@eudiplo/cli 9.0.0-main.1d44ec5 → 9.0.0-main.22d3602

package/dist/index.js

@@ -14909,7 +14909,7 @@ var CONFIG_FORMATS = {
   IssuanceConfig: {
     slug: "issuance-config",
     file: "IssuanceConfigFile",
-    version: 2
+    version: 3
   },
   CredentialConfig: {
     slug: "credential-config",
@@ -14992,6 +14992,15 @@ var CONFIG_MIGRATIONS = [
     // valid v2 spec whose offers keep having no lifetime.
     migrate: (spec) => ({ spec })
   },
+  {
+    id: "issuance-config-v3-trust-list-verifier-pem",
+    kind: "IssuanceConfig",
+    from: 2,
+    to: 3,
+    // v3 only adds the optional verifierKeyPem to wallet provider trust
+    // list references: a v2 spec is a valid v3 spec.
+    migrate: (spec) => ({ spec })
+  },
   presentationConfigV1ToV2,
   {
     id: "presentation-config-v3-typed-claim-values",
@@ -21466,13 +21475,13 @@ var CONFIG_SCHEMAS = [
   },
   {
     "$schema": "https://json-schema.org/draft/2020-12/schema",
-    "$id": "https://eudiplo.dev/schemas/v3/PresentationConfigFile.schema.json",
-    "title": "PresentationConfigFile",
+    "$id": "https://eudiplo.dev/schemas/v3/IssuanceConfigFile.schema.json",
+    "title": "IssuanceConfigFile",
     "type": "object",
     "properties": {
       "$schema": {
         "type": "string",
-        "const": "https://eudiplo.dev/schemas/v3/PresentationConfigFile.schema.json"
+        "const": "https://eudiplo.dev/schemas/v3/IssuanceConfigFile.schema.json"
       },
       "metadata": {
         "type": "object",
@@ -21494,23 +21503,7 @@ var CONFIG_SCHEMAS = [
         "additionalProperties": false
       },
       "spec": {
-        "allOf": [
-          {
-            "$ref": "#/$defs/PresentationConfigCreateDto"
-          },
-          {
-            "type": "object",
-            "required": [
-              "id"
-            ],
-            "properties": {
-              "id": {
-                "type": "string",
-                "minLength": 1
-              }
-            }
-          }
-        ]
+        "$ref": "#/$defs/IssuanceConfig"
       }
     },
     "required": [
@@ -21519,76 +21512,787 @@ var CONFIG_SCHEMAS = [
     ],
     "additionalProperties": false,
     "$defs": {
-      "PresentationConfigCreateDto": {
+      "IssuanceConfig": {
         "type": "object",
         "properties": {
-          "id": {
-            "type": "string",
-            "minLength": 1,
-            "description": "Presentation configuration identifier."
-          },
-          "description": {
-            "description": "Optional presentation configuration description.",
-            "type": [
-              "string",
-              "null"
-            ]
-          },
-          "lifeTime": {
-            "description": "Presentation request lifetime in seconds.",
+          "batchSize": {
+            "description": "Optional issuance batch size.",
             "type": "integer",
             "minimum": 1,
             "maximum": 9007199254740991
           },
-          "skewSeconds": {
-            "description": "Clock skew tolerance in seconds.",
-            "type": "integer",
-            "minimum": 0,
-            "maximum": 9007199254740991
+          "dPopRequired": {
+            "description": "Require DPoP proofs for issuance endpoints.",
+            "type": "boolean"
           },
-          "statusCheckMode": {
-            "description": "Revocation/status check mode.",
+          "walletAttestationRequired": {
+            "description": "Default wallet attestation requirement for managed authorization servers.",
+            "type": "boolean"
+          },
+          "walletProviderTrustLists": {
+            "description": "Shared wallet provider trust lists for key attestations and default authorization server wallet authentication.",
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": {
+                "trustListId": {
+                  "type": "string",
+                  "minLength": 1
+                },
+                "url": {
+                  "description": "URL of the wallet provider trust list.",
+                  "type": "string",
+                  "format": "uri"
+                },
+                "verifierKey": {
+                  "description": "Optional verifier key material used for trust list verification.",
+                  "type": "object",
+                  "propertyNames": {
+                    "type": "string"
+                  },
+                  "additionalProperties": {}
+                },
+                "verifierKeyPem": {
+                  "description": "Optional verifier public key in SPKI PEM form (-----BEGIN PUBLIC KEY-----).",
+                  "type": "string",
+                  "pattern": "^\\s*-----BEGIN PUBLIC KEY-----[A-Za-z0-9+/=\\s]+-----END PUBLIC KEY-----\\s*$"
+                },
+                "verifierX509Der": {
+                  "description": "Optional verifier certificate in DER/base64 form.",
+                  "type": "string"
+                }
+              },
+              "additionalProperties": false
+            }
+          },
+          "signingKeyId": {
+            "description": "Default signing key chain id for credential issuance.",
