@eudiplo/cli 9.0.0 → 9.1.0-main.021024e

package/dist/index.js

@@ -3099,12 +3099,13 @@ var require_data = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/fast-uri@3.1.6/node_modules/fast-uri/lib/utils.js
+// ../../node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/lib/utils.js
 var require_utils = __commonJS({
-  "../../node_modules/.pnpm/fast-uri@3.1.6/node_modules/fast-uri/lib/utils.js"(exports, module) {
+  "../../node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/lib/utils.js"(exports, module) {
     "use strict";
     var isUUID = RegExp.prototype.test.bind(/^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/iu);
     var isIPv4 = RegExp.prototype.test.bind(/^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)$/u);
+    var isPort = RegExp.prototype.test.bind(/^\d*$/u);
     var isHexPair = RegExp.prototype.test.bind(/^[\da-f]{2}$/iu);
     var isUnreserved = RegExp.prototype.test.bind(/^[\da-z\-._~]$/iu);
     var isPathCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:@/]$/u);
@@ -3570,8 +3571,12 @@ var require_utils = __commonJS({
         uriTokens.push(host);
       }
       if (typeof component.port === "number" || typeof component.port === "string") {
+        const port = String(component.port);
+        if (!isPort(port)) {
+          throw new TypeError("URI port is malformed.");
+        }
         uriTokens.push(":");
-        uriTokens.push(String(component.port));
+        uriTokens.push(port);
       }
       return uriTokens.length ? uriTokens.join("") : void 0;
     }
@@ -3596,9 +3601,9 @@ var require_utils = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/fast-uri@3.1.6/node_modules/fast-uri/lib/schemes.js
+// ../../node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/lib/schemes.js
 var require_schemes = __commonJS({
-  "../../node_modules/.pnpm/fast-uri@3.1.6/node_modules/fast-uri/lib/schemes.js"(exports, module) {
+  "../../node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/lib/schemes.js"(exports, module) {
     "use strict";
     var { isUUID } = require_utils();
     var URN_REG = /^([\da-z][\d\-a-z]{0,31}):((?:[\w!$'()*+,\-./:;=@]|%[\da-f]{2})+)$/iu;
@@ -3807,9 +3812,9 @@ var require_schemes = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/fast-uri@3.1.6/node_modules/fast-uri/index.js
+// ../../node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/index.js
 var require_fast_uri = __commonJS({
-  "../../node_modules/.pnpm/fast-uri@3.1.6/node_modules/fast-uri/index.js"(exports, module) {
+  "../../node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/index.js"(exports, module) {
     "use strict";
     var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
     var { SCHEMES, getSchemeHandler } = require_schemes();
@@ -4014,12 +4019,15 @@ var require_fast_uri = __commonJS({
       }
       return false;
     }
+    function isIPLiteral(host) {
+      return host[0] === "[" && host[host.length - 1] === "]";
+    }
     function hasMalformedComponentPercentEncoding(matches) {
       const host = matches[4];
-      return hasMalformedPercentEncoding(matches[3]) || host !== void 0 && !(host[0] === "[" && host[host.length - 1] === "]") && hasMalformedPercentEncoding(host) || hasMalformedPercentEncoding(matches[6]) || hasMalformedPercentEncoding(matches[7]) || hasMalformedPercentEncoding(matches[8]);
+      return hasMalformedPercentEncoding(matches[3]) || host !== void 0 && !isIPLiteral(host) && hasMalformedPercentEncoding(host) || hasMalformedPercentEncoding(matches[6]) || hasMalformedPercentEncoding(matches[7]) || hasMalformedPercentEncoding(matches[8]);
     }
     function canonicalizeHost(parsed, options, schemeHandler, isIP) {
-      if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport) && parsed.host && parsed.host[0] !== "[" && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
+      if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport) && parsed.host && !isIPLiteral(parsed.host) && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
         try {
           parsed.host = new URL("http://" + parsed.host).hostname;
         } catch (e) {
@@ -4106,10 +4114,11 @@ var require_fast_uri = __commonJS({
         if (parsed.host) {
           const ipv4result = isIPv4(parsed.host);
           if (ipv4result === false) {
-            const bracketedIPLiteral = parsed.host[0] === "[" && parsed.host[parsed.host.length - 1] === "]";
+            const bracketedIPLiteral = isIPLiteral(parsed.host);
+            const hasIPLiteralBracket = parsed.host.indexOf("[") !== -1 || parsed.host.indexOf("]") !== -1;
             const ipv6result = normalizeIPv6(parsed.host);
             isIP = ipv6result.isIPV6 || ipv6result.isIPVFuture === true;
-            malformedIPLiteral = bracketedIPLiteral && ipv6result.error === true;
+            malformedIPLiteral = hasIPLiteralBracket && (!bracketedIPLiteral || ipv6result.error === true);
             parsed.host = isIP ? ipv6result.host : ipv6result.host.toLowerCase();
             if (malformedIPLiteral) {
               parsed.error = parsed.error || "URI host is malformed.";
@@ -4132,14 +4141,17 @@ var require_fast_uri = __commonJS({
           parsed.error = parsed.error || "URI is not a " + options.reference + " reference.";
         }
         const schemeHandler = getSchemeHandler(options.scheme || parsed.scheme);
-        malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP);
-        if (!schemeHandler || schemeHandler && !schemeHandler.skipNormalize) {
-          if (uri.indexOf("%") !== -1) {
-            if (parsed.host !== void 0 && !malformedIPLiteral) {
-              const host = isIP ? parsed.host : normalizePercentEncoding(parsed.host, true);
-              parsed.host = reescapeHostDelimiters(host, isIP);
-            }
+        if (!malformedIPLiteral) {
+          malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP);
+        }
+        if (uri.indexOf("%") !== -1 && parsed.host !== void 0 && !malformedIPLiteral) {
+          let host = isIP ? parsed.host : normalizePercentEncoding(parsed.host, true);
+          if (!isIP) {
+            host = normalizePercentEncoding(host.toLowerCase());
           }
+          parsed.host = reescapeHostDelimiters(host, isIP);
+        }
+        if (!schemeHandler || schemeHandler && !schemeHandler.skipNormalize) {
           if (parsed.path) {
             parsed.path = normalizePathEncoding(parsed.path);
           }
@@ -14897,12 +14909,12 @@ var CONFIG_FORMATS = {
   IssuanceConfig: {
     slug: "issuance-config",
     file: "IssuanceConfigFile",
-    version: 2
+    version: 3
   },
   CredentialConfig: {
     slug: "credential-config",
     file: "CredentialConfigFile",
-    version: 1
+    version: 2
   },
   PresentationConfig: {
     slug: "presentation-config",
@@ -14980,6 +14992,25 @@ var CONFIG_MIGRATIONS = [
     // valid v2 spec whose offers keep having no lifetime.
     migrate: (spec) => ({ spec })
   },
+  {
+    id: "issuance-config-v3-trust-list-verifier-pem",
+    kind: "IssuanceConfig",
+    from: 2,
+    to: 3,
+    // v3 only adds the optional verifierKeyPem to wallet provider trust
+    // list references: a v2 spec is a valid v3 spec.
+    migrate: (spec) => ({ spec })
+  },
+  {
+    id: "credential-config-v2-x509-trusted-authority",
+    kind: "CredentialConfig",
+    from: 1,
+    to: 2,
+    // v2 only adds the frameworkType `x509` to schemaMeta trusted
+    // authorities, which schema metadata publishing already writes: a v1
+    // spec is a valid v2 spec.
