@eudiplo/cli 8.1.0-main.a6a67b3 → 8.1.0-main.b98cc00

package/dist/index.js

@@ -11388,12 +11388,7 @@ import { homedir } from "node:os";
 
 // src/services/kubectl.ts
 function scopeArgs(scope) {
-  return [
-    "--context",
-    scope.context,
-    "--namespace",
-    scope.namespace
-  ];
+  return ["--context", scope.context, "--namespace", scope.namespace];
 }
 function resolveScope(instance, instanceName) {
   if (!instance.context) {
@@ -11922,7 +11917,12 @@ function powershellCompletion() {
 }
 
 // src/commands/completion/index.ts
-var supportedShells = ["bash", "zsh", "fish", "powershell"];
+var supportedShells = [
+  "bash",
+  "zsh",
+  "fish",
+  "powershell"
+];
 function createCompletionCommand(context, setExitCode) {
   return new Command("completion").description("Generate shell completion scripts").addArgument(
     new Argument("<shell>", "shell to generate completion for").choices(
@@ -11933,14 +11933,22 @@ function createCompletionCommand(context, setExitCode) {
   });
 }
 function createCompletionCandidatesCommand(context, setExitCode) {
-  return new Command("_complete").argument("[words...]").allowUnknownOption(true).action(async (words, _options, command) => {
-    if (!command.parent) {
-      throw new Error("Completion command is not attached to the CLI root.");
+  return new Command("_complete").argument("[words...]").allowUnknownOption(true).action(
+    async (words, _options, command) => {
+      if (!command.parent) {
+        throw new Error(
+          "Completion command is not attached to the CLI root."
+        );
+      }
+      setExitCode(
+        await runCompletionCandidates(
+          command.parent,
+          words,
+          context
+        )
+      );
     }
-    setExitCode(
-      await runCompletionCandidates(command.parent, words, context)
-    );
-  });
+  );
 }
 
 // src/commands/commands/render.ts
@@ -12028,8 +12036,10 @@ function runConfigShow(configPath, config, json, context) {
   }
   context.stdout.write(`Config: ${configPath}
 `);
-  context.stdout.write(`Default instance: ${config.defaultInstance ?? "none"}
-`);
+  context.stdout.write(
+    `Default instance: ${config.defaultInstance ?? "none"}
+`
+  );
   const instances = Object.entries(config.instances).sort(
     ([left], [right]) => left.localeCompare(right)
   );
@@ -14887,7 +14897,7 @@ var CONFIG_FORMATS = {
   IssuanceConfig: {
     slug: "issuance-config",
     file: "IssuanceConfigFile",
-    version: 1
+    version: 2
   },
   CredentialConfig: {
     slug: "credential-config",
@@ -14897,7 +14907,7 @@ var CONFIG_FORMATS = {
   PresentationConfig: {
     slug: "presentation-config",
     file: "PresentationConfigFile",
-    version: 1
+    version: 2
   },
   AttributeProvider: {
     slug: "attribute-provider",
@@ -14936,7 +14946,42 @@ function resourceId(input) {
     throw new Error(`Configuration spec.${field} is required`);
   return id;
 }
-var CONFIG_MIGRATIONS = [];
+var presentationConfigV1ToV2 = {
+  id: "presentation-config-v2-provides-attestations",
+  kind: "PresentationConfig",
+  from: 1,
+  to: 2,
+  migrate(spec) {
+    const registrationCert = spec.registration_cert;
+    if (!object(registrationCert) || !object(registrationCert.body) || !("provided_attestations" in registrationCert.body)) {
+      return { spec };
+    }
+    const { provided_attestations: _, ...body } = registrationCert.body;
+    return {
+      spec: { ...spec, registration_cert: { ...registrationCert, body } },
+      issues: [
+        {
+          severity: "warning",
+          code: "PROVIDED_ATTESTATIONS_REMOVED",
+          path: "/spec/registration_cert/body/provided_attestations",
+          message: "provided_attestations is not part of the registrar API and was removed. Set provides_attestations to the credential type identifiers (SD-JWT VC vct or mdoc doctype) the issuer provides."
+        }
+      ]
+    };
+  }
+};
+var CONFIG_MIGRATIONS = [
+  {
+    id: "issuance-config-v2-offer-lifetime",
+    kind: "IssuanceConfig",
+    from: 1,
+    to: 2,
+    // v2 only adds the optional offerLifetimeSeconds: a v1 spec is a
+    // valid v2 spec whose offers keep having no lifetime.
+    migrate: (spec) => ({ spec })
+  },
+  presentationConfigV1ToV2
+];
 function schemaUrl(kind, version = CONFIG_FORMATS[kind].version) {
   if (!Number.isSafeInteger(version) || version < 1)
     throw new Error("Invalid config version");
@@ -20001,233 +20046,1627 @@ var CONFIG_SCHEMAS = [
         "title": "CreateWebhookEndpointDto"
       }
     }
-  }
-];
-
-// ../../packages/eudiplo-config-format/dist/config-validator.js
-var ajv = new import__.Ajv2020({
-  allErrors: true,
-  strict: false,
-  validateFormats: false
-});
-for (const schema of CONFIG_SCHEMAS)
-  ajv.addSchema(schema);
-function validateConfigDocument(document) {
-  const file = serializeDocument(document);
-  const validate = ajv.getSchema(file.$schema);
-  if (!validate)
-    throw new Error(`No bundled validator for ${file.$schema}`);
-  const issues = [];
-  if (!validate(file)) {
-    for (const issue of validate.errors ?? [])
-      issues.push({
-        severity: "error",
-        code: "CONFIG_SCHEMA_VALIDATION_FAILED",
-        path: issue.instancePath || "/",
-        message: issue.keyword === "additionalProperties" ? `Unknown property: ${String(issue.params.additionalProperty)}` : issue.message ?? "Invalid configuration",
-        resource: { kind: document.kind, id: resourceId(document) }
-      });
-  }
-  const id = document.kind === "Client" ? document.spec.clientId : document.spec.id;
-  if (id !== void 0 && id !== resourceId(document))
-    issues.push({
-      severity: "error",
-      code: "RESOURCE_ID_MISMATCH",
-      path: document.kind === "Client" ? "/spec/clientId" : "/spec/id",
-      message: "Resource identifier does not match metadata.id"
-    });
-  return issues;
-}
-
-// src/commands/config/portability/migrations.ts
-function upgradeDocument(input) {
-  const result = migrateDocument(input, validateConfigDocument);
-  return { ...result, document: serializeDocument(result.document) };
-}
-
-// src/commands/config/portability/upgrade.ts
-var codec = new ConfigBundleCodec();
-function parse3(text, path2) {
-  try {
-    return JSON.parse(text);
-  } catch {
-    throw new Error(`Invalid JSON in ${path2}`);
-  }
-}
-function upgradeJson(input, file, context) {
-  const bundle = Array.isArray(input?.documents);
-  if (bundle) assertConfigBundle(input);
-  const results = (bundle ? input.documents : [input]).map(
-    (document) => upgradeDocument(document)
-  );
-  let blocked = false;
-  for (const result of results) {
-    for (const issue of result.issues) {
-      context.stderr.write(
-        `${file}${issue.path}: ${issue.severity} ${issue.code}: ${issue.message}
-`
-      );
-      if (issue.severity !== "warning") blocked = true;
-    }
-    for (const migration of result.migrations)
-      context.stdout.write(`${file}: migration ${migration}
-`);
-  }
-  if (blocked) throw new Error(`${file}: upgrade blocked; no output written`);
-  if (!bundle) return results[0].document;
-  const documents = results.map(
-    (result) => result.document
-  );
-  const resources = input.manifest.resources.map(
-    (resource) => {
-      const index = input.documents.findIndex(
-        (candidate) => normalizeDocument(candidate).kind === resource.kind && resourceId(candidate) === resource.id
-      );
-      const document = documents[index];
-      return {
-        ...resource,
-        id: resourceId(document),
-        $schema: document.$schema,
-        sha256: createHash2("sha256").update(JSON.stringify(document)).digest("hex")
-      };
-    }
-  );
-  const output = {
-    ...input,
-    manifest: { ...input.manifest, formatVersion: 2, resources },
-    documents
-  };
-  assertConfigBundle(output);
-  return output;
-}
-function report(input, output, file, parsed, context) {
-  const changed = stableConfigJson(input) !== stableConfigJson(output);
-  context.stdout.write(
-    `${file}: ${changed ? "upgrade required" : "current"}
-`
-  );