             "type": "string",
-            "enum": [
-              "strict",
-              "best_effort",
-              "disabled"
-            ]
+            "minLength": 1
           },
-          "dcql_query": {
-            "type": "object",
-            "properties": {
-              "credentials": {
-                "minItems": 1,
-                "type": "array",
-                "items": {
-                  "oneOf": [
-                    {
+          "authorizationServers": {
+            "minItems": 1,
+            "type": "array",
+            "items": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "type": {
+                      "type": "string",
+                      "const": "external",
+                      "description": "Use an externally managed authorization server."
+                    },
+                    "id": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Authorization server identifier."
+                    },
+                    "issuer": {
+                      "type": "string",
+                      "format": "uri",
+                      "description": "Issuer URL for the external authorization server."
+                    },
+                    "sessionBinding": {
+                      "description": "Explicit mapping from an external access-token claim to an existing issuance session.",
                       "type": "object",
                       "properties": {
-                        "id": {
+                        "method": {
+                          "type": "string",
+                          "const": "access_token_claim",
+                          "description": "Read the correlation value from a configured access-token claim."
+                        },
+                        "claim": {
                           "type": "string",
                           "minLength": 1,
-                          "pattern": "^[A-Za-z0-9_-]+$",
-                          "description": "Credential query identifier."
+                          "description": "Claim name that contains the issuance-session correlation value."
+                        }
+                      },
+                      "required": [
+                        "method",
+                        "claim"
+                      ],
+                      "additionalProperties": false
+                    },
+                    "label": {
+                      "description": "Optional display label for UI selection.",
+                      "type": "string"
+                    },
+                    "enabled": {
+                      "description": "Whether this authorization server entry is enabled.",
+                      "type": "boolean"
+                    }
+                  },
+                  "required": [
+                    "type",
+                    "id",
+                    "issuer"
+                  ],
+                  "additionalProperties": false
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "type": {
+                      "type": "string",
+                      "const": "oid4vp",
+                      "description": "Use OID4VP-based authorization server chaining."
+                    },
+                    "id": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Authorization server identifier."
+                    },
+                    "presentationConfigId": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Presentation configuration id used during authorization."
+                    },
+                    "immediateWalletRedirect": {
+                      "description": "Redirect wallets immediately after authorization response creation.",
+                      "type": "boolean"
+                    },
+                    "token": {
+                      "description": "Optional token issuance settings.",
+                      "type": "object",
+                      "properties": {
+                        "lifetimeSeconds": {
+                          "description": "Access token lifetime in seconds.",
+                          "type": "number",
+                          "minimum": 60
                         },
-                        "multiple": {
-                          "description": "Allow multiple matching credentials.",
+                        "signingKeyId": {
+                          "description": "Optional key chain id used to sign issued tokens.",
+                          "type": "string",
+                          "minLength": 1
+                        },
+                        "refreshTokenEnabled": {
+                          "description": "Enable issuing refresh tokens.",
                           "type": "boolean"
                         },
-                        "claim_sets": {
-                          "description": "Optional claim set constraints.",
-                          "type": "array",
-                          "items": {
-                            "type": "array",
-                            "items": {
+                        "refreshTokenExpiresInSeconds": {
