finnest dcr

Fetch/summarize an SSA or safely inspect and reconcile OPIN DCR state.

Decode/fetch a provider DCR software statement (SSA), inspect a receiver DCR attempt, or reconcile one exact ambiguous attempt after out-of-band provider confirmation. SSA/token/secret material and certificate thumbprints are never printed.

Examples

finnest dcr ssa-summary --ssa-file ./ssa.jwt

finnest dcr ssa-summary --ssa-file ./ssa.jwt --json

finnest dcr fetch-ssa --org-id <id> --software-id <id> --directory-client-id <client-id> --brcac-cert ./brcac.pem --brcac-key ./brcac.key --out ./ssa.jwt

finnest dcr registration-status <authorisation-server-id>

finnest dcr reconcile <authorisation-server-id> <attempt-id> provider_confirmed_not_created --evidence-reference <provider-ticket> --yes

Options

• --ssa-file <path> — Path to a compact SSA JWT file for dcr ssa-summary.
• --ssa <jwt> — Compact SSA JWT to decode for dcr ssa-summary.
• --json — Emit a schema-versioned JSON envelope to stdout.
• --output <format> — Select text, json, or ndjson output.
• --no-color — Disable ANSI color without changing the output content mode.
• --no-evidence — Do not write .finnest run evidence.
• --verbose — Enable debug-level diagnostics.

Subcommands

• ssa-summary — Decode a compact SSA to a sanitized summary.
• fetch-ssa — Fetch a fresh SSA using the Directory-required mTLS + directory:software bearer (the Directory only accepts an SSA whose iat is under 5 minutes old). The assertion path is defined by the official OPIN Directory OpenAPI; --endpoint may change only the path on the configured Directory origin.
• registration-status — Read the sanitized local DCR registration/attempt state.
• reconcile — Delete one exact ambiguous attempt after provider confirmation.