+    migrate: (spec) => ({ spec })
+  },
   presentationConfigV1ToV2,
   {
     id: "presentation-config-v3-typed-claim-values",
@@ -20060,13 +20091,13 @@ var CONFIG_SCHEMAS = [
   },
   {
     "$schema": "https://json-schema.org/draft/2020-12/schema",
-    "$id": "https://eudiplo.dev/schemas/v2/IssuanceConfigFile.schema.json",
-    "title": "IssuanceConfigFile",
+    "$id": "https://eudiplo.dev/schemas/v2/CredentialConfigFile.schema.json",
+    "title": "CredentialConfigFile",
     "type": "object",
     "properties": {
       "$schema": {
         "type": "string",
-        "const": "https://eudiplo.dev/schemas/v2/IssuanceConfigFile.schema.json"
+        "const": "https://eudiplo.dev/schemas/v2/CredentialConfigFile.schema.json"
       },
       "metadata": {
         "type": "object",
@@ -20088,7 +20119,23 @@ var CONFIG_SCHEMAS = [
         "additionalProperties": false
       },
       "spec": {
-        "$ref": "#/$defs/IssuanceConfig"
+        "allOf": [
+          {
+            "$ref": "#/$defs/CredentialConfigCreate"
+          },
+          {
+            "type": "object",
+            "required": [
+              "id"
+            ],
+            "properties": {
+              "id": {
+                "type": "string",
+                "minLength": 1
+              }
+            }
+          }
+        ]
       }
     },
     "required": [
@@ -20097,513 +20144,260 @@ var CONFIG_SCHEMAS = [
     ],
     "additionalProperties": false,
     "$defs": {
-      "IssuanceConfig": {
+      "CredentialConfigCreate": {
         "type": "object",
         "properties": {
-          "batchSize": {
-            "description": "Optional issuance batch size.",
-            "type": "integer",
-            "minimum": 1,
-            "maximum": 9007199254740991
-          },
-          "dPopRequired": {
-            "description": "Require DPoP proofs for issuance endpoints.",
-            "type": "boolean"
+          "id": {
+            "type": "string",
+            "minLength": 1,
+            "description": "Credential configuration identifier."
           },
-          "walletAttestationRequired": {
-            "description": "Default wallet attestation requirement for managed authorization servers.",
-            "type": "boolean"
+          "description": {
+            "description": "Optional description for operators and tooling.",
+            "type": [
+              "string",
+              "null"
+            ]
           },
-          "walletProviderTrustLists": {
-            "description": "Shared wallet provider trust lists for key attestations and default authorization server wallet authentication.",
-            "type": "array",
-            "items": {
-              "type": "object",
-              "properties": {
-                "trustListId": {
-                  "type": "string",
-                  "minLength": 1
-                },
-                "url": {
-                  "description": "URL of the wallet provider trust list.",
-                  "type": "string",
-                  "format": "uri"
-                },
-                "verifierKey": {
-                  "description": "Optional verifier key material used for trust list verification.",
-                  "type": "object",
-                  "propertyNames": {
-                    "type": "string"
-                  },
-                  "additionalProperties": {}
-                },
-                "verifierX509Der": {
-                  "description": "Optional verifier certificate in DER/base64 form.",
-                  "type": "string"
-                }
+          "config": {
+            "type": "object",
+            "properties": {
+              "format": {
+                "type": "string",
+                "enum": [
+                  "mso_mdoc",
+                  "dc+sd-jwt"
+                ],
+                "description": "Credential format emitted by this configuration."
               },
-              "additionalProperties": false
-            }
-          },
-          "signingKeyId": {
-            "description": "Default signing key chain id for credential issuance.",
-            "type": "string",
-            "minLength": 1
-          },
-          "authorizationServers": {
-            "minItems": 1,
-            "type": "array",
-            "items": {
-              "oneOf": [
-                {
+              "display": {
+                "type": "array",
+                "items": {
                   "type": "object",
                   "properties": {
-                    "type": {
+                    "locale": {
                       "type": "string",
-                      "const": "external",
-                      "description": "Use an externally managed authorization server."
+                      "minLength": 1,
+                      "description": "Locale tag for the display entry."
                     },
-                    "id": {
+                    "name": {
                       "type": "string",
                       "minLength": 1,
-                      "description": "Authorization server identifier."
+                      "description": "Human-readable field name."
                     },
-                    "issuer": {
-                      "type": "string",
-                      "format": "uri",
-                      "description": "Issuer URL for the external authorization server."
+                    "description": {
+                      "description": "Optional field description for this locale.",
+                      "type": "string"
                     },
-                    "sessionBinding": {
-                      "description": "Explicit mapping from an external access-token claim to an existing issuance session.",
+                    "background_color": {
+                      "description": "Optional background color for card-style rendering.",
+                      "type": "string"
+                    },
+                    "text_color": {
+                      "description": "Optional text color for card-style rendering.",
+                      "type": "string"
+                    },
+                    "background_image": {
+                      "description": "Optional background image.",
                       "type": "object",
                       "properties": {
-                        "method": {
-                          "type": "string",
-                          "const": "access_token_claim",
-                          "description": "Read the correlation value from a configured access-token claim."
-                        },
-                        "claim": {
+                        "uri": {
                           "type": "string",
                           "minLength": 1,
-                          "description": "Claim name that contains the issuance-session correlation value."
+                          "description": "Image URI."
                         }
                       },
                       "required": [
-                        "method",
-                        "claim"
+                        "uri"
                       ],
                       "additionalProperties": false
                     },
-                    "label": {
-                      "description": "Optional display label for UI selection.",
-                      "type": "string"
-                    },
-                    "enabled": {
-                      "description": "Whether this authorization server entry is enabled.",
-                      "type": "boolean"
-                    }
-                  },
-                  "required": [
-                    "type",
-                    "id",
-                    "issuer"
-                  ],
-                  "additionalProperties": false
-                },
-                {
-                  "type": "object",
-                  "properties": {
-                    "type": {
-                      "type": "string",
-                      "const": "oid4vp",
-                      "description": "Use OID4VP-based authorization server chaining."
-                    },
-                    "id": {
-                      "type": "string",
-                      "minLength": 1,
-                      "description": "Authorization server identifier."
-                    },
-                    "presentationConfigId": {
-                      "type": "string",
-                      "minLength": 1,
-                      "description": "Presentation configuration id used during authorization."
-                    },
-                    "immediateWalletRedirect": {
-                      "description": "Redirect wallets immediately after authorization response creation.",
-                      "type": "boolean"
-                    },
-                    "token": {
-                      "description": "Optional token issuance settings.",
+                    "logo": {
+                      "description": "Optional logo image.",
                       "type": "object",
                       "properties": {
-                        "lifetimeSeconds": {
-                          "description": "Access token lifetime in seconds.",
-                          "type": "number",
-                          "minimum": 60
-                        },
-                        "signingKeyId": {
-                          "description": "Optional key chain id used to sign issued tokens.",
+                        "uri": {
                           "type": "string",
-                          "minLength": 1
-                        },
-                        "refreshTokenEnabled": {
-                          "description": "Enable issuing refresh tokens.",
-                          "type": "boolean"
-                        },
-                        "refreshTokenExpiresInSeconds": {
-                          "description": "Refresh token lifetime in seconds.",
-                          "type": "number",
-                          "minimum": 60
+                          "minLength": 1,
+                          "description": "Image URI."
