@eudiplo/cli 8.0.2 → 8.1.0-main.545119e

package/dist/index.js

@@ -2216,20 +2216,20 @@ var require_resolve = __commonJS({
       return false;
     }
     function countKeys(schema) {
-      let count = 0;
+      let count2 = 0;
       for (const key in schema) {
         if (key === "$ref")
           return Infinity;
-        count++;
+        count2++;
         if (SIMPLE_INLINED.has(key))
           continue;
         if (typeof schema[key] == "object") {
-          (0, util_1.eachItem)(schema[key], (sch) => count += countKeys(sch));
+          (0, util_1.eachItem)(schema[key], (sch) => count2 += countKeys(sch));
         }
-        if (count === Infinity)
+        if (count2 === Infinity)
           return Infinity;
       }
-      return count;
+      return count2;
     }
     function getFullPath(resolver, id = "", normalize) {
       if (normalize !== false)
@@ -2980,7 +2980,7 @@ var require_compile = __commonJS({
       const schOrFunc = root.refs[ref];
       if (schOrFunc)
         return schOrFunc;
-      let _sch = resolve7.call(this, root, ref);
+      let _sch = resolve9.call(this, root, ref);
       if (_sch === void 0) {
         const schema = (_a2 = root.localRefs) === null || _a2 === void 0 ? void 0 : _a2[ref];
         const { schemaId } = this.opts;
@@ -3007,7 +3007,7 @@ var require_compile = __commonJS({
     function sameSchemaEnv(s1, s2) {
       return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
     }
-    function resolve7(root, ref) {
+    function resolve9(root, ref) {
       let sch;
       while (typeof (sch = this.refs[ref]) == "string")
         ref = sch;
@@ -3828,11 +3828,11 @@ var require_fast_uri = __commonJS({
         normalizeString(uri, options);
       } else if (typeof uri === "object") {
         uri = /** @type {T} */
-        parse4(serialize(uri, options), options);
+        parse5(serialize(uri, options), options);
       }
       return uri;
     }
-    function resolve7(baseURI, relativeURI, options) {
+    function resolve9(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
       const {
         parsed: baseParsed,
@@ -3868,8 +3868,8 @@ var require_fast_uri = __commonJS({
     function resolveComponent(base, relative3, options, skipNormalization) {
       const target = {};
       if (!skipNormalization) {
-        base = parse4(serialize(base, options), options);
-        relative3 = parse4(serialize(relative3, options), options);
+        base = parse5(serialize(base, options), options);
+        relative3 = parse5(serialize(relative3, options), options);
       }
       options = options || {};
       if (!options.tolerant && relative3.scheme) {
@@ -4161,7 +4161,7 @@ var require_fast_uri = __commonJS({
       }
       return { parsed, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme };
     }
-    function parse4(uri, opts) {
+    function parse5(uri, opts) {
       return parseWithStatus(uri, opts).parsed;
     }
     function normalizeString(uri, opts) {
@@ -4194,11 +4194,11 @@ var require_fast_uri = __commonJS({
     var fastUri = {
       SCHEMES,
       normalize,
-      resolve: resolve7,
+      resolve: resolve9,
       resolveComponent,
       equal,
       serialize,
-      parse: parse4
+      parse: parse5
     };
     module.exports = fastUri;
     module.exports.default = fastUri;
@@ -5699,8 +5699,8 @@ var require_contains = __commonJS({
         cxt.result(valid, () => cxt.reset());
         function validateItemsWithCount() {
           const schValid = gen.name("_valid");
-          const count = gen.let("count", 0);
-          validateItems(schValid, () => gen.if(schValid, () => checkLimits(count)));
+          const count2 = gen.let("count", 0);
+          validateItems(schValid, () => gen.if(schValid, () => checkLimits(count2)));
         }
         function validateItems(_valid, block) {
           gen.forRange("i", 0, len, (i2) => {
@@ -5713,16 +5713,16 @@ var require_contains = __commonJS({
             block();
           });
         }
-        function checkLimits(count) {
-          gen.code((0, codegen_1._)`${count}++`);
+        function checkLimits(count2) {
+          gen.code((0, codegen_1._)`${count2}++`);
           if (max2 === void 0) {
-            gen.if((0, codegen_1._)`${count} >= ${min}`, () => gen.assign(valid, true).break());
+            gen.if((0, codegen_1._)`${count2} >= ${min}`, () => gen.assign(valid, true).break());
           } else {
-            gen.if((0, codegen_1._)`${count} > ${max2}`, () => gen.assign(valid, false).break());
+            gen.if((0, codegen_1._)`${count2} > ${max2}`, () => gen.assign(valid, false).break());
             if (min === 1)
               gen.assign(valid, true);
             else
-              gen.if((0, codegen_1._)`${count} >= ${min}`, () => gen.assign(valid, true));
+              gen.if((0, codegen_1._)`${count2} >= ${min}`, () => gen.assign(valid, true));
           }
         }
       }
@@ -12065,10 +12065,10 @@ import { isAbsolute as isAbsolute2, join as join2, relative, resolve as resolve2
 function createScanner(text, ignoreTrivia = false) {
   const len = text.length;
   let pos = 0, value = "", tokenOffset = 0, token = 16, lineNumber = 0, lineStartOffset = 0, tokenLineStartOffset = 0, prevTokenLineStartOffset = 0, scanError = 0;
-  function scanHexDigits(count, exact) {
+  function scanHexDigits(count2, exact) {
     let digits = 0;
     let value2 = 0;
-    while (digits < count || !exact) {
+    while (digits < count2 || !exact) {
       let ch = text.charCodeAt(pos);
       if (ch >= 48 && ch <= 57) {
         value2 = value2 * 16 + ch - 48;
@@ -12082,7 +12082,7 @@ function createScanner(text, ignoreTrivia = false) {
       pos++;
       digits++;
     }
-    if (digits < count) {
+    if (digits < count2) {
       value2 = -1;
     }
     return value2;
@@ -12707,9 +12707,9 @@ function format(documentText, range, options) {
   }
   return editOperations;
 }
-function repeat(s, count) {
+function repeat(s, count2) {
   let result = "";
-  for (let i2 = 0; i2 < count; i2++) {
+  for (let i2 = 0; i2 < count2; i2++) {
     result += s;
   }
   return result;
@@ -14887,7 +14887,7 @@ var CONFIG_FORMATS = {
   IssuanceConfig: {
     slug: "issuance-config",
     file: "IssuanceConfigFile",
-    version: 1
+    version: 2
   },
   CredentialConfig: {
     slug: "credential-config",
@@ -14897,7 +14897,7 @@ var CONFIG_FORMATS = {
   PresentationConfig: {
     slug: "presentation-config",
     file: "PresentationConfigFile",
-    version: 1
+    version: 2
   },
   AttributeProvider: {
     slug: "attribute-provider",
@@ -14936,7 +14936,42 @@ function resourceId(input) {
     throw new Error(`Configuration spec.${field} is required`);
   return id;
 }
-var CONFIG_MIGRATIONS = [];
+var presentationConfigV1ToV2 = {
+  id: "presentation-config-v2-provides-attestations",
+  kind: "PresentationConfig",
+  from: 1,
+  to: 2,
+  migrate(spec) {
+    const registrationCert = spec.registration_cert;
+    if (!object(registrationCert) || !object(registrationCert.body) || !("provided_attestations" in registrationCert.body)) {
+      return { spec };
+    }
+    const { provided_attestations: _, ...body } = registrationCert.body;
+    return {
+      spec: { ...spec, registration_cert: { ...registrationCert, body } },
+      issues: [
+        {
+          severity: "warning",
+          code: "PROVIDED_ATTESTATIONS_REMOVED",
+          path: "/spec/registration_cert/body/provided_attestations",
+          message: "provided_attestations is not part of the registrar API and was removed. Set provides_attestations to the credential type identifiers (SD-JWT VC vct or mdoc doctype) the issuer provides."
+        }
+      ]
+    };
+  }
+};
+var CONFIG_MIGRATIONS = [
+  {
+    id: "issuance-config-v2-offer-lifetime",
+    kind: "IssuanceConfig",
+    from: 1,
+    to: 2,
+    // v2 only adds the optional offerLifetimeSeconds: a v1 spec is a
+    // valid v2 spec whose offers keep having no lifetime.
+    migrate: (spec) => ({ spec })
+  },
+  presentationConfigV1ToV2
+];
 function schemaUrl(kind, version = CONFIG_FORMATS[kind].version) {
   if (!Number.isSafeInteger(version) || version < 1)
     throw new Error("Invalid config version");
@@ -15260,12 +15295,43 @@ function assertConfigBundle(input) {
 }
 
 // ../../packages/eudiplo-config-format/dist/config-values.js
+var isVariableChar = (char) => char >= "A" && char <= "Z" || char >= "0" && char <= "9" || char === "_";
+function replacePlaceholders(input, replace) {
+  let output = "";
+  let copied = 0;
+  let start = input.indexOf("${");
+  while (start !== -1) {
+    let cursor = start + 2;
+    while (cursor < input.length && isVariableChar(input[cursor]))
+      cursor++;
+    const variable = input.slice(start + 2, cursor);
+    let end = -1;
+    let fallback;
+    if (variable && input[cursor] === "}")
+      end = cursor;
+    else if (variable && input[cursor] === ":") {
+      end = input.indexOf("}", cursor + 1);
+      if (end === -1)
+        break;
+      fallback = input.slice(cursor + 1, end);
+    }
+    if (end === -1) {
+      start = input.indexOf("${", start + 2);
+      continue;
+    }
+    output += input.slice(copied, start);
+    output += replace(input.slice(start, end + 1), variable, fallback);
+    copied = end + 1;
+    start = input.indexOf("${", copied);
+  }
+  return output + input.slice(copied);
+}
 function resolveConfigVariables(input, env) {
   const issues = [];
   const seen = /* @__PURE__ */ new WeakMap();
   function visit2(value, path2) {
     if (typeof value === "string")
-      return value.replace(/\$\{([A-Z0-9_]+)(?::([^}]*))?\}/g, (match, variable, fallback) => {
+      return replacePlaceholders(value, (match, variable, fallback) => {
         if (env[variable] !== void 0 && env[variable] !== "")
           return env[variable];
         if (fallback !== void 0)
@@ -19970,215 +20036,1609 @@ var CONFIG_SCHEMAS = [
         "title": "CreateWebhookEndpointDto"
       }
     }
-  }
-];
-
-// ../../packages/eudiplo-config-format/dist/config-validator.js
-var ajv = new import__.Ajv2020({
-  allErrors: true,
-  strict: false,
-  validateFormats: false
-});
-for (const schema of CONFIG_SCHEMAS)
-  ajv.addSchema(schema);
-function validateConfigDocument(document) {
-  const file = serializeDocument(document);
-  const validate = ajv.getSchema(file.$schema);
-  if (!validate)
-    throw new Error(`No bundled validator for ${file.$schema}`);
-  const issues = [];
-  if (!validate(file)) {
-    for (const issue of validate.errors ?? [])
-      issues.push({
-        severity: "error",
-        code: "CONFIG_SCHEMA_VALIDATION_FAILED",
-        path: issue.instancePath || "/",
-        message: issue.keyword === "additionalProperties" ? `Unknown property: ${String(issue.params.additionalProperty)}` : issue.message ?? "Invalid configuration",
-        resource: { kind: document.kind, id: resourceId(document) }
-      });
-  }
-  const id = document.kind === "Client" ? document.spec.clientId : document.spec.id;
-  if (id !== void 0 && id !== resourceId(document))
-    issues.push({
-      severity: "error",
-      code: "RESOURCE_ID_MISMATCH",
-      path: document.kind === "Client" ? "/spec/clientId" : "/spec/id",
-      message: "Resource identifier does not match metadata.id"
-    });
-  return issues;
-}
-
-// src/commands/config/portability/migrations.ts
-function upgradeDocument(input) {
-  const result = migrateDocument(input, validateConfigDocument);
-  return { ...result, document: serializeDocument(result.document) };
-}
-
-// src/commands/config/portability/upgrade.ts
-var codec = new ConfigBundleCodec();
-function parse3(text, path2) {
-  try {
-    return JSON.parse(text);
-  } catch {
-    throw new Error(`Invalid JSON in ${path2}`);
-  }
-}
-function upgradeJson(input, file, context) {
-  const bundle = Array.isArray(input?.documents);
-  if (bundle) assertConfigBundle(input);
-  const results = (bundle ? input.documents : [input]).map(
-    (document) => upgradeDocument(document)
-  );
-  let blocked = false;
-  for (const result of results) {
-    for (const issue of result.issues) {
-      context.stderr.write(
-        `${file}${issue.path}: ${issue.severity} ${issue.code}: ${issue.message}
-`
-      );
-      if (issue.severity !== "warning") blocked = true;
-    }
-    for (const migration of result.migrations)
-      context.stdout.write(`${file}: migration ${migration}
-`);
-  }
-  if (blocked) throw new Error(`${file}: upgrade blocked; no output written`);
-  if (!bundle) return results[0].document;
-  const documents = results.map(
-    (result) => result.document
-  );
-  const resources = input.manifest.resources.map(
-    (resource) => {
-      const index = input.documents.findIndex(
-        (candidate) => normalizeDocument(candidate).kind === resource.kind && resourceId(candidate) === resource.id
-      );
-      const document = documents[index];
-      return {
-        ...resource,
-        id: resourceId(document),
-        $schema: document.$schema,
-        sha256: createHash2("sha256").update(JSON.stringify(document)).digest("hex")
-      };
-    }
-  );
-  const output = {
-    ...input,
-    manifest: { ...input.manifest, formatVersion: 2, resources },
-    documents
-  };
-  assertConfigBundle(output);
-  return output;
-}
-function report(input, output, file, parsed, context) {
-  const changed = stableConfigJson(input) !== stableConfigJson(output);
-  context.stdout.write(
-    `${file}: ${changed ? "upgrade required" : "current"}
-`
-  );
-  if (parsed.flags.diff === true)
-    for (const change of configChanges(input, output)) {
-      context.stdout.write(
-        `  ${change.path}: ${JSON.stringify(change.before) ?? "(absent)"} -> ${JSON.stringify(change.after) ?? "(absent)"}
-`
-      );
-    }
-  return changed;
-}
-function inferredKind(path2) {
-  const normalized = path2.split(sep2).join("/");
-  const match = TENANT_RESOURCE_REGISTRY.find(
-    (entry) => entry.kind === "file" ? normalized === entry.file || normalized.endsWith(`/${entry.file}`) : normalized.endsWith(`/${entry.subfolder}/${basename2(path2)}`) || normalized === `${entry.subfolder}/${basename2(path2)}`
-  );
-  return CONFIG_RESOURCE_KINDS.find(
-    (kind) => `${CONFIG_FORMATS[kind].file}.schema.json` === match?.schemaFile
-  );
-}
-function wrapBare(kind, input, path2) {
-  if (!input || typeof input !== "object" || Array.isArray(input))
-    throw new Error(`${path2}: configuration must be an object`);
-  const singleton = {
-    Tenant: "tenant",
-    KmsConfig: "kms",
-    RegistrarConfig: "registrar",
-    IssuanceConfig: "issuance"
-  };
-  const spec = structuredClone(input);
-  if (kind === "KeyChain" && spec.key && !spec.keySource) {
-    spec.keySource = { type: "private-jwk", jwk: spec.key };
-    delete spec.key;
-  }
-  const id = String(
-    singleton[kind] ?? spec.id ?? spec.clientId ?? basename2(path2, ".json")
-  );
-  if (!singleton[kind]) spec[kind === "Client" ? "clientId" : "id"] = id;
-  return { $schema: schemaUrl(kind, 1), metadata: { generation: 1 }, spec };
-}
-async function folderFiles(path2) {
-  const files = [];
-  for (const entry of await readdir(path2, { withFileTypes: true })) {
-    if (entry.name.startsWith(".")) continue;
-    const file = join4(path2, entry.name);
-    if (entry.isSymbolicLink())
-      throw new Error(`Config folder contains a symbolic link: ${file}`);
-    if (entry.isDirectory()) files.push(...await folderFiles(file));
-    else if (entry.isFile()) files.push(file);
-  }
-  return files.sort();
-}
-async function upgradeFolder(source, parsed, context) {
-  const outputs = /* @__PURE__ */ new Map();
-  let changed = 0;
-  for (const file of await folderFiles(source)) {
-    if (extname(file) !== ".json" || relative2(source, file).split(sep2).includes("images"))
-      continue;
-    const input = parse3(await readFile4(file, "utf8"), file);
-    const kind = inferredKind(relative2(source, file));
-    if (!kind && !isConfigDocument(input)) continue;
-    const candidate = isConfigDocument(input) ? input : wrapBare(kind, input, file);
-    const output = upgradeJson(candidate, file, context);
-    if (kind && normalizeDocument(output).kind !== kind)
-      throw new Error(`${file}: expected ${kind} configuration`);
-    if (report(input, output, relative2(source, file), parsed, context))
-      changed++;
-    outputs.set(
-      relative2(source, file),
-      `${JSON.stringify(output, null, 2)}
-`
-    );
-  }
-  if (!outputs.size)
-    throw new Error(`No configuration documents found in ${source}`);
-  context.stdout.write(
-    `${outputs.size - changed} current, ${changed} require upgrading
-`
-  );
-  if (parsed.flags.check === true) return changed ? 1 : 0;
-  if (parsed.flags["dry-run"] === true) return 0;
-  const destination = resolve3(
-    context.cwd,
-    readStringFlag(parsed.flags, "output") ?? `${source}.upgraded`
-  );
-  const overlap = (parent, child) => {
-    const path2 = relative2(parent, child);
-    return path2 === "" || !path2.startsWith(`..${sep2}`) && path2 !== "..";
-  };
-  if (overlap(source, destination) || overlap(destination, source))
-    throw new Error(
-      "Folder output must be separate from the source directory"
-    );
-  await lstat(destination).then(
-    () => {
-      throw new Error(`Output already exists: ${destination}`);
+  },
+  {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://eudiplo.dev/schemas/v2/IssuanceConfigFile.schema.json",
+    "title": "IssuanceConfigFile",
+    "type": "object",
+    "properties": {
+      "$schema": {
+        "type": "string",
+        "const": "https://eudiplo.dev/schemas/v2/IssuanceConfigFile.schema.json"
+      },
+      "metadata": {
+        "type": "object",
+        "properties": {
+          "generation": {
+            "type": "integer",
+            "minimum": 1,
+            "description": "Monotonically increasing configuration generation."