+                          "description": "Refresh token lifetime in seconds.",
+                          "type": "number",
+                          "minimum": 60
+                        }
+                      },
+                      "additionalProperties": false
+                    },
+                    "requireDPoP": {
+                      "description": "Require DPoP proofs for token/credential requests.",
+                      "type": "boolean"
+                    },
+                    "walletAttestationRequired": {
+                      "description": "Require wallet attestation for this authorization server.",
+                      "type": "boolean"
+                    },
+                    "walletProviderTrustLists": {
+                      "description": "Optional wallet provider trust list references for this authorization server.",
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "trustListId": {
+                            "type": "string",
+                            "minLength": 1
+                          },
+                          "url": {
+                            "description": "URL of the wallet provider trust list.",
+                            "type": "string",
+                            "format": "uri"
+                          },
+                          "verifierKey": {
+                            "description": "Optional verifier key material used for trust list verification.",
+                            "type": "object",
+                            "propertyNames": {
                               "type": "string"
-                            }
-                          }
-                        },
-                        "trusted_authorities": {
-                          "description": "Optional trusted authority constraints.",
-                          "type": "array",
+                            },
+                            "additionalProperties": {}
+                          },
+                          "verifierKeyPem": {
+                            "description": "Optional verifier public key in SPKI PEM form (-----BEGIN PUBLIC KEY-----).",
+                            "type": "string",
+                            "pattern": "^\\s*-----BEGIN PUBLIC KEY-----[A-Za-z0-9+/=\\s]+-----END PUBLIC KEY-----\\s*$"
+                          },
+                          "verifierX509Der": {
+                            "description": "Optional verifier certificate in DER/base64 form.",
+                            "type": "string"
+                          }
+                        },
+                        "additionalProperties": false
+                      }
+                    },
+                    "label": {
+                      "description": "Optional display label for UI selection.",
+                      "type": "string"
+                    },
+                    "enabled": {
+                      "description": "Whether this authorization server entry is enabled.",
+                      "type": "boolean"
+                    }
+                  },
+                  "required": [
+                    "type",
+                    "id",
+                    "presentationConfigId"
+                  ],
+                  "additionalProperties": false
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "type": {
+                      "type": "string",
+                      "const": "chained",
+                      "description": "Use upstream OIDC as authorization source."
+                    },
+                    "id": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Authorization server identifier."
+                    },
+                    "upstream": {
+                      "type": "object",
+                      "properties": {
+                        "issuer": {
+                          "type": "string",
+                          "format": "uri",
+                          "description": "Upstream OIDC issuer URL."
+                        },
+                        "clientId": {
+                          "type": "string",
+                          "minLength": 1,
+                          "description": "Client id for upstream OIDC authentication."
+                        },
+                        "clientSecret": {
+                          "description": "Optional client secret for upstream OIDC authentication.",
+                          "type": "string",
+                          "minLength": 1
+                        },
+                        "scopes": {
+                          "description": "Optional scopes requested from the upstream issuer.",
+                          "type": "array",
+                          "items": {
+                            "type": "string",
+                            "minLength": 1
+                          }
+                        }
+                      },
+                      "required": [
+                        "issuer",
+                        "clientId"
+                      ],
+                      "additionalProperties": false,
+                      "description": "Upstream OIDC connection settings."
