, but this package supports v${SUPPORTED_MAJOR}.x. Pass allowAnyVersion to use it anyway.`,
+        );
+      }
+      return new EudiDev(runner, info, ownsHome);
+    } catch (err) {
+      if (ownsHome) await rm(home, { recursive: true, force: true });
+      throw err;
+    }
+  }
+
+  /** Runs any eudi-dev command with `--json` and returns its parsed document. */
+  run<T = unknown>(args: readonly string[], opts?: RunOptions): Promise<RunResult<T>> {
+    this.assertOpen();
+    return this.runner.run<T>(args, opts);
+  }
+
+  /** `eudi decode`. */
+  decode(input: Input, opts?: DecodeOptions): Promise<DecodeResult> {
+    this.assertOpen();
+    return decode(this.runner, input, opts);
+  }
+
+  /** `eudi validate`. A failing check gives `valid: false` instead of throwing. */
+  validate(input: Input, opts?: ValidateOptions): Promise<ValidateResult> {
+    this.assertOpen();
+    return validate(this.runner, input, opts);
+  }
+
+  /** `eudi dcql`. */
+  dcql(input: Input, opts?: CallOptions): Promise<DcqlQuery> {
+    this.assertOpen();
+    return dcql(this.runner, input, opts);
+  }
+
+  /** Removes the home directory if this instance created it. */
+  async dispose(): Promise<void> {
+    if (this.disposed) return;
+    this.disposed = true;
+    if (this.ownsHome) await rm(this.home, { recursive: true, force: true });
+  }
+
+  async [Symbol.asyncDispose](): Promise<void> {
+    await this.dispose();
+  }
+
+  private assertOpen(): void {
+    if (this.disposed) throw new Error('EudiDev instance is disposed');
+  }
+}

package/src/index.ts

@@ -0,0 +1,44 @@
+export {
+  PLATFORM_PACKAGES,
+  type PlatformPackage,
+  platformPackage,
+  type ResolveBinaryOptions,
+  resolveBinary,
+} from './binary.js';
+export {
+  type CallOptions,
+  type CredentialCategory,
+  type DecodeFormat,
+  type DecodeOptions,
+  type IssueCommonOptions,
+  type IssueDisplayOptions,
+  type IssueJwtOptions,
+  type IssueMdocOptions,
+  type IssueRegistrationOptions,
+  type IssueResult,
+  type IssueSdJwtOptions,
+  isDecodedCredential,
+  type ValidateOptions,
+  type ValidateResult,
+} from './commands/credentials.js';
+export type {
+  AccessCertOptions,
+  AddIssuerOptions,
+  AddVerifierOptions,
+  AttestationOptions,
+  ExtendIssuerOptions,
+  ExtendVerifierOptions,
+  IntendedUseOptions,
+  PartyCommands,
+  PartyOptions,
+  RegistrarCommands,
+  RegistrationCertOptions,
+  RegistrationScopeOptions,
+} from './commands/registrar.js';
+export type { TrustAddCaOptions, TrustCommands, TrustListId, TrustShowOptions, TrustUrlOptions } from './commands/trust.js';
+export { EudiDevBinaryError, EudiDevError, type EudiDevErrorDetails } from './errors.js';
+export { EudiDev, type EudiDevOptions } from './eudi.js';
+export type { FileInput, Input } from './input.js';
+export { Runner, type RunnerConfig, type RunOptions, type RunResult } from './runner.js';
+export * from './types.js';
+export { EUDI_DEV_VERSION, SUPPORTED_MAJOR, UPSTREAM_REPO } from './version.js';

package/src/input.ts

@@ -0,0 +1,27 @@
+/**
+ * Input to a command that reads a credential, request or certificate.
+ *
+ * - A string or bytes is the content itself. It goes to the binary on stdin
+ *   (as the `-` argument), so there is no argv length limit.
+ * - `{ path }` is a file the binary reads. It must exist: upstream treats a
+ *   path that doesn't exist as raw input.
+ * - `{ url }` is an http(s) URL the binary fetches.
+ */
+export type Input = string | Uint8Array | { path: string } | { url: string };
+
+/**
+ * A file-valued flag (`--key`, `--trusted-list`, `--csr`, `--dcql`, ...).
+ *
+ * A string or bytes is the content. The runner writes it to a private temp
+ * file and passes that path. `{ path }` passes an existing file and `{ url }`
+ * a URL for flags that accept one.
+ */
+export type FileInput = string | Uint8Array | { path: string } | { url: string };
+
+export function isPathInput(v: unknown): v is { path: string } {
+  return typeof v === 'object' && v !== null && !(v instanceof Uint8Array) && typeof (v as { path?: unknown }).path === 'string';
+}
+
+export function isUrlInput(v: unknown): v is { url: string } {
+  return typeof v === 'object' && v !== null && !(v instanceof Uint8Array) && typeof (v as { url?: unknown }).url === 'string';
+}