@eudiplo/cli 8.0.2-main.e4bc4d4 → 8.1.0-main.a6a67b3

package/dist/index.js

@@ -2216,20 +2216,20 @@ var require_resolve = __commonJS({
       return false;
     }
     function countKeys(schema) {
-      let count = 0;
+      let count2 = 0;
       for (const key in schema) {
         if (key === "$ref")
           return Infinity;
-        count++;
+        count2++;
         if (SIMPLE_INLINED.has(key))
           continue;
         if (typeof schema[key] == "object") {
-          (0, util_1.eachItem)(schema[key], (sch) => count += countKeys(sch));
+          (0, util_1.eachItem)(schema[key], (sch) => count2 += countKeys(sch));
         }
-        if (count === Infinity)
+        if (count2 === Infinity)
           return Infinity;
       }
-      return count;
+      return count2;
     }
     function getFullPath(resolver, id = "", normalize) {
       if (normalize !== false)
@@ -3828,7 +3828,7 @@ var require_fast_uri = __commonJS({
         normalizeString(uri, options);
       } else if (typeof uri === "object") {
         uri = /** @type {T} */
-        parse4(serialize(uri, options), options);
+        parse5(serialize(uri, options), options);
       }
       return uri;
     }
@@ -3868,8 +3868,8 @@ var require_fast_uri = __commonJS({
     function resolveComponent(base, relative3, options, skipNormalization) {
       const target = {};
       if (!skipNormalization) {
-        base = parse4(serialize(base, options), options);
-        relative3 = parse4(serialize(relative3, options), options);
+        base = parse5(serialize(base, options), options);
+        relative3 = parse5(serialize(relative3, options), options);
       }
       options = options || {};
       if (!options.tolerant && relative3.scheme) {
@@ -4161,7 +4161,7 @@ var require_fast_uri = __commonJS({
       }
       return { parsed, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme };
     }
-    function parse4(uri, opts) {
+    function parse5(uri, opts) {
       return parseWithStatus(uri, opts).parsed;
     }
     function normalizeString(uri, opts) {
@@ -4198,7 +4198,7 @@ var require_fast_uri = __commonJS({
       resolveComponent,
       equal,
       serialize,
-      parse: parse4
+      parse: parse5
     };
     module.exports = fastUri;
     module.exports.default = fastUri;
@@ -5699,8 +5699,8 @@ var require_contains = __commonJS({
         cxt.result(valid, () => cxt.reset());
         function validateItemsWithCount() {
           const schValid = gen.name("_valid");
-          const count = gen.let("count", 0);
-          validateItems(schValid, () => gen.if(schValid, () => checkLimits(count)));
+          const count2 = gen.let("count", 0);
+          validateItems(schValid, () => gen.if(schValid, () => checkLimits(count2)));
         }
         function validateItems(_valid, block) {
           gen.forRange("i", 0, len, (i2) => {
@@ -5713,16 +5713,16 @@ var require_contains = __commonJS({
             block();
           });
         }
-        function checkLimits(count) {
-          gen.code((0, codegen_1._)`${count}++`);
+        function checkLimits(count2) {
+          gen.code((0, codegen_1._)`${count2}++`);
           if (max2 === void 0) {
-            gen.if((0, codegen_1._)`${count} >= ${min}`, () => gen.assign(valid, true).break());
+            gen.if((0, codegen_1._)`${count2} >= ${min}`, () => gen.assign(valid, true).break());
           } else {
-            gen.if((0, codegen_1._)`${count} > ${max2}`, () => gen.assign(valid, false).break());
+            gen.if((0, codegen_1._)`${count2} > ${max2}`, () => gen.assign(valid, false).break());
             if (min === 1)
               gen.assign(valid, true);
             else
-              gen.if((0, codegen_1._)`${count} >= ${min}`, () => gen.assign(valid, true));
+              gen.if((0, codegen_1._)`${count2} >= ${min}`, () => gen.assign(valid, true));
           }
         }
       }
@@ -12065,10 +12065,10 @@ import { isAbsolute as isAbsolute2, join as join2, relative, resolve as resolve2
 function createScanner(text, ignoreTrivia = false) {
   const len = text.length;
   let pos = 0, value = "", tokenOffset = 0, token = 16, lineNumber = 0, lineStartOffset = 0, tokenLineStartOffset = 0, prevTokenLineStartOffset = 0, scanError = 0;
-  function scanHexDigits(count, exact) {
+  function scanHexDigits(count2, exact) {
     let digits = 0;
     let value2 = 0;
-    while (digits < count || !exact) {
+    while (digits < count2 || !exact) {
       let ch = text.charCodeAt(pos);
       if (ch >= 48 && ch <= 57) {
         value2 = value2 * 16 + ch - 48;
@@ -12082,7 +12082,7 @@ function createScanner(text, ignoreTrivia = false) {
       pos++;
       digits++;
     }
-    if (digits < count) {
+    if (digits < count2) {
       value2 = -1;
     }
     return value2;
@@ -12707,9 +12707,9 @@ function format(documentText, range, options) {
   }
   return editOperations;
 }
-function repeat(s, count) {
+function repeat(s, count2) {
   let result = "";
-  for (let i2 = 0; i2 < count; i2++) {
+  for (let i2 = 0; i2 < count2; i2++) {
     result += s;
   }
   return result;
@@ -15260,12 +15260,43 @@ function assertConfigBundle(input) {
 }
 
 // ../../packages/eudiplo-config-format/dist/config-values.js
+var isVariableChar = (char) => char >= "A" && char <= "Z" || char >= "0" && char <= "9" || char === "_";
+function replacePlaceholders(input, replace) {
+  let output = "";
+  let copied = 0;