-  if (parsed.flags.diff === true)
-    for (const change of configChanges(input, output)) {
-      context.stdout.write(
-        `  ${change.path}: ${JSON.stringify(change.before) ?? "(absent)"} -> ${JSON.stringify(change.after) ?? "(absent)"}
-`
-      );
-    }
-  return changed;
-}
-function inferredKind(path2) {
-  const normalized = path2.split(sep2).join("/");
-  const match = TENANT_RESOURCE_REGISTRY.find(
-    (entry) => entry.kind === "file" ? normalized === entry.file || normalized.endsWith(`/${entry.file}`) : normalized.endsWith(`/${entry.subfolder}/${basename2(path2)}`) || normalized === `${entry.subfolder}/${basename2(path2)}`
-  );
-  return CONFIG_RESOURCE_KINDS.find(
-    (kind) => `${CONFIG_FORMATS[kind].file}.schema.json` === match?.schemaFile
-  );
-}
-function wrapBare(kind, input, path2) {
-  if (!input || typeof input !== "object" || Array.isArray(input))
-    throw new Error(`${path2}: configuration must be an object`);
-  const singleton = {
-    Tenant: "tenant",
-    KmsConfig: "kms",
-    RegistrarConfig: "registrar",
-    IssuanceConfig: "issuance"
-  };
-  const spec = structuredClone(input);
-  if (kind === "KeyChain" && spec.key && !spec.keySource) {
-    spec.keySource = { type: "private-jwk", jwk: spec.key };
-    delete spec.key;
-  }
-  const id = String(
-    singleton[kind] ?? spec.id ?? spec.clientId ?? basename2(path2, ".json")
-  );
-  if (!singleton[kind]) spec[kind === "Client" ? "clientId" : "id"] = id;
-  return { $schema: schemaUrl(kind, 1), metadata: { generation: 1 }, spec };
-}
-async function folderFiles(path2) {
-  const files = [];
-  for (const entry of await readdir(path2, { withFileTypes: true })) {
-    if (entry.name.startsWith(".")) continue;
-    const file = join4(path2, entry.name);
-    if (entry.isSymbolicLink())
-      throw new Error(`Config folder contains a symbolic link: ${file}`);
-    if (entry.isDirectory()) files.push(...await folderFiles(file));
-    else if (entry.isFile()) files.push(file);
-  }
-  return files.sort();
-}
-async function upgradeFolder(source, parsed, context) {
-  const outputs = /* @__PURE__ */ new Map();
-  let changed = 0;
-  for (const file of await folderFiles(source)) {
-    if (extname(file) !== ".json" || relative2(source, file).split(sep2).includes("images"))
-      continue;
-    const input = parse3(await readFile4(file, "utf8"), file);
-    const kind = inferredKind(relative2(source, file));
-    if (!kind && !isConfigDocument(input)) continue;
-    const candidate = isConfigDocument(input) ? input : wrapBare(kind, input, file);
-    const output = upgradeJson(candidate, file, context);
-    if (kind && normalizeDocument(output).kind !== kind)
-      throw new Error(`${file}: expected ${kind} configuration`);
-    if (report(input, output, relative2(source, file), parsed, context))
-      changed++;
-    outputs.set(
-      relative2(source, file),
-      `${JSON.stringify(output, null, 2)}
-`
-    );
-  }
-  if (!outputs.size)
-    throw new Error(`No configuration documents found in ${source}`);
-  context.stdout.write(
-    `${outputs.size - changed} current, ${changed} require upgrading
-`
-  );
-  if (parsed.flags.check === true) return changed ? 1 : 0;
-  if (parsed.flags["dry-run"] === true) return 0;
-  const destination = resolve3(
-    context.cwd,
-    readStringFlag(parsed.flags, "output") ?? `${source}.upgraded`
-  );
-  const overlap = (parent, child) => {
-    const path2 = relative2(parent, child);
-    return path2 === "" || !path2.startsWith(`..${sep2}`) && path2 !== "..";
-  };
-  if (overlap(source, destination) || overlap(destination, source))
-    throw new Error(
-      "Folder output must be separate from the source directory"
-    );
-  await lstat(destination).then(
-    () => {
-      throw new Error(`Output already exists: ${destination}`);
-    },
-    (error) => {
-      if (error.code !== "ENOENT") throw error;
-    }
-  );
-  await mkdir3(dirname3(destination), { recursive: true });
-  const staging = await mkdtemp(
-    join4(dirname3(destination), ".eudiplo-upgrade-")
-  );
-  try {
-    await cp(source, staging, {
-      recursive: true,
-      filter: (path2) => path2 === source || !relative2(source, path2).split(sep2).some((part) => part.startsWith("."))
-    });
-    for (const [path2, contents] of outputs)
-      await atomicWriteFile(join4(staging, path2), contents);
-    await rename2(staging, destination);
-    context.stdout.write(
-      `Wrote upgraded configuration folder to ${destination}
-`
-    );
-  } finally {
-    await rm(staging, { recursive: true, force: true });
-  }
-  return 0;
-}
-async function upgradeFile(parsed, context) {
-  const name = parsed.positionals[0];
+  },
+  {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://eudiplo.dev/schemas/v2/IssuanceConfigFile.schema.json",
+    "title": "IssuanceConfigFile",
+    "type": "object",
+    "properties": {
+      "$schema": {
+        "type": "string",
+        "const": "https://eudiplo.dev/schemas/v2/IssuanceConfigFile.schema.json"
+      },
+      "metadata": {
+        "type": "object",
+        "properties": {
+          "generation": {
+            "type": "integer",
+            "minimum": 1,
+            "description": "Monotonically increasing configuration generation."
+          },
+          "ownership": {
+            "type": "string",
+            "enum": [
+              "unmanaged",
+              "file-managed"
+            ],
+            "description": "Requested ownership recorded when the document is applied."
+          }
+        },
+        "additionalProperties": false
+      },
+      "spec": {
+        "$ref": "#/$defs/IssuanceConfig"
+      }
+    },
+    "required": [
+      "$schema",
+      "spec"
+    ],
+    "additionalProperties": false,
+    "$defs": {
+      "IssuanceConfig": {
+        "type": "object",
+        "properties": {
+          "batchSize": {
+            "description": "Optional issuance batch size.",
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 9007199254740991
+          },
+          "dPopRequired": {
+            "description": "Require DPoP proofs for issuance endpoints.",
+            "type": "boolean"
+          },
+          "walletAttestationRequired": {
+            "description": "Default wallet attestation requirement for managed authorization servers.",
+            "type": "boolean"
+          },
+          "walletProviderTrustLists": {
+            "description": "Shared wallet provider trust lists for key attestations and default authorization server wallet authentication.",
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": {
+                "trustListId": {
+                  "type": "string",
+                  "minLength": 1
+                },
+                "url": {
+                  "description": "URL of the wallet provider trust list.",
+                  "type": "string",
+                  "format": "uri"
+                },
+                "verifierKey": {
+                  "description": "Optional verifier key material used for trust list verification.",
+                  "type": "object",
+                  "propertyNames": {
+                    "type": "string"
+                  },
+                  "additionalProperties": {}
+                },
+                "verifierX509Der": {
+                  "description": "Optional verifier certificate in DER/base64 form.",
+                  "type": "string"
+                }
+              },
+              "additionalProperties": false
+            }
+          },
+          "signingKeyId": {
+            "description": "Default signing key chain id for credential issuance.",
+            "type": "string",
+            "minLength": 1
+          },
+          "authorizationServers": {
+            "minItems": 1,
+            "type": "array",
+            "items": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "type": {
+                      "type": "string",
+                      "const": "external",
+                      "description": "Use an externally managed authorization server."