+                    },
+                    "token": {
+                      "description": "Optional token issuance settings.",
+                      "type": "object",
+                      "properties": {
+                        "lifetimeSeconds": {
+                          "description": "Access token lifetime in seconds.",
+                          "type": "number",
+                          "minimum": 60
+                        },
+                        "signingKeyId": {
+                          "description": "Optional key chain id used to sign issued tokens.",
+                          "type": "string",
+                          "minLength": 1
+                        },
+                        "refreshTokenEnabled": {
+                          "description": "Enable issuing refresh tokens.",
+                          "type": "boolean"
+                        },
+                        "refreshTokenExpiresInSeconds": {
+                          "description": "Refresh token lifetime in seconds.",
+                          "type": "number",
+                          "minimum": 60
+                        }
+                      },
+                      "additionalProperties": false
+                    },
+                    "requireDPoP": {
+                      "description": "Require DPoP proofs for token/credential requests.",
+                      "type": "boolean"
+                    },
+                    "walletAttestationRequired": {
+                      "description": "Require wallet attestation for this authorization server.",
+                      "type": "boolean"
+                    },
+                    "walletProviderTrustLists": {
+                      "description": "Optional wallet provider trust list references for this authorization server.",
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "trustListId": {
+                            "type": "string",
+                            "minLength": 1
+                          },
+                          "url": {
+                            "description": "URL of the wallet provider trust list.",
+                            "type": "string",
+                            "format": "uri"
+                          },
+                          "verifierKey": {
+                            "description": "Optional verifier key material used for trust list verification.",
+                            "type": "object",
+                            "propertyNames": {
+                              "type": "string"
+                            },
+                            "additionalProperties": {}
+                          },
+                          "verifierKeyPem": {
+                            "description": "Optional verifier public key in SPKI PEM form (-----BEGIN PUBLIC KEY-----).",
+                            "type": "string",
+                            "pattern": "^\\s*-----BEGIN PUBLIC KEY-----[A-Za-z0-9+/=\\s]+-----END PUBLIC KEY-----\\s*$"
+                          },
+                          "verifierX509Der": {
+                            "description": "Optional verifier certificate in DER/base64 form.",
+                            "type": "string"
+                          }
+                        },
+                        "additionalProperties": false
+                      }
+                    },
+                    "label": {
+                      "description": "Optional display label for UI selection.",
+                      "type": "string"
+                    },
+                    "enabled": {
+                      "description": "Whether this authorization server entry is enabled.",
+                      "type": "boolean"
+                    }
+                  },
+                  "required": [
+                    "type",
+                    "id",
+                    "upstream"
+                  ],
+                  "additionalProperties": false
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "type": {
+                      "type": "string",
+                      "const": "built-in",
+                      "description": "Use EUDIPLO built-in authorization server."
+                    },
+                    "id": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Authorization server identifier."
+                    },
+                    "token": {
+                      "description": "Optional token issuance settings.",
+                      "type": "object",
+                      "properties": {
+                        "lifetimeSeconds": {
+                          "description": "Access token lifetime in seconds.",
+                          "type": "number",
+                          "minimum": 60
+                        },
+                        "signingKeyId": {
+                          "description": "Optional key chain id used to sign issued tokens.",
+                          "type": "string",
+                          "minLength": 1
+                        },
+                        "refreshTokenEnabled": {
+                          "description": "Enable issuing refresh tokens.",
+                          "type": "boolean"
+                        },
+                        "refreshTokenExpiresInSeconds": {
+                          "description": "Refresh token lifetime in seconds.",
+                          "type": "number",
+                          "minimum": 60
+                        }
+                      },
+                      "additionalProperties": false
+                    },
+                    "requireDPoP": {
+                      "description": "Require DPoP proofs for token/credential requests.",
+                      "type": "boolean"
+                    },
+                    "walletAttestationRequired": {
+                      "description": "Require wallet attestation for this authorization server.",
+                      "type": "boolean"
+                    },
+                    "walletProviderTrustLists": {
+                      "description": "Optional wallet provider trust list references for this authorization server.",
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "trustListId": {
+                            "type": "string",
+                            "minLength": 1
+                          },
+                          "url": {
+                            "description": "URL of the wallet provider trust list.",
+                            "type": "string",
+                            "format": "uri"
+                          },
+                          "verifierKey": {
+                            "description": "Optional verifier key material used for trust list verification.",
+                            "type": "object",
+                            "propertyNames": {
+                              "type": "string"
+                            },
+                            "additionalProperties": {}
+                          },
+                          "verifierKeyPem": {
+                            "description": "Optional verifier public key in SPKI PEM form (-----BEGIN PUBLIC KEY-----).",
+                            "type": "string",
+                            "pattern": "^\\s*-----BEGIN PUBLIC KEY-----[A-Za-z0-9+/=\\s]+-----END PUBLIC KEY-----\\s*$"
+                          },
+                          "verifierX509Der": {
+                            "description": "Optional verifier certificate in DER/base64 form.",
+                            "type": "string"
+                          }
+                        },
+                        "additionalProperties": false
+                      }
+                    },
+                    "label": {
+                      "description": "Optional display label for UI selection.",
+                      "type": "string"
+                    },
+                    "enabled": {
+                      "description": "Whether this authorization server entry is enabled.",
+                      "type": "boolean"
+                    }
+                  },
+                  "required": [
+                    "type",
+                    "id"
+                  ],
+                  "additionalProperties": false
+                }
+              ],
+              "description": "Supported authorization server configurations."