+  let start = input.indexOf("${");
+  while (start !== -1) {
+    let cursor = start + 2;
+    while (cursor < input.length && isVariableChar(input[cursor]))
+      cursor++;
+    const variable = input.slice(start + 2, cursor);
+    let end = -1;
+    let fallback;
+    if (variable && input[cursor] === "}")
+      end = cursor;
+    else if (variable && input[cursor] === ":") {
+      end = input.indexOf("}", cursor + 1);
+      if (end === -1)
+        break;
+      fallback = input.slice(cursor + 1, end);
+    }
+    if (end === -1) {
+      start = input.indexOf("${", start + 2);
+      continue;
+    }
+    output += input.slice(copied, start);
+    output += replace(input.slice(start, end + 1), variable, fallback);
+    copied = end + 1;
+    start = input.indexOf("${", copied);
+  }
+  return output + input.slice(copied);
+}
 function resolveConfigVariables(input, env) {
   const issues = [];
   const seen = /* @__PURE__ */ new WeakMap();
   function visit2(value, path2) {
     if (typeof value === "string")
-      return value.replace(/\$\{([A-Z0-9_]+)(?::([^}]*))?\}/g, (match, variable, fallback) => {
+      return replacePlaceholders(value, (match, variable, fallback) => {
         if (env[variable] !== void 0 && env[variable] !== "")
           return env[variable];
         if (fallback !== void 0)
@@ -20592,17 +20623,17 @@ function storageEnv(storage) {
   if (storage === "local") {
     return ["STORAGE_DRIVER=local", "LOCAL_STORAGE_DIR=/app/uploads"];
   }
-  const minioPassword = randomSecret();
+  const rustfsPassword = randomSecret();
   return [
     "STORAGE_DRIVER=s3",
-    "S3_ENDPOINT=http://minio:9000",
+    "S3_ENDPOINT=http://rustfs:9000",
     "S3_REGION=us-east-1",
-    "S3_ACCESS_KEY_ID=minioadmin",
-    `S3_SECRET_ACCESS_KEY=${minioPassword}`,
+    "S3_ACCESS_KEY_ID=rustfsadmin",
+    `S3_SECRET_ACCESS_KEY=${rustfsPassword}`,
     "S3_BUCKET=uploads",
     "S3_FORCE_PATH_STYLE=true",
-    "MINIO_ROOT_USER=minioadmin",
-    `MINIO_ROOT_PASSWORD=${minioPassword}`
+    "RUSTFS_ACCESS_KEY=rustfsadmin",
+    `RUSTFS_SECRET_KEY=${rustfsPassword}`
   ];
 }
 function kmsEnv(kms) {
@@ -20755,10 +20786,10 @@ function formatTextReport(scope, rootPath, results) {
 function formatTenantBlock(result) {
   const lines = [`${result.valid ? "PASS" : "FAIL"} ${result.id}`];
   if (result.valid) {
-    for (const [resourceType, count] of Object.entries(
+    for (const [resourceType, count2] of Object.entries(
       result.resourceCounts
     )) {
-      lines.push(`  ${count} ${pluralize(resourceType, count)}`);
+      lines.push(`  ${count2} ${pluralize(resourceType, count2)}`);
     }
   } else {
     lines.push(...formatTenantErrors(result.errors));
@@ -20804,8 +20835,8 @@ function groupErrorsByFile(errors) {
   }
   return Array.from(grouped.entries());
 }
-function pluralize(label, count) {
-  return count === 1 ? label : `${label}s`;
+function pluralize(label, count2) {
+  return count2 === 1 ? label : `${label}s`;
 }
 
 // src/commands/config/validate/validator.ts
@@ -21650,6 +21681,68 @@ function assertKnownService(service, known) {
   }
 }
 
+// src/services/container-state.ts
+function parseContainerStates(stdout) {
+  const trimmed = stdout.trim();
+  if (!trimmed) {
+    return [];
+  }
+  const entries = trimmed.startsWith("[") ? asArray(JSON.parse(trimmed)) : trimmed.split("\n").map((line) => line.trim()).filter((line) => line.startsWith("{")).map((line) => JSON.parse(line));
+  return entries.map((entry) => {
+    const record = entry;
+    const names = record.Names;
+    return {
+      name: Array.isArray(names) ? String(names[0] ?? "") : String(names ?? record.Name ?? ""),
+      state: String(record.State ?? ""),
+      status: String(record.Status ?? "")
+    };
+  });
+}
+function summarizeContainerStates(containers, projectName) {
+  const name = "service containers";
+  if (containers.length === 0) {
+    return {
+      name,
+      status: "warn",
+      message: `No containers found for project ${projectName}. Start it with eudiplo up.`
+    };
+  }
+  const unhealthy = containers.filter(
+    (container) => container.status.toLowerCase().includes("unhealthy")
+  );
+  if (unhealthy.length > 0) {
+    return {
+      name,
+      status: "fail",
+      message: `Unhealthy: ${describe(unhealthy)}`
+    };
+  }
+  const notRunning = containers.filter(
+    (container) => container.state.toLowerCase() !== "running"
+  );
+  if (notRunning.length > 0) {
+    return {
+      name,
+      status: "warn",
+      message: `${containers.length - notRunning.length}/${containers.length} running. Not running: ${describe(notRunning)}`
+    };
+  }
+  const starting = containers.filter(
+    (container) => container.status.toLowerCase().includes("starting")
+  ).length;
+  return {
+    name,
+    status: "pass",
+    message: `${containers.length} container(s) running${starting > 0 ? `, ${starting} still starting` : ""}.`
+  };
+}
+function asArray(value) {
+  return Array.isArray(value) ? value : [];
+}
+function describe(containers) {
+  return containers.map((container) => `${container.name} (${container.status})`).join(", ");
+}
+
 // src/services/deployment-drivers.ts
 var drivers = {
   compose: {
@@ -21663,6 +21756,12 @@ var drivers = {
         status: runtime ? "pass" : "warn",
         message: runtime ? `${runtime.name} found at ${runtime.command}` : "Docker or Podman was not found in a supported install location."