+                    },
+                    "id": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Authorization server identifier."
+                    },
+                    "issuer": {
+                      "type": "string",
+                      "format": "uri",
+                      "description": "Issuer URL for the external authorization server."
+                    },
+                    "sessionBinding": {
+                      "description": "Explicit mapping from an external access-token claim to an existing issuance session.",
+                      "type": "object",
+                      "properties": {
+                        "method": {
+                          "type": "string",
+                          "const": "access_token_claim",
+                          "description": "Read the correlation value from a configured access-token claim."
+                        },
+                        "claim": {
+                          "type": "string",
+                          "minLength": 1,
+                          "description": "Claim name that contains the issuance-session correlation value."
+                        }
+                      },
+                      "required": [
+                        "method",
+                        "claim"
+                      ],
+                      "additionalProperties": false
+                    },
+                    "label": {
+                      "description": "Optional display label for UI selection.",
+                      "type": "string"
+                    },
+                    "enabled": {
+                      "description": "Whether this authorization server entry is enabled.",
+                      "type": "boolean"
+                    }
+                  },
+                  "required": [
+                    "type",
+                    "id",
+                    "issuer"
+                  ],
+                  "additionalProperties": false
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "type": {
+                      "type": "string",
+                      "const": "oid4vp",
+                      "description": "Use OID4VP-based authorization server chaining."
+                    },
+                    "id": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Authorization server identifier."
+                    },
+                    "presentationConfigId": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Presentation configuration id used during authorization."
+                    },
+                    "immediateWalletRedirect": {
+                      "description": "Redirect wallets immediately after authorization response creation.",
+                      "type": "boolean"
+                    },
+                    "token": {
+                      "description": "Optional token issuance settings.",
+                      "type": "object",
+                      "properties": {
+                        "lifetimeSeconds": {
+                          "description": "Access token lifetime in seconds.",
+                          "type": "number",
+                          "minimum": 60
+                        },
+                        "signingKeyId": {
+                          "description": "Optional key chain id used to sign issued tokens.",
+                          "type": "string",
+                          "minLength": 1
+                        },
+                        "refreshTokenEnabled": {
+                          "description": "Enable issuing refresh tokens.",
+                          "type": "boolean"
+                        },
+                        "refreshTokenExpiresInSeconds": {
+                          "description": "Refresh token lifetime in seconds.",
+                          "type": "number",
+                          "minimum": 60
+                        }
+                      },
+                      "additionalProperties": false
+                    },
+                    "requireDPoP": {
+                      "description": "Require DPoP proofs for token/credential requests.",
+                      "type": "boolean"
+                    },
+                    "walletAttestationRequired": {
+                      "description": "Require wallet attestation for this authorization server.",
+                      "type": "boolean"
+                    },
+                    "walletProviderTrustLists": {
+                      "description": "Optional wallet provider trust list references for this authorization server.",
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "trustListId": {
+                            "type": "string",
+                            "minLength": 1
+                          },
+                          "url": {
+                            "description": "URL of the wallet provider trust list.",
+                            "type": "string",
+                            "format": "uri"
+                          },
+                          "verifierKey": {
+                            "description": "Optional verifier key material used for trust list verification.",
+                            "type": "object",
+                            "propertyNames": {
+                              "type": "string"
+                            },
+                            "additionalProperties": {}
+                          },
+                          "verifierX509Der": {
+                            "description": "Optional verifier certificate in DER/base64 form.",
+                            "type": "string"
+                          }
+                        },
+                        "additionalProperties": false
+                      }
+                    },
+                    "label": {
+                      "description": "Optional display label for UI selection.",
+                      "type": "string"
+                    },
+                    "enabled": {
+                      "description": "Whether this authorization server entry is enabled.",
+                      "type": "boolean"
+                    }
+                  },
+                  "required": [
+                    "type",
+                    "id",
+                    "presentationConfigId"
+                  ],
+                  "additionalProperties": false
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "type": {
+                      "type": "string",
+                      "const": "chained",
+                      "description": "Use upstream OIDC as authorization source."
+                    },
+                    "id": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Authorization server identifier."
+                    },
+                    "upstream": {
+                      "type": "object",
+                      "properties": {
+                        "issuer": {
+                          "type": "string",
+                          "format": "uri",
+                          "description": "Upstream OIDC issuer URL."
+                        },
+                        "clientId": {
+                          "type": "string",
+                          "minLength": 1,
+                          "description": "Client id for upstream OIDC authentication."
+                        },
+                        "clientSecret": {
+                          "description": "Optional client secret for upstream OIDC authentication.",
+                          "type": "string",
+                          "minLength": 1
+                        },
+                        "scopes": {
+                          "description": "Optional scopes requested from the upstream issuer.",
+                          "type": "array",
+                          "items": {
+                            "type": "string",
+                            "minLength": 1
+                          }
+                        }
+                      },
+                      "required": [
+                        "issuer",
+                        "clientId"
+                      ],
+                      "additionalProperties": false,
+                      "description": "Upstream OIDC connection settings."
+                    },
+                    "token": {
+                      "description": "Optional token issuance settings.",
+                      "type": "object",
+                      "properties": {
+                        "lifetimeSeconds": {
+                          "description": "Access token lifetime in seconds.",
+                          "type": "number",
+                          "minimum": 60
+                        },
+                        "signingKeyId": {
+                          "description": "Optional key chain id used to sign issued tokens.",
+                          "type": "string",
+                          "minLength": 1
+                        },
+                        "refreshTokenEnabled": {
+                          "description": "Enable issuing refresh tokens.",
+                          "type": "boolean"
+                        },
+                        "refreshTokenExpiresInSeconds": {
+                          "description": "Refresh token lifetime in seconds.",
+                          "type": "number",
+                          "minimum": 60
+                        }
+                      },
+                      "additionalProperties": false
+                    },
+                    "requireDPoP": {
+                      "description": "Require DPoP proofs for token/credential requests.",
+                      "type": "boolean"
+                    },
+                    "walletAttestationRequired": {
+                      "description": "Require wallet attestation for this authorization server.",
+                      "type": "boolean"
+                    },
+                    "walletProviderTrustLists": {
+                      "description": "Optional wallet provider trust list references for this authorization server.",
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "trustListId": {
+                            "type": "string",
+                            "minLength": 1
+                          },
+                          "url": {
+                            "description": "URL of the wallet provider trust list.",
+                            "type": "string",
+                            "format": "uri"
+                          },
+                          "verifierKey": {
+                            "description": "Optional verifier key material used for trust list verification.",
+                            "type": "object",
+                            "propertyNames": {
+                              "type": "string"
+                            },
+                            "additionalProperties": {}
+                          },
+                          "verifierX509Der": {
+                            "description": "Optional verifier certificate in DER/base64 form.",
+                            "type": "string"
+                          }
+                        },
+                        "additionalProperties": false
+                      }
+                    },
+                    "label": {
+                      "description": "Optional display label for UI selection.",
+                      "type": "string"
+                    },
+                    "enabled": {
+                      "description": "Whether this authorization server entry is enabled.",
+                      "type": "boolean"
+                    }
+                  },
+                  "required": [
+                    "type",
+                    "id",
+                    "upstream"
+                  ],
+                  "additionalProperties": false
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "type": {
+                      "type": "string",
+                      "const": "built-in",
+                      "description": "Use EUDIPLO built-in authorization server."