+            },
+            "description": "Configured authorization server entries."
+          },
+          "federation": {
+            "description": "Optional OpenID Federation settings.",
+            "anyOf": [
+              {
+                "type": "object",
+                "properties": {
+                  "role": {
+                    "description": "Federation role for this issuer.",
+                    "type": "string",
+                    "enum": [
+                      "trust_anchor",
+                      "intermediate",
+                      "leaf"
+                    ]
+                  },
+                  "mode": {
+                    "description": "Federation operation mode.",
+                    "type": "string",
+                    "enum": [
+                      "federation-only",
+                      "hybrid"
+                    ]
+                  },
+                  "entityId": {
+                    "description": "Optional local federation entity id.",
+                    "type": "string"
+                  },
+                  "enforceSigningPolicy": {
+                    "description": "Enforce strict signing policy checks.",
+                    "type": "boolean"
+                  },
+                  "cacheTtlSeconds": {
+                    "description": "Cache time-to-live for federation metadata in seconds.",
+                    "type": "integer",
+                    "minimum": 1,
+                    "maximum": 9007199254740991
+                  },
+                  "trustAnchors": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "entityId": {
+                          "type": "string",
+                          "minLength": 1,
+                          "description": "Federation trust anchor entity id."
+                        },
+                        "entityConfigurationUri": {
+                          "type": "string",
+                          "format": "uri",
+                          "description": "Entity configuration URI for the trust anchor."
+                        }
+                      },
+                      "required": [
+                        "entityId",
+                        "entityConfigurationUri"
+                      ],
+                      "additionalProperties": false
+                    },
+                    "description": "Federation trust anchors."
+                  }
+                },
+                "required": [
+                  "trustAnchors"
+                ],
+                "additionalProperties": false
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "registrationCertificate": {
+            "description": "Optional registration certificate settings.",
+            "anyOf": [
+              {
+                "type": "object",
+                "properties": {
+                  "enabled": {
+                    "description": "Enable issuer registration certificate support.",
+                    "type": "boolean"
+                  },
+                  "mode": {
+                    "description": "How registration certificate data is provided.",
+                    "type": "string",
+                    "enum": [
+                      "import",
+                      "generate"
+                    ]
+                  },
+                  "jwt": {
+                    "description": "Optional registration certificate JWT when using import mode.",
+                    "type": "string"
+                  },
+                  "privacyPolicy": {
+                    "description": "Optional privacy policy URI.",
+                    "type": "string"
+                  },
+                  "supportUri": {
+                    "description": "Optional support URI.",
+                    "type": "string"
+                  }
+                },
+                "additionalProperties": false
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "display": {
+            "description": "Localized issuer metadata shown to wallets.",
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "description": "Issuer display name.",
+                  "type": "string"
+                },
+                "locale": {
+                  "description": "Locale tag for this display entry.",
+                  "type": "string"
+                },
+                "logo": {
+                  "description": "Optional issuer logo metadata.",
+                  "type": "object",
+                  "properties": {
+                    "uri": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Logo URI."
+                    },
+                    "alt_text": {
+                      "description": "Optional localized alternative text.",
+                      "type": "string"
+                    }
+                  },
+                  "required": [
+                    "uri"
+                  ],
+                  "additionalProperties": {}
+                }
+              },
+              "additionalProperties": {}
+            }
+          },
+          "notificationEndpointEnabled": {
+            "description": "Whether the OID4VCI notification endpoint is exposed for this issuance configuration.",
+            "type": "boolean"
+          },
+          "credentialResponseEncryption": {
+            "description": "Enable encrypted credential responses.",
+            "type": "boolean"
+          },
+          "credentialRequestEncryption": {
+            "description": "Require encrypted credential requests.",
+            "type": "boolean"
+          },
+          "txCodeMaxAttempts": {
+            "description": "Maximum verification attempts for transaction codes. Null resets to defaults.",
+            "anyOf": [
+              {
+                "type": "integer",
+                "minimum": 1,
+                "maximum": 9007199254740991
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "offerLifetimeSeconds": {
+            "description": "Default lifetime of credential offers in seconds. Can be overridden per offer request. Null or unset: offers do not expire.",
+            "anyOf": [
+              {
+                "type": "integer",
+                "minimum": 1,
+                "maximum": 9007199254740991
+              },
+              {
+                "type": "null"
+              }
+            ]
+          }
+        },
+        "required": [
+          "authorizationServers"
+        ],
+        "additionalProperties": false,
+        "title": "IssuanceConfig"
+      }
+    }
+  },
+  {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://eudiplo.dev/schemas/v3/PresentationConfigFile.schema.json",
+    "title": "PresentationConfigFile",
+    "type": "object",
+    "properties": {
+      "$schema": {
+        "type": "string",
+        "const": "https://eudiplo.dev/schemas/v3/PresentationConfigFile.schema.json"
+      },
+      "metadata": {
+        "type": "object",
+        "properties": {
+          "generation": {
+            "type": "integer",
+            "minimum": 1,
+            "description": "Monotonically increasing configuration generation."