                         }
                       },
+                      "required": [
+                        "uri"
+                      ],
                       "additionalProperties": false
-                    },
-                    "requireDPoP": {
-                      "description": "Require DPoP proofs for token/credential requests.",
-                      "type": "boolean"
-                    },
-                    "walletAttestationRequired": {
-                      "description": "Require wallet attestation for this authorization server.",
-                      "type": "boolean"
-                    },
-                    "walletProviderTrustLists": {
-                      "description": "Optional wallet provider trust list references for this authorization server.",
-                      "type": "array",
-                      "items": {
-                        "type": "object",
-                        "properties": {
-                          "trustListId": {
-                            "type": "string",
-                            "minLength": 1
-                          },
-                          "url": {
-                            "description": "URL of the wallet provider trust list.",
-                            "type": "string",
-                            "format": "uri"
-                          },
-                          "verifierKey": {
-                            "description": "Optional verifier key material used for trust list verification.",
-                            "type": "object",
-                            "propertyNames": {
-                              "type": "string"
-                            },
-                            "additionalProperties": {}
-                          },
-                          "verifierX509Der": {
-                            "description": "Optional verifier certificate in DER/base64 form.",
-                            "type": "string"
-                          }
-                        },
-                        "additionalProperties": false
-                      }
-                    },
-                    "label": {
-                      "description": "Optional display label for UI selection.",
-                      "type": "string"
-                    },
-                    "enabled": {
-                      "description": "Whether this authorization server entry is enabled.",
-                      "type": "boolean"
                     }
                   },
                   "required": [
-                    "type",
-                    "id",
-                    "presentationConfigId"
+                    "locale",
+                    "name"
                   ],
                   "additionalProperties": false
                 },
-                {
-                  "type": "object",
-                  "properties": {
-                    "type": {
-                      "type": "string",
-                      "const": "chained",
-                      "description": "Use upstream OIDC as authorization source."
-                    },
-                    "id": {
-                      "type": "string",
-                      "minLength": 1,
-                      "description": "Authorization server identifier."
-                    },
-                    "upstream": {
+                "description": "Display metadata shown by wallets."
+              },
+              "scope": {
+                "description": "Optional OAuth scope associated with this credential type.",
+                "type": "string"
+              },
+              "docType": {
+                "description": "Optional mDoc document type.",
+                "type": "string"
+              },
+              "keyAttestationsRequired": {
+                "description": "Optional key attestation requirements.",
+                "type": "object",
+                "properties": {
+                  "key_storage": {
+                    "description": "Required key storage attestations.",
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    }
+                  },
+                  "user_authentication": {
+                    "description": "Required user authentication attestations.",
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    }
+                  }
+                },
+                "additionalProperties": false
+              },
+              "proofTypesSupported": {
+                "description": "Supported proof types for issuance requests.",
+                "type": "array",
+                "items": {
+                  "type": "string",
+                  "enum": [
+                    "jwt",
+                    "attestation"
+                  ]
+                }
+              },
+              "credentialReusePolicy": {
+                "description": "Optional PID/EAA reuse policy published in credential metadata.",
+                "type": "object",
+                "properties": {
+                  "id": {
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "options": {
+                    "type": "array",
+                    "items": {
                       "type": "object",
                       "properties": {
-                        "issuer": {
-                          "type": "string",
-                          "format": "uri",
-                          "description": "Upstream OIDC issuer URL."
-                        },
-                        "clientId": {
-                          "type": "string",
-                          "minLength": 1,
-                          "description": "Client id for upstream OIDC authentication."
-                        },
-                        "clientSecret": {
-                          "description": "Optional client secret for upstream OIDC authentication.",
-                          "type": "string",
-                          "minLength": 1
-                        },
-                        "scopes": {
-                          "description": "Optional scopes requested from the upstream issuer.",
+                        "details": {
+                          "minItems": 1,
                           "type": "array",
                           "items": {
                             "type": "string",
-                            "minLength": 1
+                            "enum": [
+                              "once_only",
+                              "limited_time",
+                              "limited-time",
+                              "rotating-batch",
+                              "per-relying-party"
+                            ]
                           }
-                        }
-                      },
-                      "required": [
-                        "issuer",
-                        "clientId"
-                      ],
-                      "additionalProperties": false,
-                      "description": "Upstream OIDC connection settings."
-                    },
-                    "token": {
-                      "description": "Optional token issuance settings.",
-                      "type": "object",
-                      "properties": {
-                        "lifetimeSeconds": {
-                          "description": "Access token lifetime in seconds.",
-                          "type": "number",
-                          "minimum": 60
                         },
-                        "signingKeyId": {
-                          "description": "Optional key chain id used to sign issued tokens.",
-                          "type": "string",
-                          "minLength": 1
+                        "batch_size": {
+                          "type": "integer",
+                          "minimum": 2,
+                          "maximum": 9007199254740991
                         },
-                        "refreshTokenEnabled": {
-                          "description": "Enable issuing refresh tokens.",
-                          "type": "boolean"
+                        "reissue_trigger_unused": {
+                          "type": "integer",
+                          "minimum": 0,
+                          "maximum": 9007199254740991
                         },
-                        "refreshTokenExpiresInSeconds": {
-                          "description": "Refresh token lifetime in seconds.",
-                          "type": "number",
-                          "minimum": 60
+                        "reissue_trigger_lifetime_left": {
+                          "type": "integer",
+                          "minimum": 0,
+                          "maximum": 9007199254740991
                         }
                       },
+                      "required": [
+                        "details"
+                      ],
                       "additionalProperties": false
-                    },
-                    "requireDPoP": {
-                      "description": "Require DPoP proofs for token/credential requests.",
-                      "type": "boolean"
-                    },
-                    "walletAttestationRequired": {
-                      "description": "Require wallet attestation for this authorization server.",
-                      "type": "boolean"
-                    },
-                    "walletProviderTrustLists": {
-                      "description": "Optional wallet provider trust list references for this authorization server.",
-                      "type": "array",
-                      "items": {
-                        "type": "object",
-                        "properties": {
-                          "trustListId": {
-                            "type": "string",
-                            "minLength": 1
-                          },
-                          "url": {
-                            "description": "URL of the wallet provider trust list.",
-                            "type": "string",
-                            "format": "uri"
-                          },
-                          "verifierKey": {
-                            "description": "Optional verifier key material used for trust list verification.",
-                            "type": "object",
-                            "propertyNames": {
-                              "type": "string"
-                            },
-                            "additionalProperties": {}
-                          },
-                          "verifierX509Der": {
-                            "description": "Optional verifier certificate in DER/base64 form.",
-                            "type": "string"
-                          }
-                        },
-                        "additionalProperties": false
-                      }
-                    },
-                    "label": {
-                      "description": "Optional display label for UI selection.",
-                      "type": "string"
-                    },
-                    "enabled": {
-                      "description": "Whether this authorization server entry is enabled.",
-                      "type": "boolean"
                     }
-                  },
-                  "required": [
-                    "type",
-                    "id",
-                    "upstream"
-                  ],
-                  "additionalProperties": false
+                  }
                 },
-                {
-                  "type": "object",
-                  "properties": {
-                    "type": {
-                      "type": "string",
-                      "const": "built-in",
-                      "description": "Use EUDIPLO built-in authorization server."