+                    },
+                    "id": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Authorization server identifier."
+                    },
+                    "token": {
+                      "description": "Optional token issuance settings.",
+                      "type": "object",
+                      "properties": {
+                        "lifetimeSeconds": {
+                          "description": "Access token lifetime in seconds.",
+                          "type": "number",
+                          "minimum": 60
+                        },
+                        "signingKeyId": {
+                          "description": "Optional key chain id used to sign issued tokens.",
+                          "type": "string",
+                          "minLength": 1
+                        },
+                        "refreshTokenEnabled": {
+                          "description": "Enable issuing refresh tokens.",
+                          "type": "boolean"
+                        },
+                        "refreshTokenExpiresInSeconds": {
+                          "description": "Refresh token lifetime in seconds.",
+                          "type": "number",
+                          "minimum": 60
+                        }
+                      },
+                      "additionalProperties": false
+                    },
+                    "requireDPoP": {
+                      "description": "Require DPoP proofs for token/credential requests.",
+                      "type": "boolean"
+                    },
+                    "walletAttestationRequired": {
+                      "description": "Require wallet attestation for this authorization server.",
+                      "type": "boolean"
+                    },
+                    "walletProviderTrustLists": {
+                      "description": "Optional wallet provider trust list references for this authorization server.",
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "trustListId": {
+                            "type": "string",
+                            "minLength": 1
+                          },
+                          "url": {
+                            "description": "URL of the wallet provider trust list.",
+                            "type": "string",
+                            "format": "uri"
+                          },
+                          "verifierKey": {
+                            "description": "Optional verifier key material used for trust list verification.",
+                            "type": "object",
+                            "propertyNames": {
+                              "type": "string"
+                            },
+                            "additionalProperties": {}
+                          },
+                          "verifierX509Der": {
+                            "description": "Optional verifier certificate in DER/base64 form.",
+                            "type": "string"
+                          }
+                        },
+                        "additionalProperties": false
+                      }
+                    },
+                    "label": {
+                      "description": "Optional display label for UI selection.",
+                      "type": "string"
+                    },
+                    "enabled": {
+                      "description": "Whether this authorization server entry is enabled.",
+                      "type": "boolean"
+                    }
+                  },
+                  "required": [
+                    "type",
+                    "id"
+                  ],
+                  "additionalProperties": false
+                }
+              ],
+              "description": "Supported authorization server configurations."
+            },
+            "description": "Configured authorization server entries."
+          },
+          "federation": {
+            "description": "Optional OpenID Federation settings.",
+            "anyOf": [
+              {
+                "type": "object",
+                "properties": {
+                  "role": {
+                    "description": "Federation role for this issuer.",
+                    "type": "string",
+                    "enum": [
+                      "trust_anchor",
+                      "intermediate",
+                      "leaf"
+                    ]
+                  },
+                  "mode": {
+                    "description": "Federation operation mode.",
+                    "type": "string",
+                    "enum": [
+                      "federation-only",
+                      "hybrid"
+                    ]
+                  },
+                  "entityId": {
+                    "description": "Optional local federation entity id.",
+                    "type": "string"
+                  },
+                  "enforceSigningPolicy": {
+                    "description": "Enforce strict signing policy checks.",
+                    "type": "boolean"
+                  },
+                  "cacheTtlSeconds": {
+                    "description": "Cache time-to-live for federation metadata in seconds.",
+                    "type": "integer",
+                    "minimum": 1,
+                    "maximum": 9007199254740991
+                  },
+                  "trustAnchors": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "entityId": {
+                          "type": "string",
+                          "minLength": 1,
+                          "description": "Federation trust anchor entity id."
+                        },
+                        "entityConfigurationUri": {
+                          "type": "string",
+                          "format": "uri",
+                          "description": "Entity configuration URI for the trust anchor."
+                        }
+                      },
+                      "required": [
+                        "entityId",
+                        "entityConfigurationUri"
+                      ],
+                      "additionalProperties": false
+                    },
+                    "description": "Federation trust anchors."
+                  }
+                },
+                "required": [
+                  "trustAnchors"
+                ],
+                "additionalProperties": false
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "registrationCertificate": {
+            "description": "Optional registration certificate settings.",
+            "anyOf": [
+              {
+                "type": "object",
+                "properties": {
+                  "enabled": {
+                    "description": "Enable issuer registration certificate support.",
+                    "type": "boolean"
+                  },
+                  "mode": {
+                    "description": "How registration certificate data is provided.",
+                    "type": "string",
+                    "enum": [
+                      "import",
+                      "generate"
+                    ]
+                  },
+                  "jwt": {
+                    "description": "Optional registration certificate JWT when using import mode.",
+                    "type": "string"
+                  },
+                  "privacyPolicy": {
+                    "description": "Optional privacy policy URI.",
+                    "type": "string"
+                  },
+                  "supportUri": {
+                    "description": "Optional support URI.",
+                    "type": "string"
+                  }
+                },
+                "additionalProperties": false
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "display": {
+            "description": "Localized issuer metadata shown to wallets.",
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "description": "Issuer display name.",
+                  "type": "string"
+                },
+                "locale": {
+                  "description": "Locale tag for this display entry.",
+                  "type": "string"
+                },
+                "logo": {
+                  "description": "Optional issuer logo metadata.",
+                  "type": "object",
+                  "properties": {
+                    "uri": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Logo URI."
+                    },
+                    "alt_text": {
+                      "description": "Optional localized alternative text.",
+                      "type": "string"
+                    }
+                  },
+                  "required": [
+                    "uri"
+                  ],
+                  "additionalProperties": {}
+                }
+              },
+              "additionalProperties": {}
+            }
+          },
+          "notificationEndpointEnabled": {
+            "description": "Whether the OID4VCI notification endpoint is exposed for this issuance configuration.",
+            "type": "boolean"
+          },
+          "credentialResponseEncryption": {
+            "description": "Enable encrypted credential responses.",
+            "type": "boolean"
+          },
+          "credentialRequestEncryption": {
+            "description": "Require encrypted credential requests.",
+            "type": "boolean"
+          },
+          "txCodeMaxAttempts": {
+            "description": "Maximum verification attempts for transaction codes. Null resets to defaults.",
+            "anyOf": [
+              {
+                "type": "integer",
+                "minimum": 1,
+                "maximum": 9007199254740991
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "offerLifetimeSeconds": {
+            "description": "Default lifetime of credential offers in seconds. Can be overridden per offer request. Null or unset: offers do not expire.",
+            "anyOf": [
+              {
+                "type": "integer",
+                "minimum": 1,
+                "maximum": 9007199254740991
+              },
+              {
+                "type": "null"
+              }
+            ]
+          }
+        },
+        "required": [
+          "authorizationServers"
+        ],
+        "additionalProperties": false,
+        "title": "IssuanceConfig"
+      }
+    }
+  },
+  {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://eudiplo.dev/schemas/v2/PresentationConfigFile.schema.json",
+    "title": "PresentationConfigFile",
+    "type": "object",
+    "properties": {
+      "$schema": {
+        "type": "string",
+        "const": "https://eudiplo.dev/schemas/v2/PresentationConfigFile.schema.json"
+      },
+      "metadata": {
+        "type": "object",
+        "properties": {
+          "generation": {
+            "type": "integer",
+            "minimum": 1,
+            "description": "Monotonically increasing configuration generation."