+          },
+          "ownership": {
+            "type": "string",
+            "enum": [
+              "unmanaged",
+              "file-managed"
+            ],
+            "description": "Requested ownership recorded when the document is applied."
+          }
+        },
+        "additionalProperties": false
+      },
+      "spec": {
+        "allOf": [
+          {
+            "$ref": "#/$defs/PresentationConfigCreateDto"
+          },
+          {
+            "type": "object",
+            "required": [
+              "id"
+            ],
+            "properties": {
+              "id": {
+                "type": "string",
+                "minLength": 1
+              }
+            }
+          }
+        ]
+      }
+    },
+    "required": [
+      "$schema",
+      "spec"
+    ],
+    "additionalProperties": false,
+    "$defs": {
+      "PresentationConfigCreateDto": {
+        "type": "object",
+        "properties": {
+          "id": {
+            "type": "string",
+            "minLength": 1,
+            "description": "Presentation configuration identifier."
+          },
+          "description": {
+            "description": "Optional presentation configuration description.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "lifeTime": {
+            "description": "Presentation request lifetime in seconds.",
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 9007199254740991
+          },
+          "skewSeconds": {
+            "description": "Clock skew tolerance in seconds.",
+            "type": "integer",
+            "minimum": 0,
+            "maximum": 9007199254740991
+          },
+          "statusCheckMode": {
+            "description": "Revocation/status check mode.",
+            "type": "string",
+            "enum": [
+              "strict",
+              "best_effort",
+              "disabled"
+            ]
+          },
+          "dcql_query": {
+            "type": "object",
+            "properties": {
+              "credentials": {
+                "minItems": 1,
+                "type": "array",
+                "items": {
+                  "oneOf": [
+                    {
+                      "type": "object",
+                      "properties": {
+                        "id": {
+                          "type": "string",
+                          "minLength": 1,
+                          "pattern": "^[A-Za-z0-9_-]+$",
+                          "description": "Credential query identifier."