-                    },
-                    "id": {
-                      "type": "string",
-                      "minLength": 1,
-                      "description": "Authorization server identifier."
-                    },
-                    "token": {
-                      "description": "Optional token issuance settings.",
-                      "type": "object",
-                      "properties": {
-                        "lifetimeSeconds": {
-                          "description": "Access token lifetime in seconds.",
-                          "type": "number",
-                          "minimum": 60
-                        },
-                        "signingKeyId": {
-                          "description": "Optional key chain id used to sign issued tokens.",
-                          "type": "string",
-                          "minLength": 1
-                        },
-                        "refreshTokenEnabled": {
-                          "description": "Enable issuing refresh tokens.",
-                          "type": "boolean"
-                        },
-                        "refreshTokenExpiresInSeconds": {
-                          "description": "Refresh token lifetime in seconds.",
-                          "type": "number",
-                          "minimum": 60
-                        }
-                      },
-                      "additionalProperties": false
-                    },
-                    "requireDPoP": {
-                      "description": "Require DPoP proofs for token/credential requests.",
-                      "type": "boolean"
-                    },
-                    "walletAttestationRequired": {
-                      "description": "Require wallet attestation for this authorization server.",
-                      "type": "boolean"
-                    },
-                    "walletProviderTrustLists": {
-                      "description": "Optional wallet provider trust list references for this authorization server.",
-                      "type": "array",
-                      "items": {
-                        "type": "object",
-                        "properties": {
-                          "trustListId": {
-                            "type": "string",
-                            "minLength": 1
-                          },
-                          "url": {
-                            "description": "URL of the wallet provider trust list.",
-                            "type": "string",
-                            "format": "uri"
-                          },
-                          "verifierKey": {
-                            "description": "Optional verifier key material used for trust list verification.",
-                            "type": "object",
-                            "propertyNames": {
-                              "type": "string"
-                            },
-                            "additionalProperties": {}
-                          },
-                          "verifierX509Der": {
-                            "description": "Optional verifier certificate in DER/base64 form.",
-                            "type": "string"
-                          }
-                        },
-                        "additionalProperties": false
-                      }
-                    },
-                    "label": {
-                      "description": "Optional display label for UI selection.",
-                      "type": "string"
-                    },
-                    "enabled": {
-                      "description": "Whether this authorization server entry is enabled.",
-                      "type": "boolean"
-                    }
-                  },
-                  "required": [
-                    "type",
-                    "id"
-                  ],
-                  "additionalProperties": false
-                }
-              ],
-              "description": "Supported authorization server configurations."
+                "required": [
+                  "id"
+                ],
+                "additionalProperties": false
+              }
             },
-            "description": "Configured authorization server entries."
+            "required": [
+              "format",
+              "display"
+            ],
+            "additionalProperties": false,
+            "description": "Issuer metadata-facing credential configuration."
           },
-          "federation": {
-            "description": "Optional OpenID Federation settings.",
+          "fields": {
+            "type": "array",
+            "items": {
+              "$ref": "#/$defs/CredentialConfigCreate/$defs/__schema0"
+            },
+            "description": "Claim field definitions for credential issuance."
+          },
+          "attributeProviderId": {
+            "description": "Optional attribute provider id used to resolve claim values.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "webhookEndpointId": {
+            "description": "Not used for notifications: they go to the webhook endpoint of the offer.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "vct": {
+            "description": "Optional VCT value or structured VCT metadata.",
             "anyOf": [
+              {
+                "type": "string"
+              },
               {
                 "type": "object",
                 "properties": {
-                  "role": {
-                    "description": "Federation role for this issuer.",
-                    "type": "string",
-                    "enum": [
-                      "trust_anchor",
-                      "intermediate",
-                      "leaf"
-                    ]
+                  "vct": {
+                    "description": "VCT identifier.",
+                    "type": "string"
                   },
-                  "mode": {
-                    "description": "Federation operation mode.",
-                    "type": "string",
-                    "enum": [
-                      "federation-only",
-                      "hybrid"
-                    ]
+                  "name": {
+                    "description": "Human-readable VCT name.",
+                    "type": "string"
                   },
-                  "entityId": {
-                    "description": "Optional local federation entity id.",
+                  "description": {
+                    "description": "Optional VCT description.",
                     "type": "string"
                   },
-                  "enforceSigningPolicy": {
-                    "description": "Enforce strict signing policy checks.",
-                    "type": "boolean"
+                  "extends": {
+                    "description": "Optional base VCT reference.",
+                    "type": "string"
                   },
-                  "cacheTtlSeconds": {
-                    "description": "Cache time-to-live for federation metadata in seconds.",
-                    "type": "integer",
-                    "minimum": 1,
-                    "maximum": 9007199254740991
+                  "extends#integrity": {
+                    "description": "Integrity hash for the extends reference.",
+                    "type": "string"
                   },
-                  "trustAnchors": {
-                    "type": "array",
-                    "items": {
-                      "type": "object",
-                      "properties": {
-                        "entityId": {
-                          "type": "string",
-                          "minLength": 1,
-                          "description": "Federation trust anchor entity id."
-                        },
-                        "entityConfigurationUri": {
-                          "type": "string",
-                          "format": "uri",
-                          "description": "Entity configuration URI for the trust anchor."
-                        }
-                      },
-                      "required": [
-                        "entityId",
-                        "entityConfigurationUri"
-                      ],
-                      "additionalProperties": false
-                    },
-                    "description": "Federation trust anchors."
+                  "schema_uri": {
+                    "description": "Optional schema URI for the VCT.",
+                    "type": "string"
+                  },
+                  "schema_uri#integrity": {
+                    "description": "Integrity hash for schema_uri.",
+                    "type": "string"
                   }
                 },
-                "required": [
-                  "trustAnchors"
-                ],
                 "additionalProperties": false
               },
               {
@@ -20611,709 +20405,2446 @@ var CONFIG_SCHEMAS = [
               }
             ]
           },
-          "registrationCertificate": {
-            "description": "Optional registration certificate settings.",
+          "keyBinding": {
+            "description": "Enable key binding requirements.",
+            "type": "boolean"
+          },
+          "keyChainId": {
+            "description": "Optional key chain id used for credential signing.",
+            "type": "string",
+            "minLength": 1
+          },
+          "statusManagement": {
+            "description": "Enable status management for issued credentials.",
+            "type": "boolean"
+          },
+          "activeCredentials": {
+            "description": "Optional issuer-side policy limiting simultaneously active credentials per subject. Requires statusManagement.",
             "anyOf": [
               {
                 "type": "object",
                 "properties": {
                   "enabled": {
-                    "description": "Enable issuer registration certificate support.",
-                    "type": "boolean"
+                    "type": "boolean",
+                    "description": "Ensure a subject has at most one active credential of this configuration."