       });
+      if (runtime) {
+        checks.push(await composeProviderCheck(runtime, context));
+        checks.push(
+          await composeServicesCheck(runtime, instance, context)
+        );
+      }
       for (const composeFile of getComposeFiles(instance)) {
         let found = true;
         try {
@@ -22258,6 +22357,89 @@ async function resolveComposeService(options) {
   assertKnownService(service, parseServiceList(listed.stdout));
   return service;
 }
+async function composeProviderCheck(runtime, context) {
+  const version = await captureRuntime(
+    runtime.command,
+    ["compose", "version"],
+    context
+  );
+  if (version.code !== 0) {
+    return {
+      name: "compose provider",
+      status: "fail",
+      message: `${runtime.name} compose is not usable: ${firstLine(version.stderr) || `exit code ${version.code}`}`
+    };
+  }
+  return {
+    name: "compose provider",
+    status: "pass",
+    message: firstLine(version.stdout) || `${runtime.name} compose works`
+  };
+}
+async function composeServicesCheck(runtime, instance, context) {
+  if (!instance.projectName) {
+    return {
+      name: "service containers",
+      status: "skip",
+      message: "This instance has no Compose project name, so its containers cannot be identified."
+    };
+  }
+  const listed = await captureRuntime(
+    runtime.command,
+    [
+      "ps",
+      "--all",
+      "--filter",
+      `label=com.docker.compose.project=${instance.projectName}`,
+      "--format",
+      "json"
+    ],
+    context
+  );
+  if (listed.code !== 0) {
+    return {
+      name: "service containers",
+      status: "warn",
+      message: `Containers could not be listed: ${firstLine(listed.stderr) || `exit code ${listed.code}`}`
+    };
+  }
+  try {
+    return summarizeContainerStates(
+      parseContainerStates(listed.stdout),
+      instance.projectName
+    );
+  } catch {
+    return {
+      name: "service containers",
+      status: "warn",
+      message: `The container list returned by ${runtime.name} could not be read.`
+    };
+  }
+}
+function captureRuntime(command, args, context) {
+  return new Promise((resolveProcess) => {
+    const child = spawn(command, args, {
+      env: context.env,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout?.on("data", (chunk) => {
+      stdout += String(chunk);
+    });
+    child.stderr?.on("data", (chunk) => {
+      stderr += String(chunk);
+    });
+    child.on(
+      "error",
+      (error) => resolveProcess({ code: 1, stdout, stderr: error.message })
+    );
+    child.on(
+      "close",
+      (code) => resolveProcess({ code: code ?? 1, stdout, stderr })
+    );
+  });
+}
 async function resolveComposeRuntime(env) {
   const preferredRuntime = parsePreferredRuntime(
     env.EUDIPLO_CONTAINER_RUNTIME
@@ -22541,63 +22723,544 @@ function createDeploymentCommands(context, setExitCode) {
   );
 }
 
+// package.json
+var package_default = {
+  name: "@eudiplo/cli",
+  version: "8.1.0-main.a6a67b3",
+  description: "Deployment-aware command line tools for EUDIPLO",
+  private: false,
+  type: "module",
+  bin: {
+    eudiplo: "dist/index.js"
+  },
+  files: [
+    "dist",
+    "templates",
+    "README.md"
+  ],
+  scripts: {
+    "assets:sync": "node scripts/sync-cli-assets.cjs",
+    "assets:check": "node scripts/check-cli-assets.cjs",
+    build: "pnpm assets:sync && pnpm assets:check && tsc -p tsconfig.json",
+    "build:publish": "pnpm build && esbuild src/index.ts --bundle --platform=node --format=esm --target=node22.12 --alias:jsonc-parser=jsonc-parser/lib/esm/main.js --outfile=dist/index.js",
+    "build:sea:bundle": "pnpm assets:sync && pnpm assets:check && esbuild src/index.ts --bundle --platform=node --format=esm --target=node22.12 --alias:jsonc-parser=jsonc-parser/lib/esm/main.js --outfile=dist-sea/index.js",
+    "build:sea": "node scripts/build-cli-sea.mjs",
+    dev: "tsx src/index.ts",
+    test: "vitest run --project cli",
+    lint: "biome lint .",
+    prepublishOnly: "pnpm build:publish"
+  },
+  keywords: [
+    "eudiplo",
+    "cli",
+    "eudi",
+    "wallet",
+    "oid4vci",
+    "oid4vp"
+  ],
+  repository: {
+    type: "git",
+    url: "git+https://github.com/openwallet-foundation/eudiplo.git",
+    directory: "apps/cli"
+  },
+  homepage: "https://github.com/openwallet-foundation/eudiplo/tree/main/apps/cli#readme",
+  bugs: {
+    url: "https://github.com/openwallet-foundation/eudiplo/issues"
+  },
+  author: "OpenWallet Foundation",
+  license: "Apache-2.0",
+  engines: {
+    node: ">=22.12.0"
+  },