+          },
+          "ownership": {
+            "type": "string",
+            "enum": [
+              "unmanaged",
+              "file-managed"
+            ],
+            "description": "Requested ownership recorded when the document is applied."
+          }
+        },
+        "additionalProperties": false
+      },
+      "spec": {
+        "allOf": [
+          {
+            "$ref": "#/$defs/PresentationConfigCreateDto"
+          },
+          {
+            "type": "object",
+            "required": [
+              "id"
+            ],
+            "properties": {
+              "id": {
+                "type": "string",
+                "minLength": 1
+              }
+            }
+          }
+        ]
+      }
+    },
+    "required": [
+      "$schema",
+      "spec"
+    ],
+    "additionalProperties": false,
+    "$defs": {
+      "PresentationConfigCreateDto": {
+        "type": "object",
+        "properties": {
+          "id": {
+            "type": "string",
+            "minLength": 1,
+            "description": "Presentation configuration identifier."
+          },
+          "description": {
+            "description": "Optional presentation configuration description.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "lifeTime": {
+            "description": "Presentation request lifetime in seconds.",
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 9007199254740991
+          },
+          "skewSeconds": {
+            "description": "Clock skew tolerance in seconds.",
+            "type": "integer",
+            "minimum": 0,
+            "maximum": 9007199254740991
+          },
+          "statusCheckMode": {
+            "description": "Revocation/status check mode.",
+            "type": "string",
+            "enum": [
+              "strict",
+              "best_effort",
+              "disabled"
+            ]
+          },
+          "dcql_query": {
+            "type": "object",
+            "properties": {
+              "credentials": {
+                "minItems": 1,
+                "type": "array",
+                "items": {
+                  "oneOf": [
+                    {
+                      "type": "object",
+                      "properties": {
+                        "id": {
+                          "type": "string",
+                          "minLength": 1,
+                          "pattern": "^[A-Za-z0-9_-]+$",
+                          "description": "Credential query identifier."
+                        },
+                        "multiple": {
+                          "description": "Allow multiple matching credentials.",
+                          "type": "boolean"
+                        },
+                        "claim_sets": {
+                          "description": "Optional claim set constraints.",
+                          "type": "array",
+                          "items": {
+                            "type": "array",
+                            "items": {
+                              "type": "string"
+                            }
+                          }
+                        },
+                        "trusted_authorities": {
+                          "description": "Optional trusted authority constraints.",
+                          "type": "array",
+                          "items": {
+                            "oneOf": [
+                              {
+                                "type": "object",
+                                "properties": {
+                                  "type": {
+                                    "type": "string",
+                                    "const": "etsi_tl",
+                                    "description": "Trusted authority type discriminator for ETSI trust lists."
+                                  },
+                                  "values": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "object",
+                                      "properties": {
+                                        "trustListId": {
+                                          "description": "Optional trust list id reference.",
+                                          "type": "string"
+                                        },
+                                        "url": {
+                                          "description": "Optional trust list URL reference.",
+                                          "anyOf": [
+                                            {
+                                              "type": "string",
+                                              "format": "uri"
+                                            },
+                                            {
+                                              "type": "string",
+                                              "pattern": "^<TENANT_URL>(?:\\/.*)?$"
+                                            }
+                                          ]
+                                        },
+                                        "verifierKey": {
+                                          "description": "Optional verifier key material.",
+                                          "type": "object",
+                                          "propertyNames": {
+                                            "type": "string"
+                                          },
+                                          "additionalProperties": {}
+                                        },
+                                        "verifierX509Der": {
+                                          "description": "Optional verifier certificate in DER/base64 form.",
+                                          "type": "string"
+                                        }
+                                      },
+                                      "additionalProperties": false
+                                    },
+                                    "description": "Trust list references for ETSI TL verification."
+                                  }
+                                },
+                                "required": [
+                                  "type",
+                                  "values"
+                                ],
+                                "additionalProperties": false
+                              },
+                              {
+                                "type": "object",
+                                "properties": {
+                                  "type": {
+                                    "type": "string",
+                                    "const": "openid_federation",
+                                    "description": "Trusted authority type discriminator for OpenID Federation."
+                                  },
+                                  "values": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "string"
+                                    },
+                                    "description": "OpenID Federation authority identifiers."
+                                  }
+                                },
+                                "required": [
+                                  "type",
+                                  "values"
+                                ],
+                                "additionalProperties": false
+                              }
+                            ]
+                          }
+                        },
+                        "format": {
+                          "type": "string",
+                          "const": "dc+sd-jwt",
+                          "description": "Credential format discriminator."
+                        },
+                        "meta": {
+                          "type": "object",
+                          "properties": {
+                            "vct_values": {
+                              "minItems": 1,
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "description": "Accepted VCT values."
+                            }
+                          },
+                          "required": [
+                            "vct_values"
+                          ],
+                          "additionalProperties": false
+                        },
+                        "claims": {
+                          "description": "Optional claim-level constraints.",
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "id": {
+                                "description": "Optional claim query id.",
+                                "type": "string"
+                              },
+                              "path": {
+                                "type": "array",
+                                "items": {
+                                  "type": [
+                                    "string",
+                                    "number"
+                                  ]
+                                },
+                                "description": "Path to the claim value in presented credentials."
+                              },
+                              "values": {
+                                "description": "Optional allowed values for the claim.",
+                                "type": "array",
+                                "items": {
+                                  "type": "string"
+                                }
+                              }
+                            },
+                            "required": [
+                              "path"
+                            ],
+                            "additionalProperties": false
+                          }
+                        }
+                      },
+                      "required": [
+                        "id",
+                        "format",
+                        "meta"
+                      ],
+                      "additionalProperties": false
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "id": {
+                          "type": "string",
+                          "minLength": 1,
+                          "pattern": "^[A-Za-z0-9_-]+$",
+                          "description": "Credential query identifier."
+                        },
+                        "multiple": {
+                          "description": "Allow multiple matching credentials.",
+                          "type": "boolean"
+                        },
+                        "claim_sets": {
+                          "description": "Optional claim set constraints.",
+                          "type": "array",
+                          "items": {
+                            "type": "array",
+                            "items": {
+                              "type": "string"
+                            }
+                          }
+                        },
+                        "trusted_authorities": {
+                          "description": "Optional trusted authority constraints.",
+                          "type": "array",
+                          "items": {
+                            "oneOf": [
+                              {
+                                "type": "object",
+                                "properties": {
+                                  "type": {
+                                    "type": "string",
+                                    "const": "etsi_tl",
+                                    "description": "Trusted authority type discriminator for ETSI trust lists."
+                                  },
+                                  "values": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "object",
+                                      "properties": {
+                                        "trustListId": {
+                                          "description": "Optional trust list id reference.",
+                                          "type": "string"
+                                        },
+                                        "url": {
+                                          "description": "Optional trust list URL reference.",
+                                          "anyOf": [
+                                            {
+                                              "type": "string",
+                                              "format": "uri"
+                                            },
+                                            {
+                                              "type": "string",
+                                              "pattern": "^<TENANT_URL>(?:\\/.*)?$"
+                                            }
+                                          ]
+                                        },
+                                        "verifierKey": {
+                                          "description": "Optional verifier key material.",
+                                          "type": "object",
+                                          "propertyNames": {
+                                            "type": "string"
+                                          },
+                                          "additionalProperties": {}
+                                        },
+                                        "verifierX509Der": {
+                                          "description": "Optional verifier certificate in DER/base64 form.",
+                                          "type": "string"
+                                        }
+                                      },
+                                      "additionalProperties": false
+                                    },
+                                    "description": "Trust list references for ETSI TL verification."