                   },
-                  "mode": {
-                    "description": "How registration certificate data is provided.",
+                  "tracking": {
+                    "description": "How the subject's active credential set is tracked. Only 'internal' (pseudonymous, issuer-side) is currently supported.",
                     "type": "string",
                     "enum": [
-                      "import",
-                      "generate"
+                      "internal"
                     ]
-                  },
-                  "jwt": {
-                    "description": "Optional registration certificate JWT when using import mode.",
-                    "type": "string"
-                  },
-                  "privacyPolicy": {
-                    "description": "Optional privacy policy URI.",
-                    "type": "string"
-                  },
-                  "supportUri": {
-                    "description": "Optional support URI.",
-                    "type": "string"
                   }
                 },
-                "additionalProperties": false
+                "required": [
+                  "enabled"
+                ],
+                "additionalProperties": false,
+                "description": "Issuer-side policy limiting the number of simultaneously active credentials per subject."
               },
               {
                 "type": "null"
               }
             ]
           },
-          "display": {
-            "description": "Localized issuer metadata shown to wallets.",
-            "type": "array",
-            "items": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "description": "Issuer display name.",
-                  "type": "string"
-                },
-                "locale": {
-                  "description": "Locale tag for this display entry.",
-                  "type": "string"
-                },
-                "logo": {
-                  "description": "Optional issuer logo metadata.",
-                  "type": "object",
-                  "properties": {
-                    "uri": {
-                      "type": "string",
-                      "minLength": 1,
-                      "description": "Logo URI."
-                    },
-                    "alt_text": {
-                      "description": "Optional localized alternative text.",
-                      "type": "string"
-                    }
-                  },
-                  "required": [
-                    "uri"
-                  ],
-                  "additionalProperties": {}
-                }
-              },
-              "additionalProperties": {}
-            }
-          },
-          "notificationEndpointEnabled": {
-            "description": "Whether the OID4VCI notification endpoint is exposed for this issuance configuration.",
-            "type": "boolean"
-          },
-          "credentialResponseEncryption": {
-            "description": "Enable encrypted credential responses.",
-            "type": "boolean"
-          },
-          "credentialRequestEncryption": {
-            "description": "Require encrypted credential requests.",
-            "type": "boolean"
-          },
-          "txCodeMaxAttempts": {
-            "description": "Maximum verification attempts for transaction codes. Null resets to defaults.",
+          "iaeActions": {
+            "description": "Interactive authorization steps (a presentation or a web flow) that the wallet completes, in order, before the credential is issued.",
             "anyOf": [
               {
-                "type": "integer",
-                "minimum": 1,
-                "maximum": 9007199254740991
+                "type": "array",
+                "items": {
+                  "oneOf": [
+                    {
+                      "type": "object",
+                      "properties": {
+                        "type": {
+                          "type": "string",
+                          "const": "openid4vp_presentation",
+                          "description": "Trigger an OpenID4VP presentation action."
+                        },
+                        "label": {
+                          "description": "Optional UI label for the action.",
+                          "type": "string"
+                        },
+                        "presentationConfigId": {
+                          "type": "string",
+                          "minLength": 1,
+                          "description": "Presentation configuration id to execute."
+                        }
+                      },
+                      "required": [
+                        "type",
+                        "presentationConfigId"
+                      ],
+                      "additionalProperties": false
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "type": {
+                          "type": "string",
+                          "const": "redirect_to_web",
+                          "description": "Trigger a redirect-to-web action."
+                        },
+                        "label": {
+                          "description": "Optional UI label for the action.",
+                          "type": "string"
+                        },
+                        "url": {
+                          "type": "string",
+                          "format": "uri",
+                          "description": "Destination URL for the redirect action."
+                        },
+                        "callbackUrl": {
+                          "description": "Optional callback URL after redirect completion.",
+                          "type": "string",
+                          "format": "uri"
+                        },
+                        "description": {
+                          "description": "Optional action description.",
+                          "type": "string"
+                        }
+                      },
+                      "required": [
+                        "type",
+                        "url"
+                      ],
+                      "additionalProperties": false
+                    }
+                  ],
+                  "description": "In-app experience action definitions."
+                }
               },
               {
                 "type": "null"
               }
             ]
           },
-          "offerLifetimeSeconds": {
-            "description": "Default lifetime of credential offers in seconds. Can be overridden per offer request. Null or unset: offers do not expire.",
+          "sdJwtTrustFormat": {
+            "description": "Trust format used for SD-JWT verification metadata.",
             "anyOf": [
               {
-                "type": "integer",
-                "minimum": 1,
-                "maximum": 9007199254740991
+                "type": "string",
+                "enum": [
+                  "x5c",
+                  "federation"
+                ]
               },
               {
                 "type": "null"
               }
             ]
-          }
-        },
-        "required": [
-          "authorizationServers"
-        ],
-        "additionalProperties": false,
-        "title": "IssuanceConfig"
-      }
-    }
-  },
-  {
-    "$schema": "https://json-schema.org/draft/2020-12/schema",
-    "$id": "https://eudiplo.dev/schemas/v2/PresentationConfigFile.schema.json",
-    "title": "PresentationConfigFile",
-    "type": "object",
-    "properties": {
-      "$schema": {
-        "type": "string",
-        "const": "https://eudiplo.dev/schemas/v2/PresentationConfigFile.schema.json"
-      },
-      "metadata": {
-        "type": "object",
-        "properties": {
-          "generation": {
-            "type": "integer",
-            "minimum": 1,
-            "description": "Monotonically increasing configuration generation."
-          },
-          "ownership": {
-            "type": "string",
-            "enum": [
-              "unmanaged",
-              "file-managed"
-            ],
-            "description": "Requested ownership recorded when the document is applied."
-          }
-        },
-        "additionalProperties": false
-      },
-      "spec": {
-        "allOf": [
-          {
-            "$ref": "#/$defs/PresentationConfigCreateDto"
-          },
-          {
-            "type": "object",
-            "required": [
-              "id"
-            ],
-            "properties": {
-              "id": {
-                "type": "string",
-                "minLength": 1
-              }
-            }
-          }
-        ]
-      }
-    },
-    "required": [
-      "$schema",
-      "spec"
-    ],
-    "additionalProperties": false,
-    "$defs": {
-      "PresentationConfigCreateDto": {
-        "type": "object",
-        "properties": {
-          "id": {
-            "type": "string",
-            "minLength": 1,
-            "description": "Presentation configuration identifier."
-          },
-          "description": {
-            "description": "Optional presentation configuration description.",
-            "type": [
-              "string",
-              "null"
-            ]
           },
           "lifeTime": {
-            "description": "Presentation request lifetime in seconds.",
+            "description": "Credential lifetime in seconds.",
             "type": "integer",
             "minimum": 1,
             "maximum": 9007199254740991
           },
-          "skewSeconds": {
-            "description": "Clock skew tolerance in seconds.",
-            "type": "integer",
-            "minimum": 0,
-            "maximum": 9007199254740991
-          },
-          "statusCheckMode": {
-            "description": "Revocation/status check mode.",
-            "type": "string",
-            "enum": [
-              "strict",
-              "best_effort",
-              "disabled"
-            ]
-          },
-          "dcql_query": {
-            "type": "object",
-            "properties": {
-              "credentials": {
-                "minItems": 1,
-                "type": "array",
-                "items": {
-                  "oneOf": [
-                    {
+          "schemaMeta": {
+            "description": "Optional schema metadata and trust bindings.",
+            "anyOf": [
+              {
+                "type": "object",
+                "properties": {
+                  "id": {
+                    "description": "Optional schema metadata identifier.",
+                    "type": "string"
+                  },
+                  "name": {
+                    "description": "Optional schema metadata name.",
+                    "type": "string"
+                  },
+                  "version": {
+                    "type": "string",
+                    "description": "Schema metadata version."