+                        },
+                        "multiple": {
+                          "description": "Allow multiple matching credentials.",
+                          "type": "boolean"
+                        },
+                        "claim_sets": {
+                          "description": "Optional claim set constraints.",
+                          "type": "array",
+                          "items": {
+                            "type": "array",
+                            "items": {
+                              "type": "string"
+                            }
+                          }
+                        },
+                        "trusted_authorities": {
+                          "description": "Optional trusted authority constraints.",
+                          "type": "array",
                           "items": {
                             "oneOf": [
                               {
@@ -23735,7 +24439,10 @@ function createTenantCommand(context, setExitCode) {
 
 // src/commands/config/validate/index.ts
 function createValidateCommand(context, setExitCode) {
-  return new Command("validate").description("Validate CLI or tenant config-import files").argument("[scope]").argument("[path]").addOption(
+  return new Command("validate").description("Validate CLI or tenant config-import files").argument(
+    "[scope]",
+    '"tenant" for one tenant folder or "tenants" for a folder of tenant folders; omit it to validate the CLI config file'
+  ).argument("[path]", "the folder to validate (required with a scope)").addOption(
     new Option("--format <text|json>", "tenant report format").choices(["text", "json"]).default("text")
   ).action(async (scope, path2, options) => {
     const state = await loadCliState(context);
@@ -23854,9 +24561,9 @@ function buildComposeLogsArgs(service, options = {}) {
   }
   return args;
 }
-function buildComposePullArgs(service) {
+function buildComposePullArgs(services) {
   const args = ["pull"];
-  if (service !== void 0) {
+  for (const service of typeof services === "string" ? [services] : services ?? []) {
     assertServiceName(service);
     args.push(service);
   }
@@ -23894,23 +24601,28 @@ function parseContainerStates(stdout) {
   return entries.map((entry) => {
     const record = entry;
     const names = record.Names;
+    const status = String(record.Status ?? "");
+    const exitCode2 = typeof record.ExitCode === "number" ? record.ExitCode : /^Exited \((\d+)\)/.exec(status)?.[1];
     return {
       name: Array.isArray(names) ? String(names[0] ?? "") : String(names ?? record.Name ?? ""),
       state: String(record.State ?? ""),
-      status: String(record.Status ?? "")
+      status,
+      exitCode: exitCode2 === void 0 ? void 0 : Number(exitCode2)
     };
   });
 }
 function summarizeContainerStates(containers, projectName) {
   const name = "service containers";
-  if (containers.length === 0) {
+  const services = containers.filter((container) => !hasCompleted(container));
+  const completed = containers.length - services.length;
+  if (services.length === 0) {
     return {
       name,
       status: "warn",
       message: `No containers found for project ${projectName}. Start it with eudiplo up.`
     };
   }
-  const unhealthy = containers.filter(
+  const unhealthy = services.filter(
     (container) => container.status.toLowerCase().includes("unhealthy")
   );
   if (unhealthy.length > 0) {
@@ -23920,25 +24632,28 @@ function summarizeContainerStates(containers, projectName) {
       message: `Unhealthy: ${describe(unhealthy)}`
     };
   }
-  const notRunning = containers.filter(
+  const notRunning = services.filter(
     (container) => container.state.toLowerCase() !== "running"
   );
   if (notRunning.length > 0) {
     return {
       name,
       status: "warn",
-      message: `${containers.length - notRunning.length}/${containers.length} running. Not running: ${describe(notRunning)}`
+      message: `${services.length - notRunning.length}/${services.length} running. Not running: ${describe(notRunning)}`
     };
   }
-  const starting = containers.filter(
+  const starting = services.filter(
     (container) => container.status.toLowerCase().includes("starting")
   ).length;
   return {
     name,
     status: "pass",
-    message: `${containers.length} container(s) running${starting > 0 ? `, ${starting} still starting` : ""}.`
+    message: `${services.length} container(s) running${starting > 0 ? `, ${starting} still starting` : ""}${completed > 0 ? `, ${completed} completed` : ""}.`
   };
 }
+function hasCompleted(container) {
+  return container.state.toLowerCase() === "exited" && container.exitCode === 0;
+}
 function asArray(value) {
   return Array.isArray(value) ? value : [];
 }
@@ -24872,11 +25587,57 @@ async function runDriverCommand(config, command, parsed, context) {
   });
 }
 
+// src/commands/deployment/pass-through.ts