+                                  }
+                                },
+                                "required": [
+                                  "type",
+                                  "values"
+                                ],
+                                "additionalProperties": false
+                              },
+                              {
+                                "type": "object",
+                                "properties": {
+                                  "type": {
+                                    "type": "string",
+                                    "const": "openid_federation",
+                                    "description": "Trusted authority type discriminator for OpenID Federation."
+                                  },
+                                  "values": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "string"
+                                    },
+                                    "description": "OpenID Federation authority identifiers."
+                                  }
+                                },
+                                "required": [
+                                  "type",
+                                  "values"
+                                ],
+                                "additionalProperties": false
+                              }
+                            ]
+                          }
+                        },
+                        "format": {
+                          "type": "string",
+                          "const": "mso_mdoc",
+                          "description": "Credential format discriminator."
+                        },
+                        "meta": {
+                          "type": "object",
+                          "properties": {
+                            "doctype_value": {
+                              "type": "string",
+                              "minLength": 1,
+                              "description": "Expected mDoc doctype value."
+                            }
+                          },
+                          "required": [
+                            "doctype_value"
+                          ],
+                          "additionalProperties": false
+                        },
+                        "claims": {
+                          "description": "Optional mDoc claim-level constraints.",
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "id": {
+                                "description": "Optional claim query id.",
+                                "type": "string"
+                              },
+                              "path": {
+                                "type": "array",
+                                "items": {
+                                  "type": [
+                                    "string",
+                                    "number"
+                                  ]
+                                },
+                                "description": "Path to the claim value in presented credentials."
+                              },
+                              "values": {
+                                "description": "Optional allowed values for the claim.",
+                                "type": "array",
+                                "items": {
+                                  "type": "string"
+                                }
+                              },
+                              "intent_to_retain": {
+                                "description": "Whether relying party intends to retain the claim.",
+                                "type": "boolean"
+                              }
+                            },
+                            "required": [
+                              "path"
+                            ],
+                            "additionalProperties": false
+                          }
+                        }
+                      },
+                      "required": [
+                        "id",
+                        "format",
+                        "meta"
+                      ],
+                      "additionalProperties": false
+                    }
+                  ]
+                },
+                "description": "Credential queries requested by the verifier."
+              },
+              "credential_sets": {
+                "description": "Optional higher-level credential set requirements.",
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "options": {
+                      "minItems": 1,
+                      "type": "array",
+                      "items": {
+                        "minItems": 1,
+                        "type": "array",
+                        "items": {
+                          "type": "string"
+                        }
+                      },
+                      "description": "Alternative credential query id combinations."
+                    },
+                    "required": {
+                      "description": "Whether this credential set is mandatory.",
+                      "type": "boolean"
+                    }
+                  },
+                  "required": [
+                    "options"
+                  ],
+                  "additionalProperties": false
+                }
+              }
+            },
+            "required": [
+              "credentials"
+            ],
+            "additionalProperties": false,
+            "description": "DCQL query defining requested credentials and claims."
+          },
+          "transaction_data": {
+            "description": "Optional transaction data descriptors.",
+            "anyOf": [
+              {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "type": {
+                      "type": "string",
+                      "description": "Transaction data type identifier."
+                    },
+                    "credential_ids": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "description": "Credential query ids this transaction data applies to."
+                    },
+                    "payload": {
+                      "description": "Transaction details. Required for TS12 SCA transaction data."
+                    }
+                  },
+                  "required": [
+                    "type",
+                    "credential_ids"
+                  ],
+                  "additionalProperties": {}
+                }
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "registration_cert": {
+            "description": "Optional registration certificate request settings.",
+            "anyOf": [
+              {
+                "type": "object",
+                "properties": {
+                  "id": {
+                    "type": "string"
+                  },
+                  "body": {
+                    "type": "object",
+                    "properties": {
+                      "privacy_policy": {
+                        "type": "string"
+                      },
+                      "support_uri": {
+                        "type": "string"
+                      },
+                      "intermediary": {
+                        "type": "string"
+                      },
+                      "purpose": {
+                        "type": "array",
+                        "items": {
+                          "type": "object",
+                          "properties": {
+                            "lang": {
+                              "type": "string"
+                            },
+                            "content": {
+                              "type": "string"
+                            }
+                          },
+                          "required": [
+                            "lang",
+                            "content"
+                          ],
+                          "additionalProperties": false
+                        }
+                      },
+                      "credentials": {
+                        "type": "array",
+                        "items": {
+                          "type": "object",
+                          "propertyNames": {
+                            "type": "string"
+                          },
+                          "additionalProperties": {}
+                        }
+                      },
+                      "provides_attestations": {
+                        "type": "array",
+                        "items": {
+                          "type": "string",
+                          "minLength": 1
+                        }
+                      }
+                    },
+                    "additionalProperties": false
+                  },
+                  "jwt": {
+                    "type": "string"
+                  }
+                },
+                "additionalProperties": false
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "registrationCertImportJwt": {
+            "description": "Optional imported registration certificate JWT.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "registrationCertImportId": {
+            "description": "Optional registrar-side registration certificate id.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "registrationCertBodyPrivacyPolicy": {
+            "description": "Optional registration certificate privacy policy URI.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "registrationCertBodySupportUri": {
+            "description": "Optional registration certificate support URI.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "registrationCertBodyIntermediary": {
+            "description": "Optional registration certificate intermediary.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "registrationCertBodyPurpose": {
+            "description": "Optional registration certificate purpose entries.",
+            "anyOf": [
+              {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "lang": {
+                      "type": "string"
+                    },
+                    "content": {
+                      "type": "string"
+                    }
+                  },
+                  "additionalProperties": false
+                }
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "webhookEndpointId": {
+            "description": "Optional webhook endpoint id for presentation callbacks.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "attached": {
+            "description": "Optional attachments included with presentation requests.",
+            "anyOf": [
+              {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "format": {
+                      "type": "string",
+                      "description": "Attachment format identifier."
+                    },
+                    "data": {
+                      "description": "Attachment payload."