+  publishConfig: {
+    access: "public"
+  },
+  dependencies: {
+    "@eudiplo/config-format": "workspace:*",
+    ajv: "^8.20.0",
+    "ajv-formats": "^3.0.1",
+    commander: "^15.0.0",
+    fflate: "^0.8.3",
+    "jsonc-parser": "^3.3.1"
+  },
+  devDependencies: {
+    "@biomejs/biome": "2.5.14",
+    "@types/node": "^26.4.0",
+    esbuild: "^0.28.2",
+    tsx: "^4.23.13",
+    typescript: "^7.0.2",
+    vitest: "4.1.11"
+  }
+};
+
+// src/services/api-auth.ts
+async function requestAccessToken(baseUrl, context) {
+  const clientId = context.env.EUDIPLO_CLIENT_ID;
+  const clientSecret = context.env.EUDIPLO_CLIENT_SECRET;
+  if (!clientId || !clientSecret) {
+    return {
+      kind: "unavailable",
+      reason: "EUDIPLO_CLIENT_ID and EUDIPLO_CLIENT_SECRET are not set"
+    };
+  }
+  const tokenUrl = new URL("api/oauth2/token", withTrailingSlash(baseUrl));
+  try {
+    const response = await context.fetch(tokenUrl, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: "client_credentials",
+        client_id: clientId,
+        client_secret: clientSecret
+      }).toString()
+    });
+    if (!response.ok) {
+      return {
+        kind: "error",
+        reason: `the token endpoint returned HTTP ${response.status}`
+      };
+    }
+    const payload = await response.json();
+    const accessToken = typeof payload === "object" && payload !== null && "access_token" in payload ? String(payload.access_token) : "";
+    if (!accessToken) {
+      return {
+        kind: "error",
+        reason: "the token response did not contain an access token"
+      };
+    }
+    return { kind: "token", accessToken };
+  } catch (error) {
+    return {
+      kind: "error",
+      reason: `the token endpoint could not be reached: ${error instanceof Error ? error.message : String(error)}`
+    };
+  }
+}
+async function fetchAuthenticated(url, accessToken, context) {
+  try {
+    const response = await context.fetch(url, {
+      method: "GET",
+      headers: { authorization: `Bearer ${accessToken}` }
+    });
+    if (!response.ok) {
+      return {
+        ok: false,
+        status: response.status,
+        reason: `${url.pathname} returned HTTP ${response.status}`
+      };
+    }
+    return { ok: true, body: await response.json() };
+  } catch (error) {
+    return {
+      ok: false,
+      reason: `${url.pathname} could not be reached: ${error instanceof Error ? error.message : String(error)}`
+    };
+  }
+}
+function withTrailingSlash(url) {
+  return url.href.endsWith("/") ? url : new URL(`${url.href}/`);
+}
+
+// src/services/backend-checks.ts
+function compareVersions(cliVersion, backendVersion) {
+  const name = "version compatibility";
+  const cli = parse4(cliVersion);
+  const backend = parse4(backendVersion);
+  if (!cli || !backend) {
+    return {
+      name,
+      status: "warn",
+      message: `CLI ${cliVersion} and backend ${backendVersion} cannot be compared as versions.`
+    };
+  }
+  if (cli.major !== backend.major) {
+    return {
+      name,
+      status: "fail",
+      message: `CLI ${cliVersion} and backend ${backendVersion} are different major versions. Install a matching CLI with npm install -g @eudiplo/cli@${backend.major}.`
+    };
+  }
+  if (cli.minor !== backend.minor) {
+    return {
+      name,
+      status: "warn",
+      message: `CLI ${cliVersion} and backend ${backendVersion} differ in minor version; some commands may not be supported.`
+    };
+  }
+  return {
+    name,
+    status: "pass",
+    message: `CLI ${cliVersion} matches backend ${backendVersion}.`
+  };
+}
+function readBackendVersion(body) {
+  if (typeof body === "object" && body !== null && "version" in body) {
+    const version = body.version;
+    return typeof version === "string" && version ? version : void 0;
+  }
+  return void 0;
+}
+function readProviderHealth(body) {
+  if (!Array.isArray(body)) {
+    throw new Error("the provider health response was not a list");
+  }
+  return body.map((entry) => {
+    const record = entry;
+    return {
+      providerId: String(record.providerId ?? "unknown"),
+      type: String(record.type ?? "unknown"),
+      ok: record.ok === true,
+      latencyMs: typeof record.latencyMs === "number" ? record.latencyMs : void 0,
+      error: typeof record.error === "string" ? record.error : void 0
+    };
+  });
+}
+function summarizeProviderHealth(providers) {
+  const name = "KMS providers";
+  if (providers.length === 0) {
+    return {
+      name,
+      status: "warn",
+      message: "No KMS providers are registered for this tenant."