+          },
+          "ownership": {
+            "type": "string",
+            "enum": [
+              "unmanaged",
+              "file-managed"
+            ],
+            "description": "Requested ownership recorded when the document is applied."
+          }
+        },
+        "additionalProperties": false
+      },
+      "spec": {
+        "$ref": "#/$defs/IssuanceConfig"
+      }
     },
-    (error) => {
-      if (error.code !== "ENOENT") throw error;
-    }
-  );
-  await mkdir3(dirname3(destination), { recursive: true });
-  const staging = await mkdtemp(
-    join4(dirname3(destination), ".eudiplo-upgrade-")
-  );
-  try {
+    "required": [
+      "$schema",
+      "spec"
+    ],
+    "additionalProperties": false,
+    "$defs": {
+      "IssuanceConfig": {
+        "type": "object",
+        "properties": {
+          "batchSize": {
+            "description": "Optional issuance batch size.",
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 9007199254740991
+          },
+          "dPopRequired": {
+            "description": "Require DPoP proofs for issuance endpoints.",
+            "type": "boolean"
+          },
+          "walletAttestationRequired": {
+            "description": "Default wallet attestation requirement for managed authorization servers.",
+            "type": "boolean"
+          },
+          "walletProviderTrustLists": {
+            "description": "Shared wallet provider trust lists for key attestations and default authorization server wallet authentication.",
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": {
+                "trustListId": {
+                  "type": "string",
+                  "minLength": 1
+                },
+                "url": {
+                  "description": "URL of the wallet provider trust list.",
+                  "type": "string",
+                  "format": "uri"
+                },
+                "verifierKey": {
+                  "description": "Optional verifier key material used for trust list verification.",
+                  "type": "object",
+                  "propertyNames": {
+                    "type": "string"
+                  },
+                  "additionalProperties": {}
+                },
+                "verifierX509Der": {
+                  "description": "Optional verifier certificate in DER/base64 form.",
+                  "type": "string"
+                }
+              },
+              "additionalProperties": false
+            }
+          },
+          "signingKeyId": {
+            "description": "Default signing key chain id for credential issuance.",
+            "type": "string",
+            "minLength": 1
+          },
+          "authorizationServers": {
+            "minItems": 1,
+            "type": "array",
+            "items": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "type": {
+                      "type": "string",
+                      "const": "external",
+                      "description": "Use an externally managed authorization server."
+                    },
+                    "id": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Authorization server identifier."
+                    },
+                    "issuer": {
+                      "type": "string",
+                      "format": "uri",
+                      "description": "Issuer URL for the external authorization server."
+                    },
+                    "sessionBinding": {
+                      "description": "Explicit mapping from an external access-token claim to an existing issuance session.",
+                      "type": "object",
+                      "properties": {
+                        "method": {
+                          "type": "string",
+                          "const": "access_token_claim",
+                          "description": "Read the correlation value from a configured access-token claim."
+                        },
+                        "claim": {
+                          "type": "string",
+                          "minLength": 1,
+                          "description": "Claim name that contains the issuance-session correlation value."
+                        }
+                      },
+                      "required": [
+                        "method",
+                        "claim"
+                      ],
+                      "additionalProperties": false
+                    },
+                    "label": {
+                      "description": "Optional display label for UI selection.",
+                      "type": "string"
+                    },
+                    "enabled": {
+                      "description": "Whether this authorization server entry is enabled.",
+                      "type": "boolean"
+                    }
+                  },
+                  "required": [
+                    "type",
+                    "id",
+                    "issuer"
+                  ],
+                  "additionalProperties": false
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "type": {
+                      "type": "string",
+                      "const": "oid4vp",
+                      "description": "Use OID4VP-based authorization server chaining."
+                    },
+                    "id": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Authorization server identifier."
+                    },
+                    "presentationConfigId": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Presentation configuration id used during authorization."
+                    },
+                    "immediateWalletRedirect": {
+                      "description": "Redirect wallets immediately after authorization response creation.",
+                      "type": "boolean"
+                    },
+                    "token": {
+                      "description": "Optional token issuance settings.",
+                      "type": "object",
+                      "properties": {
+                        "lifetimeSeconds": {
+                          "description": "Access token lifetime in seconds.",
+                          "type": "number",
+                          "minimum": 60
+                        },
+                        "signingKeyId": {
+                          "description": "Optional key chain id used to sign issued tokens.",
+                          "type": "string",
+                          "minLength": 1
+                        },
+                        "refreshTokenEnabled": {
+                          "description": "Enable issuing refresh tokens.",
+                          "type": "boolean"
+                        },
+                        "refreshTokenExpiresInSeconds": {
+                          "description": "Refresh token lifetime in seconds.",
+                          "type": "number",
+                          "minimum": 60
+                        }
+                      },
+                      "additionalProperties": false
+                    },
+                    "requireDPoP": {
+                      "description": "Require DPoP proofs for token/credential requests.",
+                      "type": "boolean"
+                    },
+                    "walletAttestationRequired": {
+                      "description": "Require wallet attestation for this authorization server.",
+                      "type": "boolean"
+                    },
+                    "walletProviderTrustLists": {
+                      "description": "Optional wallet provider trust list references for this authorization server.",
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "trustListId": {
+                            "type": "string",
+                            "minLength": 1
+                          },
+                          "url": {
+                            "description": "URL of the wallet provider trust list.",
+                            "type": "string",
+                            "format": "uri"
+                          },
+                          "verifierKey": {
+                            "description": "Optional verifier key material used for trust list verification.",
+                            "type": "object",
+                            "propertyNames": {
+                              "type": "string"
+                            },
+                            "additionalProperties": {}
+                          },
+                          "verifierX509Der": {
+                            "description": "Optional verifier certificate in DER/base64 form.",
+                            "type": "string"
+                          }
+                        },
+                        "additionalProperties": false
+                      }
+                    },
+                    "label": {
+                      "description": "Optional display label for UI selection.",
+                      "type": "string"
+                    },
+                    "enabled": {
+                      "description": "Whether this authorization server entry is enabled.",
+                      "type": "boolean"
+                    }
+                  },
+                  "required": [
+                    "type",
+                    "id",
+                    "presentationConfigId"
+                  ],
+                  "additionalProperties": false
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "type": {
+                      "type": "string",
+                      "const": "chained",
+                      "description": "Use upstream OIDC as authorization source."
+                    },
+                    "id": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Authorization server identifier."
+                    },
+                    "upstream": {
+                      "type": "object",
+                      "properties": {
+                        "issuer": {
+                          "type": "string",
+                          "format": "uri",
+                          "description": "Upstream OIDC issuer URL."
+                        },
+                        "clientId": {
+                          "type": "string",
+                          "minLength": 1,
+                          "description": "Client id for upstream OIDC authentication."
+                        },
+                        "clientSecret": {
+                          "description": "Optional client secret for upstream OIDC authentication.",
+                          "type": "string",
+                          "minLength": 1
+                        },
+                        "scopes": {
+                          "description": "Optional scopes requested from the upstream issuer.",
+                          "type": "array",
+                          "items": {
+                            "type": "string",
+                            "minLength": 1
+                          }
+                        }
+                      },
+                      "required": [
+                        "issuer",
+                        "clientId"
+                      ],
+                      "additionalProperties": false,
+                      "description": "Upstream OIDC connection settings."
+                    },
+                    "token": {
+                      "description": "Optional token issuance settings.",
+                      "type": "object",
+                      "properties": {
+                        "lifetimeSeconds": {
+                          "description": "Access token lifetime in seconds.",
+                          "type": "number",
+                          "minimum": 60
+                        },
+                        "signingKeyId": {
+                          "description": "Optional key chain id used to sign issued tokens.",
+                          "type": "string",
+                          "minLength": 1
+                        },
+                        "refreshTokenEnabled": {
+                          "description": "Enable issuing refresh tokens.",
+                          "type": "boolean"
+                        },
+                        "refreshTokenExpiresInSeconds": {
+                          "description": "Refresh token lifetime in seconds.",
+                          "type": "number",
+                          "minimum": 60
+                        }
+                      },
+                      "additionalProperties": false
+                    },
+                    "requireDPoP": {
+                      "description": "Require DPoP proofs for token/credential requests.",
+                      "type": "boolean"
+                    },
+                    "walletAttestationRequired": {
+                      "description": "Require wallet attestation for this authorization server.",
+                      "type": "boolean"
+                    },
+                    "walletProviderTrustLists": {
+                      "description": "Optional wallet provider trust list references for this authorization server.",
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "trustListId": {
+                            "type": "string",
+                            "minLength": 1
+                          },
+                          "url": {
+                            "description": "URL of the wallet provider trust list.",
+                            "type": "string",
+                            "format": "uri"
+                          },
+                          "verifierKey": {
+                            "description": "Optional verifier key material used for trust list verification.",
+                            "type": "object",
+                            "propertyNames": {
+                              "type": "string"
+                            },
+                            "additionalProperties": {}
+                          },
+                          "verifierX509Der": {
+                            "description": "Optional verifier certificate in DER/base64 form.",
+                            "type": "string"
+                          }
+                        },
+                        "additionalProperties": false
+                      }
+                    },
+                    "label": {
+                      "description": "Optional display label for UI selection.",
+                      "type": "string"
+                    },
+                    "enabled": {
+                      "description": "Whether this authorization server entry is enabled.",
+                      "type": "boolean"
+                    }
+                  },
+                  "required": [
+                    "type",
+                    "id",
+                    "upstream"
+                  ],
+                  "additionalProperties": false
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "type": {
+                      "type": "string",
+                      "const": "built-in",
+                      "description": "Use EUDIPLO built-in authorization server."
+                    },
+                    "id": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Authorization server identifier."
+                    },
+                    "token": {
+                      "description": "Optional token issuance settings.",
+                      "type": "object",
+                      "properties": {
+                        "lifetimeSeconds": {
+                          "description": "Access token lifetime in seconds.",
+                          "type": "number",
+                          "minimum": 60
+                        },
+                        "signingKeyId": {
+                          "description": "Optional key chain id used to sign issued tokens.",
+                          "type": "string",
+                          "minLength": 1
+                        },
+                        "refreshTokenEnabled": {
+                          "description": "Enable issuing refresh tokens.",
+                          "type": "boolean"
+                        },
+                        "refreshTokenExpiresInSeconds": {
+                          "description": "Refresh token lifetime in seconds.",
+                          "type": "number",
+                          "minimum": 60
+                        }
+                      },
+                      "additionalProperties": false
+                    },
+                    "requireDPoP": {
+                      "description": "Require DPoP proofs for token/credential requests.",
+                      "type": "boolean"
+                    },
+                    "walletAttestationRequired": {
+                      "description": "Require wallet attestation for this authorization server.",
+                      "type": "boolean"
+                    },
+                    "walletProviderTrustLists": {
+                      "description": "Optional wallet provider trust list references for this authorization server.",
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "trustListId": {
+                            "type": "string",
+                            "minLength": 1
+                          },
+                          "url": {
+                            "description": "URL of the wallet provider trust list.",
+                            "type": "string",
+                            "format": "uri"
+                          },
+                          "verifierKey": {
+                            "description": "Optional verifier key material used for trust list verification.",
+                            "type": "object",
+                            "propertyNames": {
+                              "type": "string"
+                            },
+                            "additionalProperties": {}
+                          },
+                          "verifierX509Der": {
+                            "description": "Optional verifier certificate in DER/base64 form.",
+                            "type": "string"
+                          }
+                        },
+                        "additionalProperties": false
+                      }
+                    },
+                    "label": {
+                      "description": "Optional display label for UI selection.",
+                      "type": "string"
+                    },
+                    "enabled": {
+                      "description": "Whether this authorization server entry is enabled.",
+                      "type": "boolean"
+                    }
+                  },
+                  "required": [
+                    "type",
+                    "id"
+                  ],
+                  "additionalProperties": false
+                }
+              ],
+              "description": "Supported authorization server configurations."
+            },
+            "description": "Configured authorization server entries."