+                  },
+                  "rulebookURI": {
+                    "description": "Optional rulebook URI reference.",
+                    "type": "string"
+                  },
+                  "attestationLoS": {
+                    "type": "string",
+                    "enum": [
+                      "iso_18045_high",
+                      "iso_18045_moderate",
+                      "iso_18045_enhanced-basic",
+                      "iso_18045_basic"
+                    ],
+                    "description": "Assurance level for attestation requirements."
+                  },
+                  "bindingType": {
+                    "type": "string",
+                    "enum": [
+                      "claim",
+                      "key",
+                      "biometric",
+                      "none"
+                    ],
+                    "description": "Subject binding type."
+                  },
+                  "schemaURIs": {
+                    "description": "Optional schema URI entries.",
+                    "type": "array",
+                    "items": {
                       "type": "object",
                       "properties": {
-                        "id": {
-                          "type": "string",
-                          "minLength": 1,
-                          "pattern": "^[A-Za-z0-9_-]+$",
-                          "description": "Credential query identifier."
+                        "credentialConfigId": {
+                          "description": "Optional credential configuration id this schema URI applies to.",
+                          "type": "string"
                         },
-                        "multiple": {
-                          "description": "Allow multiple matching credentials.",
-                          "type": "boolean"
+                        "format": {
+                          "description": "Optional credential format for this schema URI.",
+                          "type": "string"
                         },
-                        "claim_sets": {
-                          "description": "Optional claim set constraints.",
-                          "type": "array",
-                          "items": {
-                            "type": "array",
+                        "uri": {
+                          "description": "Schema URI reference.",
+                          "type": "string"
+                        },
+                        "meta": {
+                          "description": "Optional metadata attached to the schema URI.",
+                          "type": "object",
+                          "propertyNames": {
+                            "type": "string"
+                          },
+                          "additionalProperties": {}
+                        }
+                      },
+                      "additionalProperties": false
+                    }
+                  },
+                  "trustedAuthorities": {
+                    "description": "Optional trusted authority entries.",
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "trustListId": {
+                          "description": "Optional trust list id.",
+                          "type": "string"
+                        },
+                        "frameworkType": {
+                          "description": "Trust framework type. `x509` takes a root certificate in `value` and no `verificationMethod`.",
+                          "type": "string",
+                          "enum": [
+                            "aki",
+                            "etsi_tl",
+                            "openid_federation",
+                            "x509"
+                          ]
+                        },
+                        "value": {
+                          "description": "Framework-specific authority value, for example the trust list URL for `etsi_tl` or the root certificate (base64 DER or PEM) for `x509`.",
+                          "type": "string"
+                        },
+                        "verificationMethod": {
+                          "description": "Verification method descriptor.",
+                          "anyOf": [
+                            {
+                              "type": "object",
+                              "propertyNames": {
+                                "type": "string"
+                              },
+                              "additionalProperties": {}
+                            },
+                            {
+                              "type": "string"
+                            }
+                          ]
+                        }
+                      },
+                      "additionalProperties": false
+                    }
+                  }
+                },
+                "required": [
+                  "version",
+                  "attestationLoS",
+                  "bindingType"
+                ],
+                "additionalProperties": false
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "embeddedDisclosurePolicy": {
+            "description": "Optional embedded disclosure policy.",
+            "anyOf": [
+              {
+                "oneOf": [
+                  {
+                    "type": "object",
+                    "properties": {
+                      "policy": {
+                        "type": "string",
+                        "const": "attestationBased",
+                        "description": "Attestation-based policy discriminator."
+                      },
+                      "values": {
+                        "type": "array",
+                        "items": {
+                          "type": "object",
+                          "properties": {
+                            "claims": {
+                              "description": "Claims constraints considered by policy evaluation.",
+                              "type": "array",
+                              "items": {}
+                            },
+                            "credentials": {
+                              "type": "array",
+                              "items": {},
+                              "description": "Credential constraints considered by policy evaluation."
+                            },
+                            "credential_sets": {
+                              "description": "Optional credential set constraints.",
+                              "type": "array",
+                              "items": {}
+                            }
+                          },
+                          "required": [
+                            "credentials"
+                          ],
+                          "additionalProperties": false
+                        },
+                        "description": "Attestation requirements used for policy enforcement."
+                      }
+                    },
+                    "required": [
+                      "policy",
+                      "values"
+                    ],
+                    "additionalProperties": false
+                  },
+                  {
+                    "type": "object",
+                    "properties": {
+                      "policy": {
+                        "type": "string",
+                        "const": "none",
+                        "description": "No disclosure policy enforcement."
+                      }
+                    },
+                    "required": [
+                      "policy"
+                    ],
+                    "additionalProperties": false
+                  },
+                  {
+                    "type": "object",
+                    "properties": {
+                      "policy": {
+                        "type": "string",
+                        "const": "allowList",
+                        "description": "Allow-list based policy discriminator."
+                      },
+                      "values": {
+                        "type": "array",
+                        "items": {
+                          "type": "string"
+                        },
+                        "description": "Allowed values for policy checks."
+                      }
+                    },
+                    "required": [
+                      "policy",
+                      "values"
+                    ],
+                    "additionalProperties": false
+                  },
+                  {
+                    "type": "object",
+                    "properties": {
+                      "policy": {
+                        "type": "string",
+                        "const": "rootOfTrust",
+                        "description": "Root-of-trust policy discriminator."
+                      },
+                      "values": {
+                        "type": "string",
+                        "description": "Root-of-trust identifier or reference."
+                      }
+                    },
+                    "required": [
+                      "policy",
+                      "values"
+                    ],
+                    "additionalProperties": false
+                  }
+                ],
+                "description": "Embedded disclosure policy configuration."
+              },
+              {
+                "type": "null"
+              }
+            ]
+          }
+        },
+        "required": [
+          "id",
+          "config",
+          "fields"
+        ],
+        "additionalProperties": false,
+        "description": "Payload for creating credential issuance configuration.",
+        "$defs": {
+          "__schema0": {
+            "type": "object",
+            "properties": {
+              "path": {
+                "type": "array",
+                "items": {
+                  "type": [
+                    "string",
+                    "number",
+                    "null"
+                  ]
+                },
+                "description": "Path to this claim inside the credential payload."
+              },
+              "type": {
+                "type": "string",
+                "enum": [
+                  "string",
+                  "number",
+                  "integer",
+                  "boolean",
+                  "object",
+                  "array"
+                ],
+                "description": "Data type of the claim value."
+              },
+              "defaultValue": {
+                "description": "Optional default value for this field."
+              },
+              "mandatory": {
+                "description": "Whether the field is required at issuance time.",
+                "type": "boolean"
+              },
+              "disclosable": {
+                "description": "Whether the claim is selectively disclosable.",
+                "type": "boolean"
+              },
+              "namespace": {
+                "description": "Optional namespace for claim grouping.",
+                "type": "string"
+              },
+              "display": {
+                "description": "Localized display metadata for this field.",
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "locale": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Locale tag for the display entry."
+                    },
+                    "name": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Human-readable field name."