+    };
+  }
+  const failing = providers.filter((provider) => !provider.ok);
+  if (failing.length > 0) {
+    return {
+      name,
+      status: "fail",
+      message: `${failing.length}/${providers.length} provider(s) unhealthy: ${failing.map(
+        (provider) => `${provider.providerId} (${provider.type})${provider.error ? ", health check reported an error" : ""}`
+      ).join(", ")}`
+    };
+  }
+  return {
+    name,
+    status: "pass",
+    message: `${providers.length} provider(s) healthy: ${providers.map(
+      (provider) => `${provider.providerId} (${provider.type}${provider.latencyMs === void 0 ? "" : `, ${provider.latencyMs}ms`})`
+    ).join(", ")}`
+  };
+}
+function parse4(version) {
+  const match = /^v?(\d+)\.(\d+)\.(\d+)/.exec(version.trim());
+  if (!match) {
+    return void 0;
+  }
+  return {
+    major: Number(match[1]),
+    minor: Number(match[2]),
+    patch: Number(match[3])
+  };
+}
+
+// src/services/tls-expiry.ts
+import { connect } from "node:tls";
+var defaultExpiryWarningDays = 30;
+var dayInMs = 24 * 60 * 60 * 1e3;
+function evaluateCertificate(certificate, now, warningDays = defaultExpiryWarningDays) {
+  const remainingDays = Math.floor(
+    (certificate.validTo.getTime() - now.getTime()) / dayInMs
+  );
+  const expiresOn = certificate.validTo.toISOString().slice(0, 10);
+  if (remainingDays < 0) {
+    return {
+      name: "TLS certificate",
+      status: "fail",
+      message: `The certificate issued by ${certificate.issuer} expired on ${expiresOn}.`
+    };
+  }
+  if (remainingDays <= warningDays) {
+    return {
+      name: "TLS certificate",
+      status: "warn",
+      message: `The certificate expires on ${expiresOn}, in ${remainingDays} day(s). Renew it before then.`
+    };
+  }
+  return {
+    name: "TLS certificate",
+    status: "pass",
+    message: `Valid until ${expiresOn} (${remainingDays} day(s) left), issued by ${certificate.issuer}.`
+  };
+}
+var readPeerCertificate = (url) => new Promise((resolvePeer, rejectPeer) => {
+  const socket = connect(
+    {
+      host: url.hostname,
+      port: Number(url.port || 443),
+      servername: url.hostname,
+      rejectUnauthorized: true
+    },
+    () => {
+      const certificate = socket.getPeerCertificate();
+      socket.end();
+      if (!certificate || !certificate.valid_to) {
+        rejectPeer(new Error("no peer certificate was presented"));
+        return;
+      }
+      resolvePeer({
+        subject: String(certificate.subject?.CN ?? url.hostname),
+        issuer: String(certificate.issuer?.CN ?? "unknown issuer"),
+        validTo: new Date(certificate.valid_to)
+      });
+    }
+  );
+  socket.setTimeout(1e4, () => {
+    socket.destroy();
+    rejectPeer(new Error("the TLS handshake timed out"));
+  });
+  socket.once("error", (error) => {
+    socket.destroy();
+    rejectPeer(error);
+  });
+});
+async function checkTlsCertificate(baseUrl, now, read = readPeerCertificate, warningDays = defaultExpiryWarningDays) {
+  if (baseUrl.protocol !== "https:") {
+    return {
+      name: "TLS certificate",
+      status: "skip",
+      message: `${baseUrl.origin} does not use HTTPS, so there is no certificate to check.`
+    };
+  }
+  try {
+    return evaluateCertificate(await read(baseUrl), now, warningDays);
+  } catch (error) {
+    return {
+      name: "TLS certificate",
+      status: "fail",
+      message: `The certificate of ${baseUrl.origin} could not be verified: ${error instanceof Error ? error.message : String(error)}`
+    };
+  }
+}
+
 // src/services/diagnostics.ts
-async function runDoctor(instance, context, driverDiagnostics) {
-  const checks = [];
-  const baseUrl = parseUrl(instance.url);
-  if (!baseUrl) {
-    return [
-      {
+var publicUrlCheck = {
+  id: "public-url",
+  async run({ instance, baseUrl }) {
+    if (!baseUrl) {
+      return {
         name: "public URL",
         status: "fail",
         message: `${instance.url} is not a valid absolute URL`
-      }
-    ];
+      };
+    }
+    return {
+      name: "public URL",
+      status: baseUrl.protocol === "https:" ? "pass" : "warn",
+      message: baseUrl.protocol === "https:" ? `${baseUrl.href} uses HTTPS` : `${baseUrl.href} does not use HTTPS`
+    };
   }
-  checks.push({
-    name: "public URL",
-    status: baseUrl.protocol === "https:" ? "pass" : "warn",