+          },
+          "federation": {
+            "description": "Optional OpenID Federation settings.",
+            "anyOf": [
+              {
+                "type": "object",
+                "properties": {
+                  "role": {
+                    "description": "Federation role for this issuer.",
+                    "type": "string",
+                    "enum": [
+                      "trust_anchor",
+                      "intermediate",
+                      "leaf"
+                    ]
+                  },
+                  "mode": {
+                    "description": "Federation operation mode.",
+                    "type": "string",
+                    "enum": [
+                      "federation-only",
+                      "hybrid"
+                    ]
+                  },
+                  "entityId": {
+                    "description": "Optional local federation entity id.",
+                    "type": "string"
+                  },
+                  "enforceSigningPolicy": {
+                    "description": "Enforce strict signing policy checks.",
+                    "type": "boolean"
+                  },
+                  "cacheTtlSeconds": {
+                    "description": "Cache time-to-live for federation metadata in seconds.",
+                    "type": "integer",
+                    "minimum": 1,
+                    "maximum": 9007199254740991
+                  },
+                  "trustAnchors": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "entityId": {
+                          "type": "string",
+                          "minLength": 1,
+                          "description": "Federation trust anchor entity id."
+                        },
+                        "entityConfigurationUri": {
+                          "type": "string",
+                          "format": "uri",
+                          "description": "Entity configuration URI for the trust anchor."
+                        }
+                      },
+                      "required": [
+                        "entityId",
+                        "entityConfigurationUri"
+                      ],
+                      "additionalProperties": false
+                    },
+                    "description": "Federation trust anchors."
+                  }
+                },
+                "required": [
+                  "trustAnchors"
+                ],
+                "additionalProperties": false
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "registrationCertificate": {
+            "description": "Optional registration certificate settings.",
+            "anyOf": [
+              {
+                "type": "object",
+                "properties": {
+                  "enabled": {
+                    "description": "Enable issuer registration certificate support.",
+                    "type": "boolean"
+                  },
+                  "mode": {
+                    "description": "How registration certificate data is provided.",
+                    "type": "string",
+                    "enum": [
+                      "import",
+                      "generate"
+                    ]
+                  },
+                  "jwt": {
+                    "description": "Optional registration certificate JWT when using import mode.",
+                    "type": "string"
+                  },
+                  "privacyPolicy": {
+                    "description": "Optional privacy policy URI.",
+                    "type": "string"
+                  },
+                  "supportUri": {
+                    "description": "Optional support URI.",
+                    "type": "string"
+                  }
+                },
+                "additionalProperties": false
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "display": {
+            "description": "Localized issuer metadata shown to wallets.",
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "description": "Issuer display name.",
+                  "type": "string"
+                },
+                "locale": {
+                  "description": "Locale tag for this display entry.",
+                  "type": "string"
+                },
+                "logo": {
+                  "description": "Optional issuer logo metadata.",
+                  "type": "object",
+                  "properties": {
+                    "uri": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Logo URI."
+                    },
+                    "alt_text": {
+                      "description": "Optional localized alternative text.",
+                      "type": "string"
+                    }
+                  },
+                  "required": [
+                    "uri"
+                  ],
+                  "additionalProperties": {}
+                }
+              },
+              "additionalProperties": {}
+            }
+          },
+          "notificationEndpointEnabled": {
+            "description": "Whether the OID4VCI notification endpoint is exposed for this issuance configuration.",
+            "type": "boolean"
+          },
+          "credentialResponseEncryption": {
+            "description": "Enable encrypted credential responses.",
+            "type": "boolean"
+          },
+          "credentialRequestEncryption": {
+            "description": "Require encrypted credential requests.",
+            "type": "boolean"
+          },
+          "txCodeMaxAttempts": {
+            "description": "Maximum verification attempts for transaction codes. Null resets to defaults.",
+            "anyOf": [
+              {
+                "type": "integer",
+                "minimum": 1,
+                "maximum": 9007199254740991
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "offerLifetimeSeconds": {
+            "description": "Default lifetime of credential offers in seconds. Can be overridden per offer request. Null or unset: offers do not expire.",
+            "anyOf": [
+              {
+                "type": "integer",
+                "minimum": 1,
+                "maximum": 9007199254740991
+              },
+              {
+                "type": "null"
+              }
+            ]
+          }
+        },
+        "required": [
+          "authorizationServers"
+        ],
+        "additionalProperties": false,
+        "title": "IssuanceConfig"
+      }
+    }
+  },
+  {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://eudiplo.dev/schemas/v2/PresentationConfigFile.schema.json",
+    "title": "PresentationConfigFile",
+    "type": "object",
+    "properties": {
+      "$schema": {
+        "type": "string",
+        "const": "https://eudiplo.dev/schemas/v2/PresentationConfigFile.schema.json"
+      },
+      "metadata": {
+        "type": "object",
+        "properties": {
+          "generation": {
+            "type": "integer",
+            "minimum": 1,
+            "description": "Monotonically increasing configuration generation."
+          },
+          "ownership": {
+            "type": "string",
+            "enum": [
+              "unmanaged",
+              "file-managed"
+            ],
+            "description": "Requested ownership recorded when the document is applied."
+          }
+        },
+        "additionalProperties": false
+      },
+      "spec": {
+        "allOf": [
+          {
+            "$ref": "#/$defs/PresentationConfigCreateDto"
+          },
+          {
+            "type": "object",
+            "required": [
+              "id"
+            ],
+            "properties": {
+              "id": {
+                "type": "string",
+                "minLength": 1
+              }
+            }
+          }
+        ]
+      }
+    },
+    "required": [
+      "$schema",
+      "spec"
+    ],
+    "additionalProperties": false,
+    "$defs": {
+      "PresentationConfigCreateDto": {
+        "type": "object",
+        "properties": {
+          "id": {
+            "type": "string",
+            "minLength": 1,
+            "description": "Presentation configuration identifier."
+          },
+          "description": {
+            "description": "Optional presentation configuration description.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "lifeTime": {
+            "description": "Presentation request lifetime in seconds.",
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 9007199254740991
+          },
+          "skewSeconds": {
+            "description": "Clock skew tolerance in seconds.",
+            "type": "integer",
+            "minimum": 0,
+            "maximum": 9007199254740991
+          },
+          "statusCheckMode": {
+            "description": "Revocation/status check mode.",
+            "type": "string",
+            "enum": [
+              "strict",
+              "best_effort",
+              "disabled"
+            ]
+          },
+          "dcql_query": {
+            "type": "object",
+            "properties": {
+              "credentials": {
+                "minItems": 1,
+                "type": "array",
+                "items": {
+                  "oneOf": [
+                    {
+                      "type": "object",
+                      "properties": {
+                        "id": {
+                          "type": "string",
+                          "minLength": 1,
+                          "pattern": "^[A-Za-z0-9_-]+$",
+                          "description": "Credential query identifier."
+                        },
+                        "multiple": {
+                          "description": "Allow multiple matching credentials.",
+                          "type": "boolean"
+                        },
+                        "claim_sets": {
+                          "description": "Optional claim set constraints.",
+                          "type": "array",
+                          "items": {
+                            "type": "array",
+                            "items": {
+                              "type": "string"
+                            }
+                          }
+                        },
+                        "trusted_authorities": {
+                          "description": "Optional trusted authority constraints.",
+                          "type": "array",
+                          "items": {
+                            "oneOf": [
+                              {
+                                "type": "object",
+                                "properties": {
+                                  "type": {
+                                    "type": "string",
+                                    "const": "etsi_tl",
+                                    "description": "Trusted authority type discriminator for ETSI trust lists."
+                                  },
+                                  "values": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "object",
+                                      "properties": {
+                                        "trustListId": {
+                                          "description": "Optional trust list id reference.",
+                                          "type": "string"
+                                        },
+                                        "url": {
+                                          "description": "Optional trust list URL reference.",
+                                          "anyOf": [
+                                            {
+                                              "type": "string",
+                                              "format": "uri"
+                                            },
+                                            {
+                                              "type": "string",
+                                              "pattern": "^<TENANT_URL>(?:\\/.*)?$"
+                                            }
+                                          ]
+                                        },
+                                        "verifierKey": {
+                                          "description": "Optional verifier key material.",
+                                          "type": "object",
+                                          "propertyNames": {
+                                            "type": "string"
+                                          },
+                                          "additionalProperties": {}
+                                        },
+                                        "verifierX509Der": {
+                                          "description": "Optional verifier certificate in DER/base64 form.",
+                                          "type": "string"
+                                        }
+                                      },
+                                      "additionalProperties": false
+                                    },
+                                    "description": "Trust list references for ETSI TL verification."
+                                  }
+                                },
+                                "required": [
+                                  "type",
+                                  "values"
+                                ],
+                                "additionalProperties": false
+                              },
+                              {
+                                "type": "object",
+                                "properties": {
+                                  "type": {
+                                    "type": "string",
+                                    "const": "openid_federation",
+                                    "description": "Trusted authority type discriminator for OpenID Federation."
+                                  },
+                                  "values": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "string"
+                                    },
+                                    "description": "OpenID Federation authority identifiers."
+                                  }
+                                },
+                                "required": [
+                                  "type",
+                                  "values"
+                                ],
+                                "additionalProperties": false
+                              }
+                            ]
+                          }
+                        },
+                        "format": {
+                          "type": "string",
+                          "const": "dc+sd-jwt",
+                          "description": "Credential format discriminator."
+                        },
+                        "meta": {
+                          "type": "object",
+                          "properties": {
+                            "vct_values": {
+                              "minItems": 1,
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "description": "Accepted VCT values."
+                            }
+                          },
+                          "required": [
+                            "vct_values"
+                          ],
+                          "additionalProperties": false
+                        },
+                        "claims": {
+                          "description": "Optional claim-level constraints.",
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "id": {
+                                "description": "Optional claim query id.",
+                                "type": "string"
+                              },
+                              "path": {
+                                "type": "array",
+                                "items": {
+                                  "type": [
+                                    "string",
+                                    "number"
+                                  ]
+                                },
+                                "description": "Path to the claim value in presented credentials."
+                              },
+                              "values": {
+                                "description": "Optional allowed values for the claim.",
+                                "type": "array",
+                                "items": {
+                                  "type": "string"
+                                }
+                              }
+                            },
+                            "required": [
+                              "path"
+                            ],
+                            "additionalProperties": false
+                          }
+                        }
+                      },
+                      "required": [
+                        "id",
+                        "format",
+                        "meta"
+                      ],
+                      "additionalProperties": false
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "id": {
+                          "type": "string",
+                          "minLength": 1,
+                          "pattern": "^[A-Za-z0-9_-]+$",
+                          "description": "Credential query identifier."
+                        },
+                        "multiple": {
+                          "description": "Allow multiple matching credentials.",
+                          "type": "boolean"
+                        },
+                        "claim_sets": {
+                          "description": "Optional claim set constraints.",
+                          "type": "array",
+                          "items": {
+                            "type": "array",
+                            "items": {
+                              "type": "string"
+                            }
+                          }
+                        },
+                        "trusted_authorities": {
+                          "description": "Optional trusted authority constraints.",
+                          "type": "array",
+                          "items": {
+                            "oneOf": [
+                              {
+                                "type": "object",
+                                "properties": {
+                                  "type": {
+                                    "type": "string",
+                                    "const": "etsi_tl",
+                                    "description": "Trusted authority type discriminator for ETSI trust lists."
+                                  },
+                                  "values": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "object",
+                                      "properties": {
+                                        "trustListId": {
+                                          "description": "Optional trust list id reference.",
+                                          "type": "string"
+                                        },
+                                        "url": {
+                                          "description": "Optional trust list URL reference.",
+                                          "anyOf": [
+                                            {
+                                              "type": "string",
+                                              "format": "uri"
+                                            },
+                                            {
+                                              "type": "string",
+                                              "pattern": "^<TENANT_URL>(?:\\/.*)?$"
+                                            }
+                                          ]
+                                        },
+                                        "verifierKey": {
+                                          "description": "Optional verifier key material.",
+                                          "type": "object",
+                                          "propertyNames": {
+                                            "type": "string"
+                                          },
+                                          "additionalProperties": {}
+                                        },
+                                        "verifierX509Der": {
+                                          "description": "Optional verifier certificate in DER/base64 form.",
+                                          "type": "string"
+                                        }
+                                      },
+                                      "additionalProperties": false
+                                    },
+                                    "description": "Trust list references for ETSI TL verification."
+                                  }
+                                },
+                                "required": [
+                                  "type",
+                                  "values"
+                                ],
+                                "additionalProperties": false
+                              },
+                              {
+                                "type": "object",
+                                "properties": {
+                                  "type": {
+                                    "type": "string",
+                                    "const": "openid_federation",
+                                    "description": "Trusted authority type discriminator for OpenID Federation."
+                                  },
+                                  "values": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "string"
+                                    },
+                                    "description": "OpenID Federation authority identifiers."
+                                  }
+                                },
+                                "required": [
+                                  "type",
+                                  "values"
+                                ],
+                                "additionalProperties": false
+                              }
+                            ]
+                          }
+                        },
+                        "format": {
+                          "type": "string",
+                          "const": "mso_mdoc",
+                          "description": "Credential format discriminator."
+                        },
+                        "meta": {
+                          "type": "object",
+                          "properties": {
+                            "doctype_value": {
+                              "type": "string",
+                              "minLength": 1,
+                              "description": "Expected mDoc doctype value."
+                            }
+                          },
+                          "required": [
+                            "doctype_value"
+                          ],
+                          "additionalProperties": false
+                        },
+                        "claims": {
+                          "description": "Optional mDoc claim-level constraints.",
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "id": {
+                                "description": "Optional claim query id.",
+                                "type": "string"
+                              },
+                              "path": {
+                                "type": "array",
+                                "items": {
+                                  "type": [
+                                    "string",
+                                    "number"
+                                  ]
+                                },
+                                "description": "Path to the claim value in presented credentials."
+                              },
+                              "values": {
+                                "description": "Optional allowed values for the claim.",
+                                "type": "array",
+                                "items": {
+                                  "type": "string"
+                                }
+                              },
+                              "intent_to_retain": {
+                                "description": "Whether relying party intends to retain the claim.",
+                                "type": "boolean"
+                              }
+                            },
+                            "required": [
+                              "path"
+                            ],
+                            "additionalProperties": false
+                          }
+                        }
+                      },
+                      "required": [
+                        "id",
+                        "format",
+                        "meta"
+                      ],
+                      "additionalProperties": false
+                    }
+                  ]
+                },
+                "description": "Credential queries requested by the verifier."
+              },
+              "credential_sets": {
+                "description": "Optional higher-level credential set requirements.",
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "options": {
+                      "minItems": 1,
+                      "type": "array",
+                      "items": {
+                        "minItems": 1,
+                        "type": "array",
+                        "items": {
+                          "type": "string"
+                        }
+                      },
+                      "description": "Alternative credential query id combinations."
+                    },
+                    "required": {
+                      "description": "Whether this credential set is mandatory.",
+                      "type": "boolean"
+                    }
+                  },
+                  "required": [
+                    "options"
+                  ],
+                  "additionalProperties": false
+                }
+              }
+            },
+            "required": [
+              "credentials"
+            ],
+            "additionalProperties": false,
+            "description": "DCQL query defining requested credentials and claims."
+          },
+          "transaction_data": {
+            "description": "Optional transaction data descriptors.",
+            "anyOf": [
+              {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "type": {
+                      "type": "string",
+                      "description": "Transaction data type identifier."
+                    },
+                    "credential_ids": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "description": "Credential query ids this transaction data applies to."
+                    },
+                    "payload": {
+                      "description": "Transaction details. Required for TS12 SCA transaction data."