+function runtimeArguments(command, args) {
+  const options = command.options.flatMap((option) => option.long ?? []);
+  for (const arg of args) {
+    if (!arg.startsWith("--") || arg === "--") {
+      continue;
+    }
+    const flag = arg.split("=", 1)[0];
+    const similar = options.filter(
+      (option) => option !== flag && editDistance2(flag, option) <= 2
+    );
+    if (similar.length > 0) {
+      const suggestion = similar.length === 1 ? similar[0] : `one of ${similar.join(", ")}`;
+      command.error(
+        `error: unknown option '${arg}'
+(Did you mean ${suggestion}?)`,
+        { code: "commander.unknownOption" }
+      );
+    }
+  }
+  const separator = args.indexOf("--");
+  return separator === -1 ? args : [...args.slice(0, separator), ...args.slice(separator + 1)];
+}
+function editDistance2(a, b) {
+  const distances = Array.from(
+    { length: a.length + 1 },
+    (_, i2) => Array.from({ length: b.length + 1 }, (_2, j) => Math.max(i2, j))
+  );
+  for (let i2 = 1; i2 <= a.length; i2++) {
+    for (let j = 1; j <= b.length; j++) {
+      distances[i2][j] = Math.min(
+        distances[i2 - 1][j] + 1,
+        distances[i2][j - 1] + 1,
+        distances[i2 - 1][j - 1] + (a[i2 - 1] === b[j - 1] ? 0 : 1)
+      );
+      if (i2 > 1 && j > 1 && a[i2 - 1] === b[j - 2] && a[i2 - 2] === b[j - 1]) {
+        distances[i2][j] = Math.min(
+          distances[i2][j],
+          distances[i2 - 2][j - 2] + 1
+        );
+      }
+    }
+  }
+  return distances[a.length][b.length];
+}
+
 // src/commands/deployment/index.ts
 var descriptions = {
   up: "Start the selected Compose deployment",
   down: "Stop the selected Compose deployment",
-  logs: "Stream logs for the selected deployment",
+  logs: "Print the logs of the selected deployment, or stream them with --follow",
   ps: "List the running containers or pods for the selected deployment",
   restart: "Restart the workloads of the selected deployment",
   pull: "Download the configured images without changing configuration"
@@ -24891,8 +25652,8 @@ function createDeploymentCommands(context, setExitCode) {
     (name) => {
       const command = new Command(name).description(descriptions[name]).argument(
         "[args...]",
-        "additional arguments passed to the deployment runtime"
-      ).option("--instance <name>", "select a configured instance");
+        "additional arguments and options passed to the deployment runtime"
+      ).allowUnknownOption().option("--instance <name>", "select a configured instance");
       if (serviceScoped.has(name)) {
         command.option(
           "--service <name>",
@@ -24912,12 +25673,13 @@ function createDeploymentCommands(context, setExitCode) {
         );
       }
       return command.action(async (args, options) => {
+        const runtimeArgs = runtimeArguments(command, args);
         const { config } = await loadCliState(context);
         setExitCode(
           await runDriverCommand(
             config,
             name,
-            parsedArgs(name, void 0, args, options),
+            parsedArgs(name, void 0, runtimeArgs, options),
             context
           )
         );
@@ -24929,7 +25691,7 @@ function createDeploymentCommands(context, setExitCode) {
 // package.json
 var package_default = {
   name: "@eudiplo/cli",
-  version: "9.0.0-main.1d44ec5",
+  version: "9.0.0-main.22d3602",
   description: "Deployment-aware command line tools for EUDIPLO",
   private: false,
   type: "module",
@@ -25372,6 +26134,13 @@ var kmsHealthCheck = {
           message: "This backend does not expose the KMS provider health endpoint."
         };
       }
+      if (response.status === 401 || response.status === 403) {
+        return {
+          name: "KMS providers",
+          status: "skip",
+          message: `Needs a tenant client with issuance:manage or presentation:manage (${response.reason}).`
+        };
+      }
       return {
         name: "KMS providers",
         status: "fail",
@@ -26282,6 +27051,10 @@ var managedImages = {
   EUDIPLO_IMAGE: "ghcr.io/eudiplo/eudiplo",
   EUDIPLO_CLIENT_IMAGE: "ghcr.io/eudiplo/eudiplo-client"
 };
+var managedServices = {
+  EUDIPLO_IMAGE: "eudiplo",
+  EUDIPLO_CLIENT_IMAGE: "eudiplo-client"
+};
 var legacyImages = {
   EUDIPLO_IMAGE: "ghcr.io/openwallet-foundation/eudiplo",
   EUDIPLO_CLIENT_IMAGE: "ghcr.io/openwallet-foundation/eudiplo-client"
@@ -26448,7 +27221,12 @@ async function runUpgradeCommand(config, parsed, context) {
     return 0;
   }
   await writeFile6(envPath, plan.content, "utf8");
-  const pulled = await runCompose(buildComposePullArgs(void 0), options);
+  const pulled = await runCompose(
+    buildComposePullArgs(
+      plan.changes.map((change) => managedServices[change.key])
+    ),
+    options
+  );
   if (pulled !== 0) {
     await writeFile6(envPath, original, "utf8");
     context.stderr.write(