+                    },
+                    "credential_ids": {
+                      "description": "Optional credential query ids bound to this attachment.",
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      }
+                    }
+                  },
+                  "required": [
+                    "format",
+                    "data"
+                  ],
+                  "additionalProperties": false
+                }
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "redirectUri": {
+            "description": "Optional redirect URI after presentation completion.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "accessKeyChainId": {
+            "description": "Optional key chain id for access token/auth operations.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "readerAuth": {
+            "description": "Whether reader authentication is required for mDoc requests.",
+            "type": [
+              "boolean",
+              "null"
+            ]
+          }
+        },
+        "required": [
+          "id",
+          "dcql_query"
+        ],
+        "additionalProperties": false,
+        "title": "PresentationConfigCreateDto"
+      }
+    }
+  }
+];
+
+// ../../packages/eudiplo-config-format/dist/config-validator.js
+var ajv = new import__.Ajv2020({
+  allErrors: true,
+  strict: false,
+  validateFormats: false
+});
+for (const schema of CONFIG_SCHEMAS)
+  ajv.addSchema(schema);
+function validateConfigDocument(document) {
+  const file = serializeDocument(document);
+  const validate = ajv.getSchema(file.$schema);
+  if (!validate)
+    throw new Error(`No bundled validator for ${file.$schema}`);
+  const issues = [];
+  if (!validate(file)) {
+    for (const issue of validate.errors ?? [])
+      issues.push({
+        severity: "error",
+        code: "CONFIG_SCHEMA_VALIDATION_FAILED",
+        path: issue.instancePath || "/",
+        message: issue.keyword === "additionalProperties" ? `Unknown property: ${String(issue.params.additionalProperty)}` : issue.message ?? "Invalid configuration",
+        resource: { kind: document.kind, id: resourceId(document) }
+      });
+  }
+  const id = document.kind === "Client" ? document.spec.clientId : document.spec.id;
+  if (id !== void 0 && id !== resourceId(document))
+    issues.push({
+      severity: "error",
+      code: "RESOURCE_ID_MISMATCH",
+      path: document.kind === "Client" ? "/spec/clientId" : "/spec/id",
+      message: "Resource identifier does not match metadata.id"
+    });
+  return issues;
+}
+
+// src/commands/config/portability/migrations.ts
+function upgradeDocument(input) {
+  const result = migrateDocument(input, validateConfigDocument);
+  return { ...result, document: serializeDocument(result.document) };
+}
+
+// src/commands/config/portability/upgrade.ts
+var codec = new ConfigBundleCodec();
+function parse3(text, path2) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new Error(`Invalid JSON in ${path2}`);
+  }
+}
+function upgradeJson(input, file, context) {
+  const bundle = Array.isArray(input?.documents);
+  if (bundle) assertConfigBundle(input);
+  const results = (bundle ? input.documents : [input]).map(
+    (document) => upgradeDocument(document)
+  );
+  let blocked = false;
+  for (const result of results) {
+    for (const issue of result.issues) {
+      context.stderr.write(
+        `${file}${issue.path}: ${issue.severity} ${issue.code}: ${issue.message}
+`
+      );
+      if (issue.severity !== "warning") blocked = true;
+    }
+    for (const migration of result.migrations)
+      context.stdout.write(`${file}: migration ${migration}
+`);
+  }
+  if (blocked) throw new Error(`${file}: upgrade blocked; no output written`);
+  if (!bundle) return results[0].document;
+  const documents = results.map(
+    (result) => result.document
+  );
+  const resources = input.manifest.resources.map(
+    (resource) => {
+      const index = input.documents.findIndex(
+        (candidate) => normalizeDocument(candidate).kind === resource.kind && resourceId(candidate) === resource.id
+      );
+      const document = documents[index];
+      return {
+        ...resource,
+        id: resourceId(document),
+        $schema: document.$schema,
+        sha256: createHash2("sha256").update(JSON.stringify(document)).digest("hex")
+      };
+    }
+  );
+  const output = {
+    ...input,
+    manifest: { ...input.manifest, formatVersion: 2, resources },
+    documents
+  };
+  assertConfigBundle(output);
+  return output;
+}
+function report(input, output, file, parsed, context) {
+  const changed = stableConfigJson(input) !== stableConfigJson(output);
+  context.stdout.write(
+    `${file}: ${changed ? "upgrade required" : "current"}
+`
+  );
+  if (parsed.flags.diff === true)
+    for (const change of configChanges(input, output)) {
+      context.stdout.write(
+        `  ${change.path}: ${JSON.stringify(change.before) ?? "(absent)"} -> ${JSON.stringify(change.after) ?? "(absent)"}
+`
+      );
+    }
+  return changed;
+}
+function inferredKind(path2) {
+  const normalized = path2.split(sep2).join("/");
+  const match = TENANT_RESOURCE_REGISTRY.find(
+    (entry) => entry.kind === "file" ? normalized === entry.file || normalized.endsWith(`/${entry.file}`) : normalized.endsWith(`/${entry.subfolder}/${basename2(path2)}`) || normalized === `${entry.subfolder}/${basename2(path2)}`
+  );
+  return CONFIG_RESOURCE_KINDS.find(
+    (kind) => `${CONFIG_FORMATS[kind].file}.schema.json` === match?.schemaFile
+  );
+}
+function wrapBare(kind, input, path2) {
+  if (!input || typeof input !== "object" || Array.isArray(input))
+    throw new Error(`${path2}: configuration must be an object`);
+  const singleton = {
+    Tenant: "tenant",
+    KmsConfig: "kms",
+    RegistrarConfig: "registrar",
+    IssuanceConfig: "issuance"
+  };
+  const spec = structuredClone(input);
+  if (kind === "KeyChain" && spec.key && !spec.keySource) {
+    spec.keySource = { type: "private-jwk", jwk: spec.key };
+    delete spec.key;
+  }
+  const id = String(
+    singleton[kind] ?? spec.id ?? spec.clientId ?? basename2(path2, ".json")
+  );
+  if (!singleton[kind]) spec[kind === "Client" ? "clientId" : "id"] = id;
+  return { $schema: schemaUrl(kind, 1), metadata: { generation: 1 }, spec };
+}
+async function folderFiles(path2) {
+  const files = [];
+  for (const entry of await readdir(path2, { withFileTypes: true })) {
+    if (entry.name.startsWith(".")) continue;
+    const file = join4(path2, entry.name);
+    if (entry.isSymbolicLink())
+      throw new Error(`Config folder contains a symbolic link: ${file}`);
+    if (entry.isDirectory()) files.push(...await folderFiles(file));
+    else if (entry.isFile()) files.push(file);
+  }
+  return files.sort();
+}
+async function upgradeFolder(source, parsed, context) {
+  const outputs = /* @__PURE__ */ new Map();
+  let changed = 0;
+  for (const file of await folderFiles(source)) {
+    if (extname(file) !== ".json" || relative2(source, file).split(sep2).includes("images"))
+      continue;
+    const input = parse3(await readFile4(file, "utf8"), file);
+    const kind = inferredKind(relative2(source, file));
+    if (!kind && !isConfigDocument(input)) continue;
+    const candidate = isConfigDocument(input) ? input : wrapBare(kind, input, file);
+    const output = upgradeJson(candidate, file, context);
+    if (kind && normalizeDocument(output).kind !== kind)
+      throw new Error(`${file}: expected ${kind} configuration`);
+    if (report(input, output, relative2(source, file), parsed, context))
+      changed++;
+    outputs.set(
+      relative2(source, file),
+      `${JSON.stringify(output, null, 2)}
+`
+    );
+  }
+  if (!outputs.size)
+    throw new Error(`No configuration documents found in ${source}`);
+  context.stdout.write(
+    `${outputs.size - changed} current, ${changed} require upgrading
+`
+  );
+  if (parsed.flags.check === true) return changed ? 1 : 0;
+  if (parsed.flags["dry-run"] === true) return 0;
+  const destination = resolve3(
+    context.cwd,
+    readStringFlag(parsed.flags, "output") ?? `${source}.upgraded`
+  );
+  const overlap = (parent, child) => {
+    const path2 = relative2(parent, child);
+    return path2 === "" || !path2.startsWith(`..${sep2}`) && path2 !== "..";
+  };
+  if (overlap(source, destination) || overlap(destination, source))
+    throw new Error(
+      "Folder output must be separate from the source directory"
+    );
+  await lstat(destination).then(
+    () => {
+      throw new Error(`Output already exists: ${destination}`);
+    },
+    (error) => {
+      if (error.code !== "ENOENT") throw error;
+    }
+  );
+  await mkdir3(dirname3(destination), { recursive: true });
+  const staging = await mkdtemp(
+    join4(dirname3(destination), ".eudiplo-upgrade-")
+  );
+  try {
+    await cp(source, staging, {
+      recursive: true,
+      filter: (path2) => path2 === source || !relative2(source, path2).split(sep2).some((part) => part.startsWith("."))