+                    },
+                    "description": {
+                      "description": "Optional field description for this locale.",
+                      "type": "string"
+                    }
+                  },
+                  "required": [
+                    "locale",
+                    "name"
+                  ],
+                  "additionalProperties": false
+                }
+              },
+              "constraints": {
+                "description": "Optional validation constraints for the claim value.",
+                "type": "object",
+                "propertyNames": {
+                  "type": "string"
+                },
+                "additionalProperties": {}
+              },
+              "children": {
+                "description": "Nested child claim definitions for object or array fields.",
+                "type": "array",
+                "items": {
+                  "$ref": "#/$defs/CredentialConfigCreate/$defs/__schema0"
+                }
+              }
+            },
+            "required": [
+              "path",
+              "type"
+            ],
+            "additionalProperties": false
+          }
+        },
+        "title": "CredentialConfigCreate"
+      }
+    }
+  },
+  {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://eudiplo.dev/schemas/v2/IssuanceConfigFile.schema.json",
+    "title": "IssuanceConfigFile",
+    "type": "object",
+    "properties": {
+      "$schema": {
+        "type": "string",
+        "const": "https://eudiplo.dev/schemas/v2/IssuanceConfigFile.schema.json"
+      },
+      "metadata": {
+        "type": "object",
+        "properties": {
+          "generation": {
+            "type": "integer",
+            "minimum": 1,
+            "description": "Monotonically increasing configuration generation."
+          },
+          "ownership": {
+            "type": "string",
+            "enum": [
+              "unmanaged",
+              "file-managed"
+            ],
+            "description": "Requested ownership recorded when the document is applied."
+          }
+        },
+        "additionalProperties": false
+      },
+      "spec": {
+        "$ref": "#/$defs/IssuanceConfig"
+      }
+    },
+    "required": [
+      "$schema",
+      "spec"
+    ],
+    "additionalProperties": false,
+    "$defs": {
+      "IssuanceConfig": {
+        "type": "object",
+        "properties": {
+          "batchSize": {
+            "description": "Optional issuance batch size.",
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 9007199254740991
+          },
+          "dPopRequired": {
+            "description": "Require DPoP proofs for issuance endpoints.",
+            "type": "boolean"
+          },
+          "walletAttestationRequired": {
+            "description": "Default wallet attestation requirement for managed authorization servers.",
+            "type": "boolean"
+          },
+          "walletProviderTrustLists": {
+            "description": "Shared wallet provider trust lists for key attestations and default authorization server wallet authentication.",
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": {
+                "trustListId": {
+                  "type": "string",
+                  "minLength": 1
+                },
+                "url": {
+                  "description": "URL of the wallet provider trust list.",
+                  "type": "string",
+                  "format": "uri"
+                },
+                "verifierKey": {
+                  "description": "Optional verifier key material used for trust list verification.",
+                  "type": "object",
+                  "propertyNames": {
+                    "type": "string"
+                  },
+                  "additionalProperties": {}
+                },
+                "verifierX509Der": {
+                  "description": "Optional verifier certificate in DER/base64 form.",
+                  "type": "string"
+                }
+              },
+              "additionalProperties": false
+            }
+          },
+          "signingKeyId": {
+            "description": "Default signing key chain id for credential issuance.",
+            "type": "string",
+            "minLength": 1
+          },
+          "authorizationServers": {
+            "minItems": 1,
+            "type": "array",
+            "items": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "type": {
+                      "type": "string",
+                      "const": "external",
+                      "description": "Use an externally managed authorization server."
+                    },
+                    "id": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Authorization server identifier."
+                    },
+                    "issuer": {
+                      "type": "string",
+                      "format": "uri",
+                      "description": "Issuer URL for the external authorization server."
+                    },
+                    "sessionBinding": {
+                      "description": "Explicit mapping from an external access-token claim to an existing issuance session.",
+                      "type": "object",
+                      "properties": {
+                        "method": {
+                          "type": "string",
+                          "const": "access_token_claim",
+                          "description": "Read the correlation value from a configured access-token claim."
+                        },
+                        "claim": {
+                          "type": "string",
+                          "minLength": 1,
+                          "description": "Claim name that contains the issuance-session correlation value."
+                        }
+                      },
+                      "required": [
+                        "method",
+                        "claim"
+                      ],
+                      "additionalProperties": false
+                    },
+                    "label": {
+                      "description": "Optional display label for UI selection.",
+                      "type": "string"
+                    },
+                    "enabled": {
+                      "description": "Whether this authorization server entry is enabled.",
+                      "type": "boolean"
+                    }
+                  },
+                  "required": [
+                    "type",
+                    "id",
+                    "issuer"
+                  ],
+                  "additionalProperties": false
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "type": {
+                      "type": "string",
+                      "const": "oid4vp",
+                      "description": "Use OID4VP-based authorization server chaining."
+                    },
+                    "id": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Authorization server identifier."
+                    },
+                    "presentationConfigId": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Presentation configuration id used during authorization."
+                    },
+                    "immediateWalletRedirect": {
+                      "description": "Redirect wallets immediately after authorization response creation.",
+                      "type": "boolean"
+                    },
+                    "token": {
+                      "description": "Optional token issuance settings.",
+                      "type": "object",
+                      "properties": {
+                        "lifetimeSeconds": {
+                          "description": "Access token lifetime in seconds.",
+                          "type": "number",
+                          "minimum": 60
+                        },
+                        "signingKeyId": {
+                          "description": "Optional key chain id used to sign issued tokens.",
+                          "type": "string",
+                          "minLength": 1
+                        },
+                        "refreshTokenEnabled": {
+                          "description": "Enable issuing refresh tokens.",
+                          "type": "boolean"
+                        },
+                        "refreshTokenExpiresInSeconds": {
+                          "description": "Refresh token lifetime in seconds.",
+                          "type": "number",
+                          "minimum": 60
+                        }
+                      },
+                      "additionalProperties": false
+                    },
+                    "requireDPoP": {
+                      "description": "Require DPoP proofs for token/credential requests.",
+                      "type": "boolean"
+                    },
+                    "walletAttestationRequired": {
+                      "description": "Require wallet attestation for this authorization server.",
+                      "type": "boolean"
+                    },
+                    "walletProviderTrustLists": {
+                      "description": "Optional wallet provider trust list references for this authorization server.",
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "trustListId": {
+                            "type": "string",
+                            "minLength": 1
+                          },
+                          "url": {
+                            "description": "URL of the wallet provider trust list.",
+                            "type": "string",
+                            "format": "uri"
+                          },
+                          "verifierKey": {
+                            "description": "Optional verifier key material used for trust list verification.",
+                            "type": "object",
+                            "propertyNames": {
+                              "type": "string"
+                            },
+                            "additionalProperties": {}
+                          },
+                          "verifierX509Der": {
+                            "description": "Optional verifier certificate in DER/base64 form.",
+                            "type": "string"
+                          }
+                        },
+                        "additionalProperties": false
+                      }
+                    },
+                    "label": {
+                      "description": "Optional display label for UI selection.",
+                      "type": "string"
+                    },
+                    "enabled": {
+                      "description": "Whether this authorization server entry is enabled.",
+                      "type": "boolean"
+                    }
+                  },
+                  "required": [
+                    "type",
+                    "id",
+                    "presentationConfigId"
+                  ],
+                  "additionalProperties": false
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "type": {
+                      "type": "string",
+                      "const": "chained",
+                      "description": "Use upstream OIDC as authorization source."
+                    },
+                    "id": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Authorization server identifier."