+                    }
+                  },
+                  "required": [
+                    "type",
+                    "credential_ids"
+                  ],
+                  "additionalProperties": {}
+                }
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "registration_cert": {
+            "description": "Optional registration certificate request settings.",
+            "anyOf": [
+              {
+                "type": "object",
+                "properties": {
+                  "id": {
+                    "type": "string"
+                  },
+                  "body": {
+                    "type": "object",
+                    "properties": {
+                      "privacy_policy": {
+                        "type": "string"
+                      },
+                      "support_uri": {
+                        "type": "string"
+                      },
+                      "intermediary": {
+                        "type": "string"
+                      },
+                      "purpose": {
+                        "type": "array",
+                        "items": {
+                          "type": "object",
+                          "properties": {
+                            "lang": {
+                              "type": "string"
+                            },
+                            "content": {
+                              "type": "string"
+                            }
+                          },
+                          "required": [
+                            "lang",
+                            "content"
+                          ],
+                          "additionalProperties": false
+                        }
+                      },
+                      "credentials": {
+                        "type": "array",
+                        "items": {
+                          "type": "object",
+                          "propertyNames": {
+                            "type": "string"
+                          },
+                          "additionalProperties": {}
+                        }
+                      },
+                      "provides_attestations": {
+                        "type": "array",
+                        "items": {
+                          "type": "string",
+                          "minLength": 1
+                        }
+                      }
+                    },
+                    "additionalProperties": false
+                  },
+                  "jwt": {
+                    "type": "string"
+                  }
+                },
+                "additionalProperties": false
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "registrationCertImportJwt": {
+            "description": "Optional imported registration certificate JWT.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "registrationCertImportId": {
+            "description": "Optional registrar-side registration certificate id.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "registrationCertBodyPrivacyPolicy": {
+            "description": "Optional registration certificate privacy policy URI.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "registrationCertBodySupportUri": {
+            "description": "Optional registration certificate support URI.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "registrationCertBodyIntermediary": {
+            "description": "Optional registration certificate intermediary.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "registrationCertBodyPurpose": {
+            "description": "Optional registration certificate purpose entries.",
+            "anyOf": [
+              {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "lang": {
+                      "type": "string"
+                    },
+                    "content": {
+                      "type": "string"
+                    }
+                  },
+                  "additionalProperties": false
+                }
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "webhookEndpointId": {
+            "description": "Optional webhook endpoint id for presentation callbacks.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "attached": {
+            "description": "Optional attachments included with presentation requests.",
+            "anyOf": [
+              {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "format": {
+                      "type": "string",
+                      "description": "Attachment format identifier."
+                    },
+                    "data": {
+                      "description": "Attachment payload."
+                    },
+                    "credential_ids": {
+                      "description": "Optional credential query ids bound to this attachment.",
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      }
+                    }
+                  },
+                  "required": [
+                    "format",
+                    "data"
+                  ],
+                  "additionalProperties": false
+                }
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "redirectUri": {
+            "description": "Optional redirect URI after presentation completion.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "accessKeyChainId": {
+            "description": "Optional key chain id for access token/auth operations.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "readerAuth": {
+            "description": "Whether reader authentication is required for mDoc requests.",
+            "type": [
+              "boolean",
+              "null"
+            ]
+          }
+        },
+        "required": [
+          "id",
+          "dcql_query"
+        ],
+        "additionalProperties": false,
+        "title": "PresentationConfigCreateDto"
+      }
+    }
+  }
+];
+
+// ../../packages/eudiplo-config-format/dist/config-validator.js
+var ajv = new import__.Ajv2020({
+  allErrors: true,
+  strict: false,
+  validateFormats: false
+});
+for (const schema of CONFIG_SCHEMAS)
+  ajv.addSchema(schema);
+function validateConfigDocument(document) {
+  const file = serializeDocument(document);
+  const validate = ajv.getSchema(file.$schema);
+  if (!validate)
+    throw new Error(`No bundled validator for ${file.$schema}`);
+  const issues = [];
+  if (!validate(file)) {
+    for (const issue of validate.errors ?? [])
+      issues.push({
+        severity: "error",
+        code: "CONFIG_SCHEMA_VALIDATION_FAILED",
+        path: issue.instancePath || "/",
+        message: issue.keyword === "additionalProperties" ? `Unknown property: ${String(issue.params.additionalProperty)}` : issue.message ?? "Invalid configuration",
+        resource: { kind: document.kind, id: resourceId(document) }
+      });
+  }
+  const id = document.kind === "Client" ? document.spec.clientId : document.spec.id;
+  if (id !== void 0 && id !== resourceId(document))
+    issues.push({
+      severity: "error",
+      code: "RESOURCE_ID_MISMATCH",
+      path: document.kind === "Client" ? "/spec/clientId" : "/spec/id",
+      message: "Resource identifier does not match metadata.id"
+    });
+  return issues;
+}
+
+// src/commands/config/portability/migrations.ts
+function upgradeDocument(input) {
+  const result = migrateDocument(input, validateConfigDocument);
+  return { ...result, document: serializeDocument(result.document) };
+}
+
+// src/commands/config/portability/upgrade.ts
+var codec = new ConfigBundleCodec();
+function parse3(text, path2) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new Error(`Invalid JSON in ${path2}`);
+  }
+}
+function upgradeJson(input, file, context) {
+  const bundle = Array.isArray(input?.documents);
+  if (bundle) assertConfigBundle(input);
+  const results = (bundle ? input.documents : [input]).map(
+    (document) => upgradeDocument(document)
+  );
+  let blocked = false;
+  for (const result of results) {
+    for (const issue of result.issues) {
+      context.stderr.write(
+        `${file}${issue.path}: ${issue.severity} ${issue.code}: ${issue.message}
+`
+      );
+      if (issue.severity !== "warning") blocked = true;
+    }
+    for (const migration of result.migrations)
+      context.stdout.write(`${file}: migration ${migration}
+`);
+  }
+  if (blocked) throw new Error(`${file}: upgrade blocked; no output written`);
+  if (!bundle) return results[0].document;
+  const documents = results.map(
+    (result) => result.document
+  );
+  const resources = input.manifest.resources.map(
+    (resource) => {
+      const index = input.documents.findIndex(
+        (candidate) => normalizeDocument(candidate).kind === resource.kind && resourceId(candidate) === resource.id
+      );
+      const document = documents[index];
+      return {
+        ...resource,
+        id: resourceId(document),
+        $schema: document.$schema,
+        sha256: createHash2("sha256").update(JSON.stringify(document)).digest("hex")
+      };
+    }
+  );
+  const output = {
+    ...input,
+    manifest: { ...input.manifest, formatVersion: 2, resources },
+    documents
+  };
+  assertConfigBundle(output);
+  return output;
+}
+function report(input, output, file, parsed, context) {
+  const changed = stableConfigJson(input) !== stableConfigJson(output);
+  context.stdout.write(
+    `${file}: ${changed ? "upgrade required" : "current"}
+`
+  );
+  if (parsed.flags.diff === true)
+    for (const change of configChanges(input, output)) {
+      context.stdout.write(
+        `  ${change.path}: ${JSON.stringify(change.before) ?? "(absent)"} -> ${JSON.stringify(change.after) ?? "(absent)"}
+`
+      );
+    }
+  return changed;
+}
+function inferredKind(path2) {
+  const normalized = path2.split(sep2).join("/");
+  const match = TENANT_RESOURCE_REGISTRY.find(
+    (entry) => entry.kind === "file" ? normalized === entry.file || normalized.endsWith(`/${entry.file}`) : normalized.endsWith(`/${entry.subfolder}/${basename2(path2)}`) || normalized === `${entry.subfolder}/${basename2(path2)}`
+  );
+  return CONFIG_RESOURCE_KINDS.find(
+    (kind) => `${CONFIG_FORMATS[kind].file}.schema.json` === match?.schemaFile
+  );
+}
+function wrapBare(kind, input, path2) {
+  if (!input || typeof input !== "object" || Array.isArray(input))
+    throw new Error(`${path2}: configuration must be an object`);
+  const singleton = {
+    Tenant: "tenant",
+    KmsConfig: "kms",
+    RegistrarConfig: "registrar",
+    IssuanceConfig: "issuance"
+  };
+  const spec = structuredClone(input);
+  if (kind === "KeyChain" && spec.key && !spec.keySource) {
+    spec.keySource = { type: "private-jwk", jwk: spec.key };
+    delete spec.key;
+  }
+  const id = String(
+    singleton[kind] ?? spec.id ?? spec.clientId ?? basename2(path2, ".json")
+  );
+  if (!singleton[kind]) spec[kind === "Client" ? "clientId" : "id"] = id;
+  return { $schema: schemaUrl(kind, 1), metadata: { generation: 1 }, spec };
+}
+async function folderFiles(path2) {
+  const files = [];
+  for (const entry of await readdir(path2, { withFileTypes: true })) {
+    if (entry.name.startsWith(".")) continue;
+    const file = join4(path2, entry.name);
+    if (entry.isSymbolicLink())
+      throw new Error(`Config folder contains a symbolic link: ${file}`);
+    if (entry.isDirectory()) files.push(...await folderFiles(file));
+    else if (entry.isFile()) files.push(file);
+  }
+  return files.sort();
+}
+async function upgradeFolder(source, parsed, context) {
+  const outputs = /* @__PURE__ */ new Map();
+  let changed = 0;
+  for (const file of await folderFiles(source)) {
+    if (extname(file) !== ".json" || relative2(source, file).split(sep2).includes("images"))
+      continue;
+    const input = parse3(await readFile4(file, "utf8"), file);
+    const kind = inferredKind(relative2(source, file));
+    if (!kind && !isConfigDocument(input)) continue;
+    const candidate = isConfigDocument(input) ? input : wrapBare(kind, input, file);
+    const output = upgradeJson(candidate, file, context);
+    if (kind && normalizeDocument(output).kind !== kind)
+      throw new Error(`${file}: expected ${kind} configuration`);
+    if (report(input, output, relative2(source, file), parsed, context))
+      changed++;
+    outputs.set(
+      relative2(source, file),
+      `${JSON.stringify(output, null, 2)}
+`
+    );
+  }
+  if (!outputs.size)
+    throw new Error(`No configuration documents found in ${source}`);
+  context.stdout.write(
+    `${outputs.size - changed} current, ${changed} require upgrading
+`
+  );
+  if (parsed.flags.check === true) return changed ? 1 : 0;
+  if (parsed.flags["dry-run"] === true) return 0;
+  const destination = resolve3(
+    context.cwd,
+    readStringFlag(parsed.flags, "output") ?? `${source}.upgraded`
+  );
+  const overlap = (parent, child) => {
+    const path2 = relative2(parent, child);
+    return path2 === "" || !path2.startsWith(`..${sep2}`) && path2 !== "..";
+  };
+  if (overlap(source, destination) || overlap(destination, source))
+    throw new Error(
+      "Folder output must be separate from the source directory"
+    );
+  await lstat(destination).then(
+    () => {
+      throw new Error(`Output already exists: ${destination}`);
+    },
+    (error) => {
+      if (error.code !== "ENOENT") throw error;
+    }
+  );
+  await mkdir3(dirname3(destination), { recursive: true });
+  const staging = await mkdtemp(
+    join4(dirname3(destination), ".eudiplo-upgrade-")
+  );
+  try {
     await cp(source, staging, {
       recursive: true,
       filter: (path2) => path2 === source || !relative2(source, path2).split(sep2).some((part) => part.startsWith("."))
@@ -20592,17 +22052,17 @@ function storageEnv(storage) {
   if (storage === "local") {
     return ["STORAGE_DRIVER=local", "LOCAL_STORAGE_DIR=/app/uploads"];
   }
-  const minioPassword = randomSecret();
+  const rustfsPassword = randomSecret();
   return [
     "STORAGE_DRIVER=s3",
-    "S3_ENDPOINT=http://minio:9000",
+    "S3_ENDPOINT=http://rustfs:9000",
     "S3_REGION=us-east-1",
-    "S3_ACCESS_KEY_ID=minioadmin",
-    `S3_SECRET_ACCESS_KEY=${minioPassword}`,
+    "S3_ACCESS_KEY_ID=rustfsadmin",
+    `S3_SECRET_ACCESS_KEY=${rustfsPassword}`,
     "S3_BUCKET=uploads",
     "S3_FORCE_PATH_STYLE=true",
-    "MINIO_ROOT_USER=minioadmin",
-    `MINIO_ROOT_PASSWORD=${minioPassword}`
+    "RUSTFS_ACCESS_KEY=rustfsadmin",
+    `RUSTFS_SECRET_KEY=${rustfsPassword}`
   ];
 }
 function kmsEnv(kms) {
@@ -20755,10 +22215,10 @@ function formatTextReport(scope, rootPath, results) {
 function formatTenantBlock(result) {
   const lines = [`${result.valid ? "PASS" : "FAIL"} ${result.id}`];
   if (result.valid) {
-    for (const [resourceType, count] of Object.entries(
+    for (const [resourceType, count2] of Object.entries(
       result.resourceCounts
     )) {
-      lines.push(`  ${count} ${pluralize(resourceType, count)}`);
+      lines.push(`  ${count2} ${pluralize(resourceType, count2)}`);
     }
   } else {
     lines.push(...formatTenantErrors(result.errors));
@@ -20804,8 +22264,8 @@ function groupErrorsByFile(errors) {
   }
   return Array.from(grouped.entries());
 }
-function pluralize(label, count) {
-  return count === 1 ? label : `${label}s`;
+function pluralize(label, count2) {
+  return count2 === 1 ? label : `${label}s`;
 }
 
 // src/commands/config/validate/validator.ts
@@ -21550,8 +23010,169 @@ function createConfigCommand(context, setExitCode) {
 
 // src/services/deployment-drivers.ts
 import { access as access2, mkdir as mkdir6, rm as rm4, stat as stat2, unlink as unlink2, writeFile as writeFile5 } from "node:fs/promises";
-import { delimiter, join as join10, resolve as resolve5 } from "node:path";
+import { delimiter, join as join10, resolve as resolve6 } from "node:path";
 import { spawn } from "node:child_process";
+
+// src/services/compose-args.ts
+import { resolve as resolve5 } from "node:path";
+var SERVICE_NAME = /^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/;
+var DURATION = /^(\d+(\.\d+)?(ns|us|µs|ms|s|m|h))+$/;
+var TIMESTAMP = /^\d{4}-\d{2}-\d{2}(T\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[+-]\d{2}:\d{2})?)?$/;
+function assertServiceName(service) {
+  if (!SERVICE_NAME.test(service)) {
+    throw new Error(
+      `Invalid service name ${JSON.stringify(service)}. Service names start with a letter or digit and contain only letters, digits, ".", "_" and "-".`
+    );
+  }
+}
+function assertSince(since) {
+  const isDuration = DURATION.test(since);
+  const isTimestamp = TIMESTAMP.test(since) && !Number.isNaN(Date.parse(since));
+  if (!isDuration && !isTimestamp) {
+    throw new Error(
+      `Invalid --since value ${JSON.stringify(since)}. Use a duration such as 10m or 2h30m, or a timestamp such as 2026-09-01T12:00:00Z.`
+    );
+  }
+}
+function assertTail(tail) {
+  if (!Number.isInteger(tail) || tail < 0) {
+    throw new Error("--tail must be a whole number of lines, 0 or more.");
+  }
+}
+function buildComposeBaseArgs(instance, projectDirectory, composeFiles) {
+  const args = ["compose"];
+  if (instance.envFile) {
+    args.push("--env-file", resolve5(projectDirectory, instance.envFile));
+  }
+  for (const composeFile of composeFiles) {
+    args.push("-f", resolve5(projectDirectory, composeFile));
+  }
+  for (const profile of instance.composeProfiles ?? []) {
+    args.push("--profile", profile);
+  }
+  if (instance.projectName) {
+    args.push("--project-name", instance.projectName);
+  }
+  return args;
+}
+function buildComposePsArgs() {
+  return ["ps"];
+}
+function buildComposeListServicesArgs() {
+  return ["config", "--services"];
+}
+function buildComposeLogsArgs(service, options = {}) {
+  const args = ["logs"];
+  if (options.follow === true) {
+    args.push("--follow");
+  }
+  if (options.tail !== void 0) {
+    assertTail(options.tail);
+    args.push("--tail", String(options.tail));
+  }
+  if (options.since !== void 0) {
+    assertSince(options.since);
+    args.push("--since", options.since);
+  }
+  if (service !== void 0) {
+    assertServiceName(service);
+    args.push(service);
+  }
+  return args;
+}
+function buildComposePullArgs(service) {
+  const args = ["pull"];
+  if (service !== void 0) {
+    assertServiceName(service);
+    args.push(service);
+  }
+  return args;
+}
+function buildComposeUpArgs() {
+  return ["up", "-d"];
+}
+function buildComposeRestartArgs(service) {
+  const args = ["restart"];
+  if (service !== void 0) {
+    assertServiceName(service);
+    args.push(service);
+  }
+  return args;
+}
+function parseServiceList(stdout) {
+  return stdout.split(/\r?\n/).map((line) => line.trim()).filter((line) => SERVICE_NAME.test(line)).sort();
+}
+function assertKnownService(service, known) {
+  if (!known.includes(service)) {
+    throw new Error(
+      `Unknown service ${service}. Services in this project: ${known.join(", ") || "none"}.`
+    );
+  }
+}
+
+// src/services/container-state.ts
+function parseContainerStates(stdout) {
+  const trimmed = stdout.trim();
+  if (!trimmed) {
+    return [];
+  }
+  const entries = trimmed.startsWith("[") ? asArray(JSON.parse(trimmed)) : trimmed.split("\n").map((line) => line.trim()).filter((line) => line.startsWith("{")).map((line) => JSON.parse(line));
+  return entries.map((entry) => {
+    const record = entry;
+    const names = record.Names;
+    return {
+      name: Array.isArray(names) ? String(names[0] ?? "") : String(names ?? record.Name ?? ""),
+      state: String(record.State ?? ""),
+      status: String(record.Status ?? "")
+    };
+  });
+}
+function summarizeContainerStates(containers, projectName) {
+  const name = "service containers";
+  if (containers.length === 0) {
+    return {
+      name,
+      status: "warn",
+      message: `No containers found for project ${projectName}. Start it with eudiplo up.`
+    };
+  }
+  const unhealthy = containers.filter(
+    (container) => container.status.toLowerCase().includes("unhealthy")
+  );
+  if (unhealthy.length > 0) {
+    return {
+      name,
+      status: "fail",
+      message: `Unhealthy: ${describe(unhealthy)}`
+    };
+  }
+  const notRunning = containers.filter(
+    (container) => container.state.toLowerCase() !== "running"
+  );
+  if (notRunning.length > 0) {
+    return {
+      name,
+      status: "warn",
+      message: `${containers.length - notRunning.length}/${containers.length} running. Not running: ${describe(notRunning)}`
+    };
+  }
+  const starting = containers.filter(
+    (container) => container.status.toLowerCase().includes("starting")
+  ).length;
+  return {
+    name,
+    status: "pass",
+    message: `${containers.length} container(s) running${starting > 0 ? `, ${starting} still starting` : ""}.`
+  };
+}
+function asArray(value) {
+  return Array.isArray(value) ? value : [];
+}
+function describe(containers) {
+  return containers.map((container) => `${container.name} (${container.status})`).join(", ");
+}
+
+// src/services/deployment-drivers.ts
 var drivers = {
   compose: {
     target: "compose",
@@ -21564,10 +23185,16 @@ var drivers = {
         status: runtime ? "pass" : "warn",
         message: runtime ? `${runtime.name} found at ${runtime.command}` : "Docker or Podman was not found in a supported install location."