+    });
+    for (const [path2, contents] of outputs)
+      await atomicWriteFile(join4(staging, path2), contents);
+    await rename2(staging, destination);
+    context.stdout.write(
+      `Wrote upgraded configuration folder to ${destination}
+`
+    );
+  } finally {
+    await rm(staging, { recursive: true, force: true });
+  }
+  return 0;
+}
+async function upgradeFile(parsed, context) {
+  const name = parsed.positionals[0];
   if (!name)
     throw new Error("Usage: eudiplo config upgrade <file-or-folder>");
   const source = resolve3(context.cwd, name);
@@ -20568,14 +22007,11 @@ function createComposeEnv(options) {
     `AUTH_CLIENT_ID=${escapeEnvValue(authClientId)}`,
     `AUTH_CLIENT_SECRET=${escapeEnvValue(authClientSecret)}`
   ];
-  lines.push(
-    "",
-    ...databaseEnv(database),
-    "",
-    ...storageEnv(storage),
-    "",
-    ...kmsEnv(kms)
-  );
+  lines.push("", ...databaseEnv(database), "", ...storageEnv(storage));
+  const kmsLines = kmsEnv(kms);
+  if (kmsLines.length > 0) {
+    lines.push("", ...kmsLines);
+  }
   return `${lines.join("\n")}
 `;
 }
@@ -20638,13 +22074,9 @@ function storageEnv(storage) {
 }
 function kmsEnv(kms) {
   if (kms === "db") {
-    return ["KM_TYPE=db"];
+    return [];
   }
-  return [
-    "KM_TYPE=vault",
-    "VAULT_ADDR=http://vault:8200",
-    "VAULT_TOKEN=root"
-  ];
+  return ["VAULT_ADDR=http://vault:8200", "VAULT_TOKEN=root"];
 }
 function randomSecret() {
   return randomBytes(24).toString("base64url");
@@ -21031,7 +22463,10 @@ async function validateResourceFile(filePath, relativeFile, schemaFile, getValid
         delete spec.key;
       }
       if (!CONFIG_SINGLETON_IDS[kind])
-        spec[kind === "Client" ? "clientId" : "id"] ??= basename4(relativeFile, ".json");
+        spec[kind === "Client" ? "clientId" : "id"] ??= basename4(
+          relativeFile,
+          ".json"
+        );
       resolved = {
         $schema: schemaUrl(kind),
         metadata: { generation: 1 },
@@ -22726,7 +24161,7 @@ function createDeploymentCommands(context, setExitCode) {
 // package.json
 var package_default = {
   name: "@eudiplo/cli",
-  version: "8.1.0-main.a6a67b3",
+  version: "8.1.0-main.b98cc00",
   description: "Deployment-aware command line tools for EUDIPLO",
   private: false,
   type: "module",
@@ -22746,8 +24181,10 @@ var package_default = {
     "build:sea:bundle": "pnpm assets:sync && pnpm assets:check && esbuild src/index.ts --bundle --platform=node --format=esm --target=node22.12 --alias:jsonc-parser=jsonc-parser/lib/esm/main.js --outfile=dist-sea/index.js",
     "build:sea": "node scripts/build-cli-sea.mjs",
     dev: "tsx src/index.ts",
-    test: "vitest run --project cli",
+    test: "vitest run --root ../.. --project cli",
     lint: "biome lint .",
+    format: "biome format --write .",
+    "format:check": "biome format .",
     prepublishOnly: "pnpm build:publish"
   },
   keywords: [
@@ -22789,7 +24226,7 @@ var package_default = {
     esbuild: "^0.28.2",
     tsx: "^4.23.13",
     typescript: "^7.0.2",
-    vitest: "4.1.11"
+    vitest: "5.0.2"
   }
 };
 
@@ -23056,7 +24493,7 @@ var apiReachabilityCheck = {
   run: ({ baseUrl, context }) => requireBaseUrl(
     "API reachability",
     baseUrl,
-    (url) => checkEndpoint("API reachability", url, "/api/docs", context)
+    (url) => checkEndpoint("API reachability", url, "api/docs", context)
   )
 };
 var healthEndpointCheck = {
@@ -23064,7 +24501,7 @@ var healthEndpointCheck = {
   run: ({ baseUrl, context }) => requireBaseUrl(
     "health endpoint",
     baseUrl,
-    (url) => checkEndpoint("health endpoint", url, "/health", context)
+    (url) => checkEndpoint("health endpoint", url, "health", context)
   )
 };
 var tlsCertificateCheck = {
@@ -23104,7 +24541,7 @@ var clientConnectivityCheck = {
         message: `${instance.clientUrl} is not a valid absolute URL`
       };
     }
-    return checkEndpoint("client connectivity", clientUrl, "/", context);
+    return checkEndpoint("client connectivity", clientUrl, "", context);
   }
 };
 var versionCompatibilityCheck = {
@@ -23115,7 +24552,7 @@ var versionCompatibilityCheck = {
       return authUnavailable("version compatibility", token);
     }
     const response = await fetchAuthenticated(
-      new URL("version", withTrailingSlash(url)),
+      new URL("api/version", withTrailingSlash(url)),
       token.accessToken,
       context
     );
@@ -23124,7 +24561,7 @@ var versionCompatibilityCheck = {
         return {
           name: "version compatibility",
           status: "skip",
-          message: "This backend does not expose /version, so compatibility cannot be checked."
+          message: "This backend does not expose /api/version, so compatibility cannot be checked."
         };
       }
       return {
@@ -23152,7 +24589,10 @@ var kmsHealthCheck = {
       return authUnavailable("KMS providers", token);
     }
     const response = await fetchAuthenticated(
-      new URL("key-chain/providers/health", withTrailingSlash(url)),
+      new URL(
+        "api/key-chain/providers/health",
+        withTrailingSlash(url)
+      ),
       token.accessToken,
       context
     );
@@ -23262,7 +24702,7 @@ async function requireBaseUrl(name, baseUrl, run) {
   return run(baseUrl);
 }
 async function checkEndpoint(name, baseUrl, path2, context) {
-  const url = new URL(path2, baseUrl);
+  const url = new URL(path2, withTrailingSlash(baseUrl));
   try {
     const response = await context.fetch(url, { method: "GET" });
     if (response.ok) {
@@ -23743,7 +25183,9 @@ function runInstanceList(config, context) {
 function runInstanceShow(config, parsed, context) {
   const name = parsed.positionals[0] ?? config.defaultInstance;
   if (!name) {
-    throw new Error("No instance selected. Specify a name or add an instance first.");
+    throw new Error(
+      "No instance selected. Specify a name or add an instance first."
+    );
   }
   const instance = config.instances[name];
   if (!instance) {
@@ -24134,7 +25576,7 @@ function parseVersion(tag) {
 function compareVersions2(a, b) {
   return a.major - b.major || a.minor - b.minor || a.patch - b.patch;
 }
-var migrationBaseUrl = "https://docs.eudiplo.dev/migration";
+var migrationBaseUrl = "https://docs.eudiplo.dev/upgrade";
 function migrationNotes(from, to) {
   const fromVersion = parseVersion(from);
   const toVersion = parseVersion(to);
@@ -24380,7 +25822,7 @@ function createProgram(context, setExitCode) {
     "Print the installed CLI version"
   ).helpCommand(true).addHelpText(
     "afterAll",
-    "\nFor more information, see https://docs.eudiplo.dev/getting-started/quick-start"
+    "\nFor more information, see https://docs.eudiplo.dev/cookbooks/foundation"
   );
   program2.addCommand(createDemoCommand(context, setExitCode));
   program2.addCommand(createInitCommand(context, setExitCode));