-    message: baseUrl.protocol === "https:" ? `${baseUrl.href} uses HTTPS` : `${baseUrl.href} does not use HTTPS`
-  });
-  checks.push(
-    await checkEndpoint("API reachability", baseUrl, "/api/docs", context)
-  );
-  checks.push(
-    await checkEndpoint("health endpoint", baseUrl, "/health", context)
-  );
-  checks.push(checkAuthentication(context));
-  if (instance.clientUrl) {
+};
+var apiReachabilityCheck = {
+  id: "api-reachability",
+  run: ({ baseUrl, context }) => requireBaseUrl(
+    "API reachability",
+    baseUrl,
+    (url) => checkEndpoint("API reachability", url, "/api/docs", context)
+  )
+};
+var healthEndpointCheck = {
+  id: "health-endpoint",
+  run: ({ baseUrl, context }) => requireBaseUrl(
+    "health endpoint",
+    baseUrl,
+    (url) => checkEndpoint("health endpoint", url, "/health", context)
+  )
+};
+var tlsCertificateCheck = {
+  id: "tls-certificate",
+  run: ({ baseUrl, now, readCertificate }) => requireBaseUrl(
+    "TLS certificate",
+    baseUrl,
+    (url) => checkTlsCertificate(url, now, readCertificate)
+  )
+};
+var authenticationCheck = {
+  id: "authentication",
+  async run({ context }) {
+    const configured = Boolean(context.env.EUDIPLO_CLIENT_ID) && Boolean(context.env.EUDIPLO_CLIENT_SECRET);
+    return {
+      name: "authentication configuration",
+      status: configured ? "pass" : "warn",
+      message: configured ? "Client credentials are available in environment variables." : "Set EUDIPLO_CLIENT_ID and EUDIPLO_CLIENT_SECRET when commands need authenticated API access."
+    };
+  }
+};
+var clientConnectivityCheck = {
+  id: "client-connectivity",
+  async run({ instance, context }) {
+    if (!instance.clientUrl) {
+      return {
+        name: "client connectivity",
+        status: "skip",
+        message: "No client URL configured for this instance."
+      };
+    }
     const clientUrl = parseUrl(instance.clientUrl);
-    checks.push(
-      clientUrl ? await checkEndpoint(
-        "client connectivity",
-        clientUrl,
-        "/",
-        context
-      ) : {
+    if (!clientUrl) {
+      return {
         name: "client connectivity",
         status: "fail",
         message: `${instance.clientUrl} is not a valid absolute URL`
+      };
+    }
+    return checkEndpoint("client connectivity", clientUrl, "/", context);
+  }
+};
+var versionCompatibilityCheck = {
+  id: "version-compatibility",
+  run: ({ baseUrl, context, accessToken }) => requireBaseUrl("version compatibility", baseUrl, async (url) => {
+    const token = await accessToken();
+    if (token.kind !== "token") {
+      return authUnavailable("version compatibility", token);
+    }
+    const response = await fetchAuthenticated(
+      new URL("version", withTrailingSlash(url)),
+      token.accessToken,
+      context
+    );
+    if (!response.ok) {
+      if (response.status === 404) {
+        return {
+          name: "version compatibility",
+          status: "skip",
+          message: "This backend does not expose /version, so compatibility cannot be checked."
+        };
       }
+      return {
+        name: "version compatibility",
+        status: "fail",
+        message: `The backend version could not be read: ${response.reason}`
+      };
+    }
+    const backendVersion = readBackendVersion(response.body);
+    if (!backendVersion) {
+      return {
+        name: "version compatibility",
+        status: "warn",
+        message: "The backend did not report a version."
+      };
+    }
+    return compareVersions(package_default.version, backendVersion);
+  })
+};
+var kmsHealthCheck = {
+  id: "kms-health",
+  run: ({ baseUrl, context, accessToken }) => requireBaseUrl("KMS providers", baseUrl, async (url) => {
+    const token = await accessToken();
+    if (token.kind !== "token") {
+      return authUnavailable("KMS providers", token);
+    }
+    const response = await fetchAuthenticated(
+      new URL("key-chain/providers/health", withTrailingSlash(url)),
+      token.accessToken,
+      context
     );
-  } else {
-    checks.push({
-      name: "client connectivity",
-      status: "warn",
-      message: "No client URL configured for this instance."
-    });
+    if (!response.ok) {
+      if (response.status === 404) {
+        return {
+          name: "KMS providers",
+          status: "skip",
+          message: "This backend does not expose the KMS provider health endpoint."