       });
+      if (runtime) {
+        checks.push(await composeProviderCheck(runtime, context));
+        checks.push(
+          await composeServicesCheck(runtime, instance, context)
+        );
+      }
       for (const composeFile of getComposeFiles(instance)) {
         let found = true;
         try {
-          await access2(resolve5(projectDirectory, composeFile));
+          await access2(resolve6(projectDirectory, composeFile));
         } catch {
           found = false;
         }
@@ -21585,8 +23212,41 @@ var drivers = {
     down(options) {
       return runCompose(["down", ...options.args], options);
     },
-    logs(options) {
-      return runCompose(["logs", "-f", ...options.args], options);
+    async logs(options) {
+      const service = await resolveComposeService(options);
+      const { follow, tail } = readLogOptions(options.flags);
+      const since = typeof options.flags.since === "string" ? options.flags.since : void 0;
+      return runCompose(
+        [
+          ...buildComposeLogsArgs(service, { follow, tail, since }),
+          ...options.args
+        ],
+        options
+      );
+    },
+    async ps(options) {
+      return runCompose(
+        [...buildComposePsArgs(), ...options.args],
+        options
+      );
+    },
+    async pull(options) {
+      const service = await resolveComposeService(options);
+      return runCompose(
+        [...buildComposePullArgs(service), ...options.args],
+        options
+      );
+    },
+    async restart(options) {
+      assertWritable(options);
+      const service = await resolveComposeService(options);
+      const restartArgs = buildComposeRestartArgs(service);
+      const runtime = await resolveComposeRuntime(options.context.env);
+      options.context.stdout.write(
+        `Restarting ${service ?? "all services"} of ${options.instanceName}${runtime ? ` with ${runtime.name} compose` : ""}
+`
+      );
+      return runCompose([...restartArgs, ...options.args], options);
     }
   },
   external: {
@@ -21606,7 +23266,11 @@ var drivers = {
       );
       return runKubectl(
         [
-          ...buildLogsArgs(scope, workload, readLogOptions(options.flags)),
+          ...buildLogsArgs(
+            scope,
+            workload,
+            readLogOptions(options.flags)
+          ),
           ...options.args
         ],
         options
@@ -21634,14 +23298,17 @@ var drivers = {
         [...buildRestartArgs(scope, workload), ...options.args],
         options
       );
-      if (restarted !== 0 || options.flags.wait === false) {
+      if (restarted !== 0 || options.flags["no-wait"] === true) {
         return restarted;
       }
       return runKubectl(buildRolloutStatusArgs(scope, workload), options);
     }
   }
 };
-function assertWritable({ instance, instanceName }) {
+function assertWritable({
+  instance,
+  instanceName
+}) {
   if (instance.readOnly === true) {
     throw new Error(
       `Instance ${instanceName} is registered read-only. Re-register it without --read-only to allow changes.`
@@ -21847,7 +23514,10 @@ function unreadyEndpoints(stdout) {
       (endpoint) => isRecord3(endpoint) && // An omitted ready condition means ready, per the API contract.
       (!isRecord3(endpoint.conditions) || endpoint.conditions.ready !== false)
     );
-    readyByService.set(service, (readyByService.get(service) ?? false) || ready);
+    readyByService.set(
+      service,
+      (readyByService.get(service) ?? false) || ready
+    );
   }
   return [...readyByService.entries()].filter(([, ready]) => !ready).map(([service]) => service).sort();
 }
@@ -21975,7 +23645,7 @@ async function ensureComposeProject(cwd, options) {
     composeProfiles: composeProfiles(options),
     envFile: envFileName,
     projectName: mode === "demo" ? "eudiplo-demo" : "eudiplo",
-    projectDirectory: resolve5(cwd)
+    projectDirectory: resolve6(cwd)
   };
 }
 async function ensureProjectDirectory(directory) {
@@ -22029,23 +23699,14 @@ function unsupportedCommand(command, target) {
 }
 async function runCompose(args, { instance, context }) {
   const projectDirectory = instance.projectDirectory ?? context.cwd;
-  const composeArgs = ["compose"];
-  if (instance.envFile) {
-    composeArgs.push(
-      "--env-file",
-      resolve5(projectDirectory, instance.envFile)
-    );
-  }
-  for (const composeFile of getComposeFiles(instance)) {
-    composeArgs.push("-f", resolve5(projectDirectory, composeFile));
-  }
-  for (const profile of instance.composeProfiles ?? []) {
-    composeArgs.push("--profile", profile);
-  }
-  if (instance.projectName) {
-    composeArgs.push("--project-name", instance.projectName);
-  }
-  composeArgs.push(...args);
+  const composeArgs = [
+    ...buildComposeBaseArgs(
+      instance,
+      projectDirectory,
+      getComposeFiles(instance)
+    ),
+    ...args
+  ];
   const composeRuntime = await resolveComposeRuntime(context.env);
   if (!composeRuntime) {
     context.stderr.write(
@@ -22054,17 +23715,158 @@ async function runCompose(args, { instance, context }) {
     return 1;
   }
   return new Promise((resolveProcess) => {
-    const child = spawn(composeRuntime.command, composeArgs, {
-      cwd: projectDirectory,
+    const child = spawn(composeRuntime.command, composeArgs, {
+      cwd: projectDirectory,
+      env: context.env,
+      stdio: "inherit"
+    });
+    child.on("error", (error) => {
+      context.stderr.write(`${error.message}
+`);
+      resolveProcess(1);
+    });
+    child.on("close", (code) => resolveProcess(code ?? 1));
+  });
+}
+async function captureCompose(args, { instance, context }) {
+  const projectDirectory = instance.projectDirectory ?? context.cwd;
+  const composeRuntime = await resolveComposeRuntime(context.env);
+  if (!composeRuntime) {
+    throw new Error(
+      "Docker or Podman was not found in a supported install location."
+    );
+  }
+  const composeArgs = [
+    ...buildComposeBaseArgs(
+      instance,
+      projectDirectory,
+      getComposeFiles(instance)
+    ),
+    ...args
+  ];
+  return new Promise((resolveProcess) => {
+    const child = spawn(composeRuntime.command, composeArgs, {
+      cwd: projectDirectory,
+      env: context.env,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout?.on("data", (chunk) => {
+      stdout += String(chunk);
+    });
+    child.stderr?.on("data", (chunk) => {
+      stderr += String(chunk);
+    });
+    child.on(
+      "error",
+      (error) => resolveProcess({ code: 1, stdout, stderr: error.message })
+    );
+    child.on(
+      "close",
+      (code) => resolveProcess({ code: code ?? 1, stdout, stderr })
+    );
+  });
+}
+async function resolveComposeService(options) {
+  const service = readServiceFlag(options.flags);
+  if (service === void 0) {
+    return void 0;
+  }
+  assertServiceName(service);
+  const listed = await captureCompose(
+    buildComposeListServicesArgs(),
+    options
+  );
+  if (listed.code !== 0) {
+    throw new Error(
+      `Could not list Compose services: ${listed.stderr.trim() || `exit code ${listed.code}`}`
+    );
+  }
+  assertKnownService(service, parseServiceList(listed.stdout));
+  return service;
+}
+async function composeProviderCheck(runtime, context) {
+  const version = await captureRuntime(
+    runtime.command,
+    ["compose", "version"],
+    context
+  );
+  if (version.code !== 0) {
+    return {
+      name: "compose provider",
+      status: "fail",
+      message: `${runtime.name} compose is not usable: ${firstLine(version.stderr) || `exit code ${version.code}`}`
+    };
+  }
+  return {
+    name: "compose provider",
+    status: "pass",
+    message: firstLine(version.stdout) || `${runtime.name} compose works`
+  };
+}
+async function composeServicesCheck(runtime, instance, context) {
+  if (!instance.projectName) {
+    return {
+      name: "service containers",
+      status: "skip",
+      message: "This instance has no Compose project name, so its containers cannot be identified."
+    };
+  }
+  const listed = await captureRuntime(
+    runtime.command,
+    [
+      "ps",
+      "--all",
+      "--filter",
+      `label=com.docker.compose.project=${instance.projectName}`,
+      "--format",
+      "json"
+    ],
+    context
+  );
+  if (listed.code !== 0) {
+    return {
+      name: "service containers",
+      status: "warn",
+      message: `Containers could not be listed: ${firstLine(listed.stderr) || `exit code ${listed.code}`}`
+    };
+  }
+  try {
+    return summarizeContainerStates(
+      parseContainerStates(listed.stdout),
+      instance.projectName
+    );
+  } catch {
+    return {
+      name: "service containers",
+      status: "warn",
+      message: `The container list returned by ${runtime.name} could not be read.`
+    };
+  }
+}
+function captureRuntime(command, args, context) {
+  return new Promise((resolveProcess) => {
+    const child = spawn(command, args, {
       env: context.env,
-      stdio: "inherit"
+      stdio: ["ignore", "pipe", "pipe"]
     });
-    child.on("error", (error) => {
-      context.stderr.write(`${error.message}
-`);
-      resolveProcess(1);
+    let stdout = "";
+    let stderr = "";
+    child.stdout?.on("data", (chunk) => {
+      stdout += String(chunk);
     });
-    child.on("close", (code) => resolveProcess(code ?? 1));
+    child.stderr?.on("data", (chunk) => {
+      stderr += String(chunk);
+    });
+    child.on(
+      "error",
+      (error) => resolveProcess({ code: 1, stdout, stderr: error.message })
+    );
+    child.on(
+      "close",
+      (code) => resolveProcess({ code: code ?? 1, stdout, stderr })
+    );
   });
 }
 async function resolveComposeRuntime(env) {
@@ -22164,7 +23966,7 @@ async function removeIfExists(path2) {
 }
 
 // src/services/project-directory.ts
-import { resolve as resolve6 } from "node:path";
+import { resolve as resolve7 } from "node:path";
 function resolveProjectDirectory(parsed, context, promptedDirectory) {
   const positionalDirectory = parsed.subject;
   const flagDirectory = readStringFlag(parsed.flags, "directory");
@@ -22176,7 +23978,7 @@ function resolveProjectDirectory(parsed, context, promptedDirectory) {
       "Specify the project directory either positionally or with --directory."
     );
   }
-  return resolve6(
+  return resolve7(
     context.cwd,
     positionalDirectory ?? flagDirectory ?? promptedDirectory ?? "."
   );
@@ -22197,209 +23999,697 @@ async function runDemo(configPath, config, parsed, context) {
   } finally {
     prompter.close();
   }
-  const force = parsed.flags.force === true;
-  const reset = parsed.flags.reset === true;
-  const imageTagOverride = readStringFlag(parsed.flags, "image-tag") ?? context.env.EUDIPLO_IMAGE_TAG;
-  if (reset && !force) {
-    throw new Error(
-      "demo --reset requires --force to remove managed demo data."
-    );
+  const force = parsed.flags.force === true;
+  const reset = parsed.flags.reset === true;
+  const imageTagOverride = readStringFlag(parsed.flags, "image-tag") ?? context.env.EUDIPLO_IMAGE_TAG;
+  if (reset && !force) {
+    throw new Error(
+      "demo --reset requires --force to remove managed demo data."