+        };
+      }
+      return {
+        name: "KMS providers",
+        status: "fail",
+        message: `Provider health could not be read: ${response.reason}`
+      };
+    }
+    try {
+      return summarizeProviderHealth(
+        readProviderHealth(response.body)
+      );
+    } catch {
+      return {
+        name: "KMS providers",
+        status: "warn",
+        message: "The provider health response could not be read."
+      };
+    }
+  })
+};
+function authUnavailable(name, token) {
+  return {
+    name,
+    status: token.kind === "unavailable" ? "skip" : "fail",
+    message: token.kind === "unavailable" ? `Needs authentication: ${token.reason}.` : `Could not authenticate: ${token.reason}.`
+  };
+}
+var coreChecks = [
+  publicUrlCheck,
+  apiReachabilityCheck,
+  healthEndpointCheck,
+  tlsCertificateCheck,
+  authenticationCheck,
+  versionCompatibilityCheck,
+  kmsHealthCheck,
+  clientConnectivityCheck
+];
+async function runDoctor(instance, context, driverDiagnostics, options = {}) {
+  const baseUrl = parseUrl(instance.url);
+  let token;
+  const checkContext = {
+    instance,
+    context,
+    baseUrl,
+    now: options.now ?? /* @__PURE__ */ new Date(),
+    readCertificate: options.readCertificate ?? context.readCertificate ?? readPeerCertificate,
+    accessToken: () => {
+      if (!baseUrl) {
+        return Promise.resolve({
+          kind: "unavailable",
+          reason: "the instance URL could not be parsed"
+        });
+      }
+      token ??= requestAccessToken(baseUrl, context);
+      return token;
+    }
+  };
+  const checks = [];
+  for (const check of coreChecks) {
+    checks.push(await check.run(checkContext));
   }
   checks.push(...driverDiagnostics);
   return checks;
 }
-function hasFailedChecks(checks) {
-  return checks.some((check) => check.status === "fail");
+function summarizeChecks(checks) {
+  return {
+    pass: count(checks, "pass"),
+    warn: count(checks, "warn"),
+    fail: count(checks, "fail"),
+    skip: count(checks, "skip")
+  };
+}
+function hasFailedChecks(checks, strict = false) {
+  return checks.some(
+    (check) => check.status === "fail" || strict && check.status === "warn"
+  );
 }
 function formatChecks(checks) {
   return checks.map(
     (check) => `${formatStatus(check.status)} ${check.name}: ${check.message}`
   ).join("\n");
 }
+function formatSummary(summary) {
+  return `${summary.pass} passed, ${summary.warn} warning(s), ${summary.fail} failure(s), ${summary.skip} skipped`;
+}
+function count(checks, status) {
+  return checks.filter((check) => check.status === status).length;
+}
+async function requireBaseUrl(name, baseUrl, run) {
+  if (!baseUrl) {
+    return {
+      name,
+      status: "skip",
+      message: "The instance URL could not be parsed."
+    };
+  }
+  return run(baseUrl);
+}
 async function checkEndpoint(name, baseUrl, path2, context) {
   const url = new URL(path2, baseUrl);
   try {
@@ -22622,22 +23285,6 @@ async function checkEndpoint(name, baseUrl, path2, context) {
     };
   }
 }
-function checkAuthentication(context) {
-  const hasClientId = Boolean(context.env.EUDIPLO_CLIENT_ID);
-  const hasClientSecret = Boolean(context.env.EUDIPLO_CLIENT_SECRET);
-  if (hasClientId && hasClientSecret) {
-    return {
-      name: "authentication configuration",
-      status: "pass",
-      message: "Client credentials are available in environment variables."
-    };
-  }
-  return {
-    name: "authentication configuration",
-    status: "warn",
-    message: "Set EUDIPLO_CLIENT_ID and EUDIPLO_CLIENT_SECRET when commands need authenticated API access."
-  };
-}
 function parseUrl(value) {
   try {
     const url = new URL(value);
@@ -22653,28 +23300,54 @@ function formatStatus(status) {
   if (status === "warn") {
     return "WARN";
   }
+  if (status === "skip") {
+    return "SKIP";
+  }
   return "FAIL";
 }
 
 // src/commands/doctor/action.ts
-async function runDoctorCommand(config, parsed, context) {
-  const [instanceName, instance] = resolveInstance(config, parsed);
+async function runDoctorCommand(config, parsed, context, options = {}) {
+  const strict = parsed.flags.strict === true;
+  const instances = parsed.flags.all === true ? Object.keys(config.instances) : [resolveInstance(config, parsed)[0]];
+  if (instances.length === 0) {
+    throw new Error("No instances are configured.");
+  }
+  let failed = false;
+  for (const [index, instanceName] of instances.entries()) {
+    const instance = config.instances[instanceName];
+    if (index > 0) {
+      context.stdout.write("\n");
+    }
+    const checks = await runDiagnostics(instance, context, options);
+    context.stdout.write(
+      `Doctor for ${instanceName} (${instance.target})
+`
+    );
+    context.stdout.write(`${formatChecks(checks)}
+`);
+    context.stdout.write(`${formatSummary(summarizeChecks(checks))}
+`);
+    failed = hasFailedChecks(checks, strict) || failed;
+  }
+  return failed ? 1 : 0;
+}
+async function runDiagnostics(instance, context, options) {
   const driver = drivers[instance.target];
-  const checks = await runDoctor(
+  return runDoctor(
     instance,
     context,
-    await driver.diagnostics(instance, context)
+    await driver.diagnostics(instance, context),
+    options
   );
-  context.stdout.write(`Doctor for ${instanceName} (${instance.target})
-`);
-  context.stdout.write(`${formatChecks(checks)}
-`);
-  return hasFailedChecks(checks) ? 1 : 0;
 }
 
 // src/commands/doctor/index.ts
 function createDoctorCommand(context, setExitCode) {
-  return new Command("doctor").description("Run deployment diagnostics").option("--instance <name>", "select a configured instance").action(async (options) => {
+  return new Command("doctor").description("Run deployment diagnostics").option("--instance <name>", "select a configured instance").option("--all", "run the checks for every configured instance").option(
+    "--strict",
+    "treat warnings as failures (skipped checks never fail)"
+  ).action(async (options) => {
     const { config } = await loadCliState(context);
     setExitCode(
       await runDoctorCommand(
@@ -23458,7 +24131,7 @@ function parseVersion(tag) {
     patch: Number(match[3])
   };
 }
-function compareVersions(a, b) {
+function compareVersions2(a, b) {
   return a.major - b.major || a.minor - b.minor || a.patch - b.patch;
 }
 var migrationBaseUrl = "https://docs.eudiplo.dev/migration";
@@ -23470,7 +24143,7 @@ function migrationNotes(from, to) {
       `Cannot compare ${from} and ${to} as versions. Check the release notes and ${migrationBaseUrl} before continuing.`
     ];
   }
-  const order = compareVersions(fromVersion, toVersion);
+  const order = compareVersions2(fromVersion, toVersion);
   if (order > 0) {
     return [
       `${to} is older than ${from}. Downgrades are not supported once database migrations have run; restore a backup instead if you need to go back.`
@@ -23608,78 +24281,6 @@ function createUpgradeCommand(context, setExitCode) {
 
 // src/commands/version/action.ts
 import { isSea as isSea2 } from "node:sea";
-
-// package.json
-var package_default = {
-  name: "@eudiplo/cli",
-  version: "8.0.2-main.e4bc4d4",
-  description: "Deployment-aware command line tools for EUDIPLO",
-  private: false,
-  type: "module",
-  bin: {
-    eudiplo: "dist/index.js"
-  },
-  files: [
-    "dist",
-    "templates",
-    "README.md"
-  ],
-  scripts: {
-    "assets:sync": "node scripts/sync-cli-assets.cjs",
-    "assets:check": "node scripts/check-cli-assets.cjs",
-    build: "pnpm assets:sync && pnpm assets:check && tsc -p tsconfig.json",
-    "build:publish": "pnpm build && esbuild src/index.ts --bundle --platform=node --format=esm --target=node22.12 --alias:jsonc-parser=jsonc-parser/lib/esm/main.js --outfile=dist/index.js",
-    "build:sea:bundle": "pnpm assets:sync && pnpm assets:check && esbuild src/index.ts --bundle --platform=node --format=esm --target=node22.12 --alias:jsonc-parser=jsonc-parser/lib/esm/main.js --outfile=dist-sea/index.js",
-    "build:sea": "node scripts/build-cli-sea.mjs",
-    dev: "tsx src/index.ts",
-    test: "vitest run --project cli",
-    lint: "biome lint .",
-    prepublishOnly: "pnpm build:publish"
-  },
-  keywords: [
-    "eudiplo",
-    "cli",
-    "eudi",
-    "wallet",
-    "oid4vci",
-    "oid4vp"
-  ],
-  repository: {
-    type: "git",
-    url: "git+https://github.com/openwallet-foundation/eudiplo.git",
-    directory: "apps/cli"
-  },
-  homepage: "https://github.com/openwallet-foundation/eudiplo/tree/main/apps/cli#readme",
-  bugs: {
-    url: "https://github.com/openwallet-foundation/eudiplo/issues"
-  },
-  author: "OpenWallet Foundation",
-  license: "Apache-2.0",
-  engines: {
-    node: ">=22.12.0"
-  },
-  publishConfig: {
-    access: "public"
-  },
-  dependencies: {
-    "@eudiplo/config-format": "workspace:*",
-    ajv: "^8.20.0",
-    "ajv-formats": "^3.0.1",
-    commander: "^15.0.0",
-    fflate: "^0.8.3",
-    "jsonc-parser": "^3.3.1"
-  },
-  devDependencies: {
-    "@biomejs/biome": "2.5.14",
-    "@types/node": "^26.4.0",
-    esbuild: "^0.28.2",
-    tsx: "^4.23.13",
-    typescript: "^7.0.2",
-    vitest: "4.1.11"
-  }
-};
-
-// src/commands/version/action.ts
 function versionText() {
   return `${package_default.name} ${package_default.version}`;
 }