+    );
+  }
+  if (reset && await demoProjectExists(projectDirectory)) {
+    context.stdout.write(
+      "Resetting demo deployment and removing managed demo volumes...\n"
+    );
+    await drivers.compose.down?.({
+      instanceName: "local",
+      instance: {
+        target: "compose",
+        url: "http://localhost:3000",
+        clientUrl: "http://localhost:4200",
+        composeFiles: ["eudiplo.demo.compose.yaml"],
+        envFile: ".eudiplo.demo.env",
+        projectName: "eudiplo-demo",
+        projectDirectory
+      },
+      args: ["--volumes", "--remove-orphans"],
+      flags: {},
+      context
+    });
+  }
+  const instance = await ensureComposeProject(projectDirectory, {
+    mode: "demo",
+    force,
+    reset,
+    imageTagOverride
+  });
+  const nextConfig = upsertInstance(config, "local", instance);
+  await saveConfig(configPath, nextConfig);
+  context.stdout.write("Starting EUDIPLO demo with the Compose runtime...\n");
+  const exitCode2 = await drivers.compose.up?.({
+    instanceName: "local",
+    instance,
+    args: [],
+    flags: {},
+    context
+  }) ?? 1;
+  if (exitCode2 === 0) {
+    context.stdout.write("\nDemo mode - not for production.\n");
+    context.stdout.write("API URL: http://localhost:3000\n");
+    context.stdout.write("Client URL: http://localhost:4200\n");
+    context.stdout.write("Demo credentials:\n");
+    context.stdout.write("  Client ID: root\n");
+    context.stdout.write("  Client Secret: root\n");
+    context.stdout.write(
+      `Editable demo config: ${projectDirectory}/config/demo
+`
+    );
+  }
+  return exitCode2;
+}
+
+// src/commands/demo/index.ts
+function createDemoCommand(context, setExitCode) {
+  return new Command("demo").description("Start the minimal local demo").argument("[directory]", "project directory").option("--directory <path>", "set the project directory").option("--reset", "recreate managed demo data and configuration").option("--force", "allow replacement of managed demo files").option("--yes", "accept the default directory without prompting").option("--no-interactive", "disable the directory prompt").option(
+    "--image-tag <tag>",
+    "override the backend and client image tag"
+  ).action(async (directory, options) => {
+    const { configPath, config } = await loadCliState(context);
+    setExitCode(
+      await runDemo(
+        configPath,
+        config,
+        parsedArgs("demo", directory, [], options),
+        context
+      )
+    );
+  });
+}
+
+// src/commands/deployment/action.ts
+async function runDriverCommand(config, command, parsed, context) {
+  const [instanceName, instance] = resolveInstance(config, parsed);
+  const driver = drivers[instance.target];
+  const handler = driver[command];
+  if (!handler) {
+    throw new Error(unsupportedCommand(command, instance.target));
+  }
+  if (instance.target === "compose") {
+    const clientMode = instance.clientUrl ? "client enabled" : "client disabled";
+    context.stdout.write(`${command} ${instanceName} (${clientMode})
+`);
+  }
+  return handler({
+    instanceName,
+    instance,
+    args: parsed.positionals,
+    flags: parsed.flags,
+    context
+  });
+}
+
+// src/commands/deployment/index.ts
+var descriptions = {
+  up: "Start the selected Compose deployment",
+  down: "Stop the selected Compose deployment",
+  logs: "Stream logs for the selected deployment",
+  ps: "List the running containers or pods for the selected deployment",
+  restart: "Restart the workloads of the selected deployment",
+  pull: "Download the configured images without changing configuration"
+};
+var serviceScoped = /* @__PURE__ */ new Set([
+  "logs",
+  "restart",
+  "pull"
+]);
+function createDeploymentCommands(context, setExitCode) {
+  return ["up", "down", "logs", "ps", "restart", "pull"].map(
+    (name) => {
+      const command = new Command(name).description(descriptions[name]).argument(
+        "[args...]",
+        "additional arguments passed to the deployment runtime"
+      ).option("--instance <name>", "select a configured instance");
+      if (serviceScoped.has(name)) {
+        command.option(
+          "--service <name>",
+          "select a single service (Compose) or configured workload (Kubernetes)"
+        );
+      }
+      if (name === "logs") {
+        command.option("--follow", "stream new output as it arrives").option("--tail <lines>", "number of recent lines to show").option(
+          "--since <time>",
+          "show logs since a duration (10m, 2h) or timestamp (Compose instances)"
+        );
+      }
+      if (name === "restart") {
+        command.option(
+          "--no-wait",
+          "return without waiting for the rollout to finish (Kubernetes instances)"
+        );
+      }
+      return command.action(async (args, options) => {
+        const { config } = await loadCliState(context);
+        setExitCode(
+          await runDriverCommand(
+            config,
+            name,
+            parsedArgs(name, void 0, args, options),
+            context
+          )
+        );
+      });
+    }
+  );
+}
+
+// package.json
+var package_default = {
+  name: "@eudiplo/cli",
+  version: "8.1.0-main.545119e",
+  description: "Deployment-aware command line tools for EUDIPLO",
+  private: false,
+  type: "module",
+  bin: {
+    eudiplo: "dist/index.js"
+  },
+  files: [
+    "dist",
+    "templates",
+    "README.md"
+  ],
+  scripts: {
+    "assets:sync": "node scripts/sync-cli-assets.cjs",
+    "assets:check": "node scripts/check-cli-assets.cjs",
+    build: "pnpm assets:sync && pnpm assets:check && tsc -p tsconfig.json",
+    "build:publish": "pnpm build && esbuild src/index.ts --bundle --platform=node --format=esm --target=node22.12 --alias:jsonc-parser=jsonc-parser/lib/esm/main.js --outfile=dist/index.js",
+    "build:sea:bundle": "pnpm assets:sync && pnpm assets:check && esbuild src/index.ts --bundle --platform=node --format=esm --target=node22.12 --alias:jsonc-parser=jsonc-parser/lib/esm/main.js --outfile=dist-sea/index.js",
+    "build:sea": "node scripts/build-cli-sea.mjs",
+    dev: "tsx src/index.ts",
+    test: "vitest run --root ../.. --project cli",
+    lint: "biome lint .",
+    prepublishOnly: "pnpm build:publish"
+  },
+  keywords: [
+    "eudiplo",
+    "cli",
+    "eudi",
+    "wallet",
+    "oid4vci",
+    "oid4vp"
+  ],
+  repository: {
+    type: "git",
+    url: "git+https://github.com/openwallet-foundation/eudiplo.git",
+    directory: "apps/cli"
+  },
+  homepage: "https://github.com/openwallet-foundation/eudiplo/tree/main/apps/cli#readme",
+  bugs: {
+    url: "https://github.com/openwallet-foundation/eudiplo/issues"
+  },
+  author: "OpenWallet Foundation",
+  license: "Apache-2.0",
+  engines: {
+    node: ">=22.12.0"
+  },
+  publishConfig: {
+    access: "public"
+  },
+  dependencies: {
+    "@eudiplo/config-format": "workspace:*",
+    ajv: "^8.20.0",
+    "ajv-formats": "^3.0.1",
+    commander: "^15.0.0",
+    fflate: "^0.8.3",
+    "jsonc-parser": "^3.3.1"
+  },
+  devDependencies: {
+    "@biomejs/biome": "2.5.14",
+    "@types/node": "^26.4.0",
+    esbuild: "^0.28.2",
+    tsx: "^4.23.13",
+    typescript: "^7.0.2",
+    vitest: "5.0.2"
+  }
+};
+
+// src/services/api-auth.ts
+async function requestAccessToken(baseUrl, context) {
+  const clientId = context.env.EUDIPLO_CLIENT_ID;
+  const clientSecret = context.env.EUDIPLO_CLIENT_SECRET;
+  if (!clientId || !clientSecret) {
+    return {
+      kind: "unavailable",
+      reason: "EUDIPLO_CLIENT_ID and EUDIPLO_CLIENT_SECRET are not set"
+    };
+  }
+  const tokenUrl = new URL("api/oauth2/token", withTrailingSlash(baseUrl));
+  try {
+    const response = await context.fetch(tokenUrl, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: "client_credentials",
+        client_id: clientId,
+        client_secret: clientSecret
+      }).toString()
+    });
+    if (!response.ok) {
+      return {
+        kind: "error",
+        reason: `the token endpoint returned HTTP ${response.status}`
+      };
+    }
+    const payload = await response.json();
+    const accessToken = typeof payload === "object" && payload !== null && "access_token" in payload ? String(payload.access_token) : "";
+    if (!accessToken) {
+      return {
+        kind: "error",
+        reason: "the token response did not contain an access token"
+      };
+    }
+    return { kind: "token", accessToken };
+  } catch (error) {
+    return {
+      kind: "error",
+      reason: `the token endpoint could not be reached: ${error instanceof Error ? error.message : String(error)}`
+    };
+  }
+}
+async function fetchAuthenticated(url, accessToken, context) {
+  try {
+    const response = await context.fetch(url, {
+      method: "GET",
+      headers: { authorization: `Bearer ${accessToken}` }
+    });
+    if (!response.ok) {
+      return {
+        ok: false,
+        status: response.status,
+        reason: `${url.pathname} returned HTTP ${response.status}`
+      };
+    }
+    return { ok: true, body: await response.json() };
+  } catch (error) {
+    return {
+      ok: false,
+      reason: `${url.pathname} could not be reached: ${error instanceof Error ? error.message : String(error)}`
+    };
+  }
+}
+function withTrailingSlash(url) {
+  return url.href.endsWith("/") ? url : new URL(`${url.href}/`);
+}
+
+// src/services/backend-checks.ts
+function compareVersions(cliVersion, backendVersion) {
+  const name = "version compatibility";
+  const cli = parse4(cliVersion);
+  const backend = parse4(backendVersion);
+  if (!cli || !backend) {
+    return {
+      name,
+      status: "warn",
+      message: `CLI ${cliVersion} and backend ${backendVersion} cannot be compared as versions.`
+    };
+  }
+  if (cli.major !== backend.major) {
+    return {
+      name,
+      status: "fail",
+      message: `CLI ${cliVersion} and backend ${backendVersion} are different major versions. Install a matching CLI with npm install -g @eudiplo/cli@${backend.major}.`
+    };
+  }
+  if (cli.minor !== backend.minor) {
+    return {
+      name,
+      status: "warn",
+      message: `CLI ${cliVersion} and backend ${backendVersion} differ in minor version; some commands may not be supported.`
+    };
   }
-  if (reset && await demoProjectExists(projectDirectory)) {
-    context.stdout.write(
-      "Resetting demo deployment and removing managed demo volumes...\n"
-    );
-    await drivers.compose.down?.({
-      instanceName: "local",
-      instance: {
-        target: "compose",
-        url: "http://localhost:3000",
-        clientUrl: "http://localhost:4200",
-        composeFiles: ["eudiplo.demo.compose.yaml"],
-        envFile: ".eudiplo.demo.env",
-        projectName: "eudiplo-demo",
-        projectDirectory
-      },
-      args: ["--volumes", "--remove-orphans"],
-      flags: {},
-      context
-    });
+  return {
+    name,
+    status: "pass",
+    message: `CLI ${cliVersion} matches backend ${backendVersion}.`
+  };
+}
+function readBackendVersion(body) {
+  if (typeof body === "object" && body !== null && "version" in body) {
+    const version = body.version;
+    return typeof version === "string" && version ? version : void 0;
   }
-  const instance = await ensureComposeProject(projectDirectory, {
-    mode: "demo",
-    force,
-    reset,
-    imageTagOverride
+  return void 0;
+}
+function readProviderHealth(body) {
+  if (!Array.isArray(body)) {
+    throw new Error("the provider health response was not a list");
+  }
+  return body.map((entry) => {
+    const record = entry;
+    return {
+      providerId: String(record.providerId ?? "unknown"),
+      type: String(record.type ?? "unknown"),
+      ok: record.ok === true,
+      latencyMs: typeof record.latencyMs === "number" ? record.latencyMs : void 0,
+      error: typeof record.error === "string" ? record.error : void 0
+    };
   });
-  const nextConfig = upsertInstance(config, "local", instance);
-  await saveConfig(configPath, nextConfig);
-  context.stdout.write("Starting EUDIPLO demo with the Compose runtime...\n");
-  const exitCode2 = await drivers.compose.up?.({
-    instanceName: "local",
-    instance,
-    args: [],
-    flags: {},
-    context
-  }) ?? 1;
-  if (exitCode2 === 0) {
-    context.stdout.write("\nDemo mode - not for production.\n");
-    context.stdout.write("API URL: http://localhost:3000\n");
-    context.stdout.write("Client URL: http://localhost:4200\n");
-    context.stdout.write("Demo credentials:\n");
-    context.stdout.write("  Client ID: root\n");
-    context.stdout.write("  Client Secret: root\n");
-    context.stdout.write(
-      `Editable demo config: ${projectDirectory}/config/demo
-`
-    );
+}
+function summarizeProviderHealth(providers) {
+  const name = "KMS providers";
+  if (providers.length === 0) {
+    return {
+      name,
+      status: "warn",
+      message: "No KMS providers are registered for this tenant."
+    };
   }
-  return exitCode2;
+  const failing = providers.filter((provider) => !provider.ok);
+  if (failing.length > 0) {
+    return {
+      name,
+      status: "fail",
+      message: `${failing.length}/${providers.length} provider(s) unhealthy: ${failing.map(
+        (provider) => `${provider.providerId} (${provider.type})${provider.error ? ", health check reported an error" : ""}`
+      ).join(", ")}`
+    };
+  }
+  return {
+    name,
+    status: "pass",
+    message: `${providers.length} provider(s) healthy: ${providers.map(
+      (provider) => `${provider.providerId} (${provider.type}${provider.latencyMs === void 0 ? "" : `, ${provider.latencyMs}ms`})`
+    ).join(", ")}`
+  };
 }
-
-// src/commands/demo/index.ts
-function createDemoCommand(context, setExitCode) {
-  return new Command("demo").description("Start the minimal local demo").argument("[directory]", "project directory").option("--directory <path>", "set the project directory").option("--reset", "recreate managed demo data and configuration").option("--force", "allow replacement of managed demo files").option("--yes", "accept the default directory without prompting").option("--no-interactive", "disable the directory prompt").option(
-    "--image-tag <tag>",
-    "override the backend and client image tag"
-  ).action(async (directory, options) => {
-    const { configPath, config } = await loadCliState(context);
-    setExitCode(
-      await runDemo(
-        configPath,
-        config,
-        parsedArgs("demo", directory, [], options),
-        context
-      )
-    );
-  });
+function parse4(version) {
+  const match = /^v?(\d+)\.(\d+)\.(\d+)/.exec(version.trim());
+  if (!match) {
+    return void 0;
+  }
+  return {
+    major: Number(match[1]),
+    minor: Number(match[2]),
+    patch: Number(match[3])
+  };
 }
 
-// src/commands/deployment/action.ts
-async function runDriverCommand(config, command, parsed, context) {
-  const [instanceName, instance] = resolveInstance(config, parsed);
-  const driver = drivers[instance.target];
-  const handler = driver[command];
-  if (!handler) {
-    throw new Error(unsupportedCommand(command, instance.target));
+// src/services/tls-expiry.ts
+import { connect } from "node:tls";
+var defaultExpiryWarningDays = 30;
+var dayInMs = 24 * 60 * 60 * 1e3;
+function evaluateCertificate(certificate, now, warningDays = defaultExpiryWarningDays) {
+  const remainingDays = Math.floor(
+    (certificate.validTo.getTime() - now.getTime()) / dayInMs
+  );
+  const expiresOn = certificate.validTo.toISOString().slice(0, 10);
+  if (remainingDays < 0) {
+    return {
+      name: "TLS certificate",
+      status: "fail",
+      message: `The certificate issued by ${certificate.issuer} expired on ${expiresOn}.`
+    };
   }
-  if (instance.target === "compose") {
-    const clientMode = instance.clientUrl ? "client enabled" : "client disabled";
-    context.stdout.write(`${command} ${instanceName} (${clientMode})
-`);
+  if (remainingDays <= warningDays) {
+    return {
+      name: "TLS certificate",
+      status: "warn",
+      message: `The certificate expires on ${expiresOn}, in ${remainingDays} day(s). Renew it before then.`
+    };
   }
-  return handler({
-    instanceName,
-    instance,
-    args: parsed.positionals,
-    flags: parsed.flags,
-    context
-  });
+  return {
+    name: "TLS certificate",
+    status: "pass",
+    message: `Valid until ${expiresOn} (${remainingDays} day(s) left), issued by ${certificate.issuer}.`
+  };
 }
-
-// src/commands/deployment/index.ts
-var descriptions = {
-  up: "Start the selected Compose deployment",
-  down: "Stop the selected Compose deployment",
-  logs: "Stream logs for the selected deployment",
-  ps: "List the running containers or pods for the selected deployment",
-  restart: "Restart the workloads of the selected deployment"
-};
-var serviceScoped = /* @__PURE__ */ new Set([
-  "logs",
-  "restart"
-]);
-function createDeploymentCommands(context, setExitCode) {
-  return ["up", "down", "logs", "ps", "restart"].map((name) => {
-    const command = new Command(name).description(descriptions[name]).argument(
-      "[args...]",
-      "additional arguments passed to the deployment runtime"
-    ).option("--instance <name>", "select a configured instance");
-    if (serviceScoped.has(name)) {
-      command.option(
-        "--service <name>",
-        "select a configured workload (Kubernetes instances)"
-      );
-    }
-    if (name === "logs") {
-      command.option("--follow", "stream new output as it arrives").option("--tail <lines>", "number of recent lines to show");
-    }
-    if (name === "restart") {
-      command.option(
-        "--no-wait",
-        "return without waiting for the rollout to finish"
-      );
+var readPeerCertificate = (url) => new Promise((resolvePeer, rejectPeer) => {
+  const socket = connect(
+    {
+      host: url.hostname,
+      port: Number(url.port || 443),
+      servername: url.hostname,
+      rejectUnauthorized: true
+    },
+    () => {
+      const certificate = socket.getPeerCertificate();
+      socket.end();
+      if (!certificate || !certificate.valid_to) {
+        rejectPeer(new Error("no peer certificate was presented"));
+        return;
+      }
+      resolvePeer({
+        subject: String(certificate.subject?.CN ?? url.hostname),
+        issuer: String(certificate.issuer?.CN ?? "unknown issuer"),
+        validTo: new Date(certificate.valid_to)
+      });
     }
-    return command.action(async (args, options) => {
-      const { config } = await loadCliState(context);
-      setExitCode(
-        await runDriverCommand(
-          config,
-          name,
-          parsedArgs(name, void 0, args, options),
-          context
-        )
-      );
-    });
+  );
+  socket.setTimeout(1e4, () => {
+    socket.destroy();
+    rejectPeer(new Error("the TLS handshake timed out"));
+  });
+  socket.once("error", (error) => {
+    socket.destroy();
+    rejectPeer(error);
   });
+});
+async function checkTlsCertificate(baseUrl, now, read = readPeerCertificate, warningDays = defaultExpiryWarningDays) {
+  if (baseUrl.protocol !== "https:") {
+    return {
+      name: "TLS certificate",
+      status: "skip",
+      message: `${baseUrl.origin} does not use HTTPS, so there is no certificate to check.`
+    };
+  }
+  try {
+    return evaluateCertificate(await read(baseUrl), now, warningDays);
+  } catch (error) {
+    return {
+      name: "TLS certificate",
+      status: "fail",
+      message: `The certificate of ${baseUrl.origin} could not be verified: ${error instanceof Error ? error.message : String(error)}`
+    };
+  }
 }
 
 // src/services/diagnostics.ts
-async function runDoctor(instance, context, driverDiagnostics) {
-  const checks = [];
-  const baseUrl = parseUrl(instance.url);
-  if (!baseUrl) {
-    return [
-      {
+var publicUrlCheck = {
+  id: "public-url",
+  async run({ instance, baseUrl }) {
+    if (!baseUrl) {
+      return {
         name: "public URL",
         status: "fail",
         message: `${instance.url} is not a valid absolute URL`
-      }
-    ];
+      };
+    }
+    return {
+      name: "public URL",
+      status: baseUrl.protocol === "https:" ? "pass" : "warn",
+      message: baseUrl.protocol === "https:" ? `${baseUrl.href} uses HTTPS` : `${baseUrl.href} does not use HTTPS`
+    };
   }
-  checks.push({
-    name: "public URL",
-    status: baseUrl.protocol === "https:" ? "pass" : "warn",
-    message: baseUrl.protocol === "https:" ? `${baseUrl.href} uses HTTPS` : `${baseUrl.href} does not use HTTPS`
-  });
-  checks.push(
-    await checkEndpoint("API reachability", baseUrl, "/api/docs", context)
-  );
-  checks.push(
-    await checkEndpoint("health endpoint", baseUrl, "/health", context)
-  );
-  checks.push(checkAuthentication(context));
-  if (instance.clientUrl) {
+};
+var apiReachabilityCheck = {
+  id: "api-reachability",
+  run: ({ baseUrl, context }) => requireBaseUrl(
+    "API reachability",
+    baseUrl,
+    (url) => checkEndpoint("API reachability", url, "/api/docs", context)
+  )
+};
+var healthEndpointCheck = {
+  id: "health-endpoint",
+  run: ({ baseUrl, context }) => requireBaseUrl(
+    "health endpoint",
+    baseUrl,
+    (url) => checkEndpoint("health endpoint", url, "/health", context)
+  )
+};
+var tlsCertificateCheck = {
+  id: "tls-certificate",
+  run: ({ baseUrl, now, readCertificate }) => requireBaseUrl(
+    "TLS certificate",
+    baseUrl,
+    (url) => checkTlsCertificate(url, now, readCertificate)
+  )
+};
+var authenticationCheck = {
+  id: "authentication",
+  async run({ context }) {
+    const configured = Boolean(context.env.EUDIPLO_CLIENT_ID) && Boolean(context.env.EUDIPLO_CLIENT_SECRET);
+    return {
+      name: "authentication configuration",
+      status: configured ? "pass" : "warn",
+      message: configured ? "Client credentials are available in environment variables." : "Set EUDIPLO_CLIENT_ID and EUDIPLO_CLIENT_SECRET when commands need authenticated API access."
+    };
+  }
+};
+var clientConnectivityCheck = {
+  id: "client-connectivity",
+  async run({ instance, context }) {
+    if (!instance.clientUrl) {
+      return {
+        name: "client connectivity",
+        status: "skip",
+        message: "No client URL configured for this instance."
+      };
+    }
     const clientUrl = parseUrl(instance.clientUrl);
-    checks.push(
-      clientUrl ? await checkEndpoint(
-        "client connectivity",
-        clientUrl,
-        "/",
-        context
-      ) : {
+    if (!clientUrl) {
+      return {
         name: "client connectivity",
         status: "fail",
         message: `${instance.clientUrl} is not a valid absolute URL`
+      };
+    }
+    return checkEndpoint("client connectivity", clientUrl, "/", context);
+  }
+};
+var versionCompatibilityCheck = {
+  id: "version-compatibility",
+  run: ({ baseUrl, context, accessToken }) => requireBaseUrl("version compatibility", baseUrl, async (url) => {
+    const token = await accessToken();
+    if (token.kind !== "token") {
+      return authUnavailable("version compatibility", token);
+    }
+    const response = await fetchAuthenticated(
+      new URL("version", withTrailingSlash(url)),
+      token.accessToken,
+      context
+    );
+    if (!response.ok) {
+      if (response.status === 404) {
+        return {
+          name: "version compatibility",
+          status: "skip",
+          message: "This backend does not expose /version, so compatibility cannot be checked."
+        };
       }
+      return {
+        name: "version compatibility",
+        status: "fail",
+        message: `The backend version could not be read: ${response.reason}`
+      };
+    }
+    const backendVersion = readBackendVersion(response.body);
+    if (!backendVersion) {
+      return {
+        name: "version compatibility",
+        status: "warn",
+        message: "The backend did not report a version."
+      };
+    }
+    return compareVersions(package_default.version, backendVersion);
+  })
+};
+var kmsHealthCheck = {
+  id: "kms-health",
+  run: ({ baseUrl, context, accessToken }) => requireBaseUrl("KMS providers", baseUrl, async (url) => {
+    const token = await accessToken();
+    if (token.kind !== "token") {
+      return authUnavailable("KMS providers", token);
+    }
+    const response = await fetchAuthenticated(
+      new URL("key-chain/providers/health", withTrailingSlash(url)),
+      token.accessToken,
+      context
     );
-  } else {
-    checks.push({
-      name: "client connectivity",
-      status: "warn",
-      message: "No client URL configured for this instance."
-    });
+    if (!response.ok) {
+      if (response.status === 404) {
+        return {
+          name: "KMS providers",
+          status: "skip",
+          message: "This backend does not expose the KMS provider health endpoint."
+        };
+      }
+      return {
+        name: "KMS providers",
+        status: "fail",
+        message: `Provider health could not be read: ${response.reason}`
+      };
+    }
+    try {
+      return summarizeProviderHealth(
+        readProviderHealth(response.body)
+      );
+    } catch {
+      return {
+        name: "KMS providers",
+        status: "warn",
+        message: "The provider health response could not be read."
+      };
+    }
+  })
+};
+function authUnavailable(name, token) {
+  return {
+    name,
+    status: token.kind === "unavailable" ? "skip" : "fail",
+    message: token.kind === "unavailable" ? `Needs authentication: ${token.reason}.` : `Could not authenticate: ${token.reason}.`
+  };
+}
+var coreChecks = [
+  publicUrlCheck,
+  apiReachabilityCheck,
+  healthEndpointCheck,
+  tlsCertificateCheck,
+  authenticationCheck,
+  versionCompatibilityCheck,
+  kmsHealthCheck,
+  clientConnectivityCheck
+];
+async function runDoctor(instance, context, driverDiagnostics, options = {}) {
+  const baseUrl = parseUrl(instance.url);
+  let token;
+  const checkContext = {
+    instance,
+    context,
+    baseUrl,
+    now: options.now ?? /* @__PURE__ */ new Date(),
+    readCertificate: options.readCertificate ?? context.readCertificate ?? readPeerCertificate,
+    accessToken: () => {
+      if (!baseUrl) {
+        return Promise.resolve({
+          kind: "unavailable",
+          reason: "the instance URL could not be parsed"
+        });
+      }
+      token ??= requestAccessToken(baseUrl, context);
+      return token;
+    }
+  };
+  const checks = [];
+  for (const check of coreChecks) {
+    checks.push(await check.run(checkContext));
   }
   checks.push(...driverDiagnostics);
   return checks;
 }
-function hasFailedChecks(checks) {
-  return checks.some((check) => check.status === "fail");
+function summarizeChecks(checks) {
+  return {
+    pass: count(checks, "pass"),
+    warn: count(checks, "warn"),
+    fail: count(checks, "fail"),
+    skip: count(checks, "skip")
+  };
+}
+function hasFailedChecks(checks, strict = false) {
+  return checks.some(
+    (check) => check.status === "fail" || strict && check.status === "warn"
+  );
 }
 function formatChecks(checks) {
   return checks.map(
     (check) => `${formatStatus(check.status)} ${check.name}: ${check.message}`
   ).join("\n");
 }
+function formatSummary(summary) {
+  return `${summary.pass} passed, ${summary.warn} warning(s), ${summary.fail} failure(s), ${summary.skip} skipped`;
+}
+function count(checks, status) {
+  return checks.filter((check) => check.status === status).length;
+}
+async function requireBaseUrl(name, baseUrl, run) {
+  if (!baseUrl) {
+    return {
+      name,
+      status: "skip",
+      message: "The instance URL could not be parsed."
+    };
+  }
+  return run(baseUrl);
+}
 async function checkEndpoint(name, baseUrl, path2, context) {
   const url = new URL(path2, baseUrl);
   try {
@@ -22424,22 +24714,6 @@ async function checkEndpoint(name, baseUrl, path2, context) {
     };
   }
 }
-function checkAuthentication(context) {
-  const hasClientId = Boolean(context.env.EUDIPLO_CLIENT_ID);
-  const hasClientSecret = Boolean(context.env.EUDIPLO_CLIENT_SECRET);
-  if (hasClientId && hasClientSecret) {
-    return {
-      name: "authentication configuration",
-      status: "pass",
-      message: "Client credentials are available in environment variables."
-    };
-  }
-  return {
-    name: "authentication configuration",
-    status: "warn",
-    message: "Set EUDIPLO_CLIENT_ID and EUDIPLO_CLIENT_SECRET when commands need authenticated API access."
-  };
-}
 function parseUrl(value) {
   try {
     const url = new URL(value);
@@ -22455,28 +24729,54 @@ function formatStatus(status) {
   if (status === "warn") {
     return "WARN";
   }
+  if (status === "skip") {
+    return "SKIP";
+  }
   return "FAIL";
 }
 
 // src/commands/doctor/action.ts
-async function runDoctorCommand(config, parsed, context) {
-  const [instanceName, instance] = resolveInstance(config, parsed);
+async function runDoctorCommand(config, parsed, context, options = {}) {
+  const strict = parsed.flags.strict === true;
+  const instances = parsed.flags.all === true ? Object.keys(config.instances) : [resolveInstance(config, parsed)[0]];
+  if (instances.length === 0) {
+    throw new Error("No instances are configured.");
+  }
+  let failed = false;
+  for (const [index, instanceName] of instances.entries()) {
+    const instance = config.instances[instanceName];
+    if (index > 0) {
+      context.stdout.write("\n");
+    }
+    const checks = await runDiagnostics(instance, context, options);
+    context.stdout.write(
+      `Doctor for ${instanceName} (${instance.target})
+`
+    );
+    context.stdout.write(`${formatChecks(checks)}
+`);
+    context.stdout.write(`${formatSummary(summarizeChecks(checks))}
+`);
+    failed = hasFailedChecks(checks, strict) || failed;
+  }
+  return failed ? 1 : 0;
+}
+async function runDiagnostics(instance, context, options) {
   const driver = drivers[instance.target];
-  const checks = await runDoctor(
+  return runDoctor(
     instance,
     context,
-    await driver.diagnostics(instance, context)
+    await driver.diagnostics(instance, context),
+    options
   );
-  context.stdout.write(`Doctor for ${instanceName} (${instance.target})
-`);
-  context.stdout.write(`${formatChecks(checks)}
-`);
-  return hasFailedChecks(checks) ? 1 : 0;
 }
 
 // src/commands/doctor/index.ts
 function createDoctorCommand(context, setExitCode) {
-  return new Command("doctor").description("Run deployment diagnostics").option("--instance <name>", "select a configured instance").action(async (options) => {
+  return new Command("doctor").description("Run deployment diagnostics").option("--instance <name>", "select a configured instance").option("--all", "run the checks for every configured instance").option(
+    "--strict",
+    "treat warnings as failures (skipped checks never fail)"
+  ).action(async (options) => {
     const { config } = await loadCliState(context);
     setExitCode(
       await runDoctorCommand(
@@ -23020,6 +25320,146 @@ function createInstanceCommand(context, setExitCode) {
   return instance;
 }
 
+// src/services/browser.ts
+import { spawn as spawn2 } from "node:child_process";
+import { access as access3 } from "node:fs/promises";
+import { delimiter as delimiter2, join as join11 } from "node:path";
+function assertWebUrl(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error(`${value} is not a valid absolute URL.`);
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    throw new Error(
+      `Refusing to open ${value}: only http and https URLs are supported.`
+    );
+  }
+  return url;
+}
+async function chooseLauncher(url, { platform, env, which }) {
+  const browser = env.BROWSER?.trim();
+  if (browser && !/\s|%s/.test(browser)) {
+    const command = await which(browser);
+    if (command) {
+      return { command, args: [url] };
+    }
+  }
+  if (platform === "darwin") {
+    return { command: "open", args: [url] };
+  }
+  if (platform === "win32") {
+    return {
+      command: "rundll32.exe",
+      args: ["url.dll,FileProtocolHandler", url]
+    };
+  }
+  if (env.WSL_DISTRO_NAME) {
+    const wslview = await which("wslview");
+    if (wslview) {
+      return { command: wslview, args: [url] };
+    }
+  }
+  if (env.DISPLAY || env.WAYLAND_DISPLAY) {
+    const xdgOpen = await which("xdg-open");
+    if (xdgOpen) {
+      return { command: xdgOpen, args: [url] };
+    }
+  }
+  return void 0;
+}
+function launchBrowser(launcher) {
+  return new Promise((resolveLaunch) => {
+    const child = spawn2(launcher.command, launcher.args, {
+      detached: true,
+      stdio: "ignore"
+    });
+    child.once("error", () => resolveLaunch(false));
+    child.once("spawn", () => {
+      child.unref();
+      resolveLaunch(true);
+    });
+  });
+}
+function pathLookup(env, platform = process.platform) {
+  const extensions = platform === "win32" ? ["", ...(env.PATHEXT ?? ".EXE;.CMD;.BAT;.COM").split(";")] : [""];
+  return async (name) => {
+    const entries = (env.PATH ?? "").split(delimiter2).filter(Boolean);
+    for (const entry of entries) {
+      for (const extension of extensions) {
+        const candidate = join11(entry, `${name}${extension}`);
+        try {
+          await access3(candidate);
+          return candidate;
+        } catch {
+        }
+      }
+    }
+    return void 0;
+  };
+}
+
+// src/commands/open/action.ts
+var defaultDependencies = {
+  platform: process.platform,
+  launch: launchBrowser
+};
+function resolveOpenTarget(instanceName, instance, docs) {
+  if (docs) {
+    const base = instance.url.endsWith("/") ? instance.url : `${instance.url}/`;
+    return assertWebUrl(new URL("api/docs", base).href).href;
+  }
+  if (!instance.clientUrl) {
+    throw new Error(
+      `Instance ${instanceName} has no web client URL. Use --docs to open the API documentation instead.`
+    );
+  }
+  return assertWebUrl(instance.clientUrl).href;
+}
+async function runOpenCommand(config, parsed, context, dependencies = defaultDependencies) {
+  const [instanceName, instance] = resolveInstance(config, parsed);
+  const url = resolveOpenTarget(
+    instanceName,
+    instance,
+    parsed.flags.docs === true
+  );
+  if (parsed.flags.print === true || context.interactive !== true) {
+    context.stdout.write(`${url}
+`);
+    return 0;
+  }
+  const launcher = await chooseLauncher(url, {
+    platform: dependencies.platform,
+    env: context.env,
+    which: pathLookup(context.env, dependencies.platform)
+  });
+  if (!launcher || !await dependencies.launch(launcher)) {
+    context.stdout.write(`No browser is available here. Open: ${url}
+`);
+    return 0;
+  }
+  context.stdout.write(`Opening ${url}
+`);
+  return 0;
+}
+
+// src/commands/open/index.ts
+function createOpenCommand(context, setExitCode) {
+  return new Command("open").description(
+    "Open the web client of the selected instance in a browser"
+  ).option("--instance <name>", "select a configured instance").option("--docs", "open the management API documentation instead").option("--print", "print the URL instead of opening a browser").action(async (options) => {
+    const { config } = await loadCliState(context);
+    setExitCode(
+      await runOpenCommand(
+        config,
+        parsedArgs("open", void 0, [], options),
+        context
+      )
+    );
+  });
+}
+
 // src/commands/status/action.ts
 async function runStatusCommand(config, parsed, context) {
   const [instanceName, instance] = resolveInstance(config, parsed);
@@ -23052,80 +25492,224 @@ function createStatusCommand(context, setExitCode) {
   });
 }
 
-// src/commands/version/action.ts
-import { isSea as isSea2 } from "node:sea";
+// src/commands/upgrade/action.ts
+import { readFile as readFile9, writeFile as writeFile6 } from "node:fs/promises";
+import { resolve as resolve8 } from "node:path";
 
-// package.json
-var package_default = {
-  name: "@eudiplo/cli",
-  version: "8.0.2",
-  description: "Deployment-aware command line tools for EUDIPLO",
-  private: false,
-  type: "module",
-  bin: {
-    eudiplo: "dist/index.js"
-  },
-  files: [
-    "dist",
-    "templates",
-    "README.md"
-  ],
-  scripts: {
-    "assets:sync": "node scripts/sync-cli-assets.cjs",
-    "assets:check": "node scripts/check-cli-assets.cjs",
-    build: "pnpm assets:sync && pnpm assets:check && tsc -p tsconfig.json",
-    "build:publish": "pnpm build && esbuild src/index.ts --bundle --platform=node --format=esm --target=node22.12 --alias:jsonc-parser=jsonc-parser/lib/esm/main.js --outfile=dist/index.js",
-    "build:sea:bundle": "pnpm assets:sync && pnpm assets:check && esbuild src/index.ts --bundle --platform=node --format=esm --target=node22.12 --alias:jsonc-parser=jsonc-parser/lib/esm/main.js --outfile=dist-sea/index.js",
-    "build:sea": "node scripts/build-cli-sea.mjs",
-    dev: "tsx src/index.ts",
-    test: "vitest run --project cli",
-    lint: "biome lint .",
-    prepublishOnly: "pnpm build:publish"
-  },
-  keywords: [
-    "eudiplo",
-    "cli",
-    "eudi",
-    "wallet",
-    "oid4vci",
-    "oid4vp"
-  ],
-  repository: {
-    type: "git",
-    url: "git+https://github.com/openwallet-foundation/eudiplo.git",
-    directory: "apps/cli"
-  },
-  homepage: "https://github.com/openwallet-foundation/eudiplo/tree/main/apps/cli#readme",
-  bugs: {
-    url: "https://github.com/openwallet-foundation/eudiplo/issues"
-  },
-  author: "OpenWallet Foundation",
-  license: "Apache-2.0",
-  engines: {
-    node: ">=22.12.0"
-  },
-  publishConfig: {
-    access: "public"
-  },
-  dependencies: {
-    "@eudiplo/config-format": "workspace:*",
-    ajv: "^8.20.0",
-    "ajv-formats": "^3.0.1",
-    commander: "^15.0.0",
-    fflate: "^0.8.3",
-    "jsonc-parser": "^3.3.1"
-  },
-  devDependencies: {
-    "@biomejs/biome": "2.5.13",
-    "@types/node": "^26.4.0",
-    esbuild: "^0.28.2",
-    tsx: "^4.23.13",
-    typescript: "^7.0.2",
-    vitest: "4.1.11"
-  }
+// src/services/compose-upgrade.ts
+var managedImages = {
+  EUDIPLO_IMAGE: "ghcr.io/openwallet-foundation/eudiplo",
+  EUDIPLO_CLIENT_IMAGE: "ghcr.io/openwallet-foundation/eudiplo-client"
 };
+var TAG = /^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$/;
+function assertImageTag(tag) {
+  if (!TAG.test(tag)) {
+    throw new Error(
+      `Invalid image tag ${JSON.stringify(tag)}. Tags contain letters, digits, "_", "." and "-", and cannot start with "." or "-".`
+    );
+  }
+}
+function planImageUpgrade(content, tag) {
+  assertImageTag(tag);
+  const found = /* @__PURE__ */ new Set();
+  const changes = [];
+  const lines = content.split("\n").map((line) => {
+    const match = /^(EUDIPLO_IMAGE|EUDIPLO_CLIENT_IMAGE)=(.*?)(\r?)$/.exec(
+      line
+    );
+    if (!match) {
+      return line;
+    }
+    const key = match[1];
+    const value = match[2];
+    const lineEnding = match[3];
+    const repository = managedImages[key];
+    if (found.has(key)) {
+      throw new Error(
+        `${key} is defined more than once in the env file.`
+      );
+    }
+    found.add(key);
+    const prefix = `${repository}:`;
+    const current = value.startsWith(prefix) ? value.slice(prefix.length) : void 0;
+    if (current === void 0 || !TAG.test(current)) {
+      throw new Error(
+        `${key} is set to ${value}, which is not a CLI-managed image. Update it yourself, or restore ${prefix}<tag> to let the CLI manage it.`
+      );
+    }
+    if (current !== tag) {
+      changes.push({ key, repository, from: current, to: tag });
+    }
+    return `${key}=${prefix}${tag}${lineEnding}`;
+  });
+  if (!found.has("EUDIPLO_IMAGE")) {
+    throw new Error(
+      "The env file does not define EUDIPLO_IMAGE, so there is no CLI-managed image to upgrade."
+    );
+  }
+  return { changes, content: lines.join("\n") };
+}
+function parseVersion(tag) {
+  const match = /^v?(\d+)\.(\d+)\.(\d+)$/.exec(tag);
+  if (!match) {
+    return void 0;
+  }
+  return {
+    major: Number(match[1]),
+    minor: Number(match[2]),
+    patch: Number(match[3])
+  };
+}
+function compareVersions2(a, b) {
+  return a.major - b.major || a.minor - b.minor || a.patch - b.patch;
+}
+var migrationBaseUrl = "https://docs.eudiplo.dev/migration";
+function migrationNotes(from, to) {
+  const fromVersion = parseVersion(from);
+  const toVersion = parseVersion(to);
+  if (!fromVersion || !toVersion) {
+    return [
+      `Cannot compare ${from} and ${to} as versions. Check the release notes and ${migrationBaseUrl} before continuing.`
+    ];
+  }
+  const order = compareVersions2(fromVersion, toVersion);
+  if (order > 0) {
+    return [
+      `${to} is older than ${from}. Downgrades are not supported once database migrations have run; restore a backup instead if you need to go back.`
+    ];
+  }
+  const notes = [];
+  for (let major = fromVersion.major + 1; major <= toVersion.major; major++) {
+    notes.push(
+      `Major version ${major}: read ${migrationBaseUrl}/${major - 1}.x-to-${major}.0 first.`
+    );
+  }
+  return notes;
+}
+
+// src/commands/upgrade/action.ts
+async function runUpgradeCommand(config, parsed, context) {
+  const [instanceName, instance] = resolveInstance(config, parsed);
+  if (instance.target !== "compose") {
+    throw new Error(unsupportedCommand("upgrade", instance.target));
+  }
+  const options = {
+    instanceName,
+    instance,
+    args: [],
+    flags: parsed.flags,
+    context
+  };
+  assertWritable(options);
+  const tag = readStringFlag(parsed.flags, "image-tag");
+  if (!tag) {
+    throw new Error("upgrade requires --image-tag <tag>.");
+  }
+  if (!instance.envFile) {
+    throw new Error(
+      `Instance ${instanceName} has no env file, so its images are not managed by the CLI.`
+    );
+  }
+  const envPath = resolve8(
+    instance.projectDirectory ?? context.cwd,
+    instance.envFile
+  );
+  const original = await readEnvFile(envPath);
+  const plan = planImageUpgrade(original, tag);
+  if (plan.changes.length === 0) {
+    context.stdout.write(
+      `${instanceName} already uses image tag ${tag}.
+`
+    );
+    return 0;
+  }
+  context.stdout.write(`Upgrade ${instanceName}:
+`);
+  for (const change of plan.changes) {
+    context.stdout.write(
+      `  ${change.repository}: ${change.from} -> ${change.to}
+`
+    );
+  }
+  const notes = new Set(
+    plan.changes.flatMap(
+      (change) => migrationNotes(change.from, change.to)
+    )
+  );
+  for (const note of notes) {
+    context.stdout.write(`Note: ${note}
+`);
+  }
+  if (!await confirmUpgrade(parsed, context)) {
+    context.stdout.write("Upgrade cancelled. Nothing was changed.\n");
+    return 0;
+  }
+  await writeFile6(envPath, plan.content, "utf8");
+  const pulled = await runCompose(buildComposePullArgs(void 0), options);
+  if (pulled !== 0) {
+    await writeFile6(envPath, original, "utf8");
+    context.stderr.write(
+      `Pulling the new images failed. Restored the previous image tags in ${envPath}.
+`
+    );
+    return pulled;
+  }
+  const recreated = await runCompose(buildComposeUpArgs(), options);
+  if (recreated !== 0) {
+    context.stderr.write(
+      `The new images were pulled and ${envPath} now uses ${tag}, but recreating the services failed. Fix the error above and run eudiplo up.
+`
+    );
+    return recreated;
+  }
+  context.stdout.write(`Upgraded ${instanceName} to ${tag}.
+`);
+  return 0;
+}
+async function readEnvFile(path2) {
+  try {
+    return await readFile9(path2, "utf8");
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+      throw new Error(`Env file not found: ${path2}`);
+    }
+    throw error;
+  }
+}
+async function confirmUpgrade(parsed, context) {
+  if (parsed.flags.yes === true) {
+    return true;
+  }
+  if (context.interactive !== true) {
+    throw new Error("upgrade requires --yes in non-interactive mode.");
+  }
+  const prompter = createPrompter(context);
+  try {
+    const answer = (await prompter.ask("Continue? [y/N]: ")).trim().toLowerCase();
+    return answer === "y" || answer === "yes";
+  } finally {
+    prompter.close();
+  }
+}
+
+// src/commands/upgrade/index.ts
+function createUpgradeCommand(context, setExitCode) {
+  return new Command("upgrade").description(
+    "Upgrade the EUDIPLO application images of a Compose deployment"
+  ).requiredOption("--image-tag <tag>", "image tag to upgrade to").option("--instance <name>", "select a configured instance").option("--yes", "upgrade without asking for confirmation").action(async (options) => {
+    const { config } = await loadCliState(context);
+    setExitCode(
+      await runUpgradeCommand(
+        config,
+        parsedArgs("upgrade", void 0, [], options),
+        context
+      )
+    );
+  });
+}
 
 // src/commands/version/action.ts
+import { isSea as isSea2 } from "node:sea";
 function versionText() {
   return `${package_default.name} ${package_default.version}`;
 }
@@ -23232,6 +25816,8 @@ function createProgram(context, setExitCode) {
   for (const command of createDeploymentCommands(context, setExitCode)) {
     program2.addCommand(command);
   }
+  program2.addCommand(createUpgradeCommand(context, setExitCode));
+  program2.addCommand(createOpenCommand(context, setExitCode));
   program2.addCommand(createInstanceCommand(context, setExitCode));
   program2.addCommand(createConfigCommand(context, setExitCode));
   program2.addCommand(createDoctorCommand(context, setExitCode));