+                    },
+                    "upstream": {
+                      "type": "object",
+                      "properties": {
+                        "issuer": {
+                          "type": "string",
+                          "format": "uri",
+                          "description": "Upstream OIDC issuer URL."
+                        },
+                        "clientId": {
+                          "type": "string",
+                          "minLength": 1,
+                          "description": "Client id for upstream OIDC authentication."
+                        },
+                        "clientSecret": {
+                          "description": "Optional client secret for upstream OIDC authentication.",
+                          "type": "string",
+                          "minLength": 1
+                        },
+                        "scopes": {
+                          "description": "Optional scopes requested from the upstream issuer.",
+                          "type": "array",
+                          "items": {
+                            "type": "string",
+                            "minLength": 1
+                          }
+                        }
+                      },
+                      "required": [
+                        "issuer",
+                        "clientId"
+                      ],
+                      "additionalProperties": false,
+                      "description": "Upstream OIDC connection settings."
+                    },
+                    "token": {
+                      "description": "Optional token issuance settings.",
+                      "type": "object",
+                      "properties": {
+                        "lifetimeSeconds": {
+                          "description": "Access token lifetime in seconds.",
+                          "type": "number",
+                          "minimum": 60
+                        },
+                        "signingKeyId": {
+                          "description": "Optional key chain id used to sign issued tokens.",
+                          "type": "string",
+                          "minLength": 1
+                        },
+                        "refreshTokenEnabled": {
+                          "description": "Enable issuing refresh tokens.",
+                          "type": "boolean"
+                        },
+                        "refreshTokenExpiresInSeconds": {
+                          "description": "Refresh token lifetime in seconds.",
+                          "type": "number",
+                          "minimum": 60
+                        }
+                      },
+                      "additionalProperties": false
+                    },
+                    "requireDPoP": {
+                      "description": "Require DPoP proofs for token/credential requests.",
+                      "type": "boolean"
+                    },
+                    "walletAttestationRequired": {
+                      "description": "Require wallet attestation for this authorization server.",
+                      "type": "boolean"
+                    },
+                    "walletProviderTrustLists": {
+                      "description": "Optional wallet provider trust list references for this authorization server.",
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "trustListId": {
+                            "type": "string",
+                            "minLength": 1
+                          },
+                          "url": {
+                            "description": "URL of the wallet provider trust list.",
+                            "type": "string",
+                            "format": "uri"
+                          },
+                          "verifierKey": {
+                            "description": "Optional verifier key material used for trust list verification.",
+                            "type": "object",
+                            "propertyNames": {
+                              "type": "string"
+                            },
+                            "additionalProperties": {}
+                          },
+                          "verifierX509Der": {
+                            "description": "Optional verifier certificate in DER/base64 form.",
+                            "type": "string"
+                          }
+                        },
+                        "additionalProperties": false
+                      }
+                    },
+                    "label": {
+                      "description": "Optional display label for UI selection.",
+                      "type": "string"
+                    },
+                    "enabled": {
+                      "description": "Whether this authorization server entry is enabled.",
+                      "type": "boolean"
+                    }
+                  },
+                  "required": [
+                    "type",
+                    "id",
+                    "upstream"
+                  ],
+                  "additionalProperties": false
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "type": {
+                      "type": "string",
+                      "const": "built-in",
+                      "description": "Use EUDIPLO built-in authorization server."
+                    },
+                    "id": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Authorization server identifier."
+                    },
+                    "token": {
+                      "description": "Optional token issuance settings.",
+                      "type": "object",
+                      "properties": {
+                        "lifetimeSeconds": {
+                          "description": "Access token lifetime in seconds.",
+                          "type": "number",
+                          "minimum": 60
+                        },
+                        "signingKeyId": {
+                          "description": "Optional key chain id used to sign issued tokens.",
+                          "type": "string",
+                          "minLength": 1
+                        },
+                        "refreshTokenEnabled": {
+                          "description": "Enable issuing refresh tokens.",
+                          "type": "boolean"
+                        },
+                        "refreshTokenExpiresInSeconds": {
+                          "description": "Refresh token lifetime in seconds.",
+                          "type": "number",
+                          "minimum": 60
+                        }
+                      },
+                      "additionalProperties": false
+                    },
+                    "requireDPoP": {
+                      "description": "Require DPoP proofs for token/credential requests.",
+                      "type": "boolean"
+                    },
+                    "walletAttestationRequired": {
+                      "description": "Require wallet attestation for this authorization server.",
+                      "type": "boolean"
+                    },
+                    "walletProviderTrustLists": {
+                      "description": "Optional wallet provider trust list references for this authorization server.",
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "trustListId": {
+                            "type": "string",
+                            "minLength": 1
+                          },
+                          "url": {
+                            "description": "URL of the wallet provider trust list.",
+                            "type": "string",
+                            "format": "uri"
+                          },
+                          "verifierKey": {
+                            "description": "Optional verifier key material used for trust list verification.",
+                            "type": "object",
+                            "propertyNames": {
+                              "type": "string"
+                            },
+                            "additionalProperties": {}
+                          },
+                          "verifierX509Der": {
+                            "description": "Optional verifier certificate in DER/base64 form.",
+                            "type": "string"
+                          }
+                        },
+                        "additionalProperties": false
+                      }
+                    },
+                    "label": {
+                      "description": "Optional display label for UI selection.",
+                      "type": "string"
+                    },
+                    "enabled": {
+                      "description": "Whether this authorization server entry is enabled.",
+                      "type": "boolean"
+                    }
+                  },
+                  "required": [
+                    "type",
+                    "id"
+                  ],
+                  "additionalProperties": false
+                }
+              ],
+              "description": "Supported authorization server configurations."
+            },
+            "description": "Configured authorization server entries."
+          },
+          "federation": {
+            "description": "Optional OpenID Federation settings.",
+            "anyOf": [
+              {
+                "type": "object",
+                "properties": {
+                  "role": {
+                    "description": "Federation role for this issuer.",
+                    "type": "string",
+                    "enum": [
+                      "trust_anchor",
+                      "intermediate",
+                      "leaf"
+                    ]
+                  },
+                  "mode": {
+                    "description": "Federation operation mode.",
+                    "type": "string",
+                    "enum": [
+                      "federation-only",
+                      "hybrid"
+                    ]
+                  },
+                  "entityId": {
+                    "description": "Optional local federation entity id.",
+                    "type": "string"
+                  },
+                  "enforceSigningPolicy": {
+                    "description": "Enforce strict signing policy checks.",
+                    "type": "boolean"
+                  },
+                  "cacheTtlSeconds": {
+                    "description": "Cache time-to-live for federation metadata in seconds.",
+                    "type": "integer",
+                    "minimum": 1,
+                    "maximum": 9007199254740991
+                  },
+                  "trustAnchors": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "entityId": {
+                          "type": "string",
+                          "minLength": 1,
+                          "description": "Federation trust anchor entity id."
+                        },
+                        "entityConfigurationUri": {
+                          "type": "string",
+                          "format": "uri",
+                          "description": "Entity configuration URI for the trust anchor."
+                        }
+                      },
+                      "required": [
+                        "entityId",
+                        "entityConfigurationUri"
+                      ],
+                      "additionalProperties": false
+                    },
+                    "description": "Federation trust anchors."
+                  }
+                },
+                "required": [
+                  "trustAnchors"
+                ],
+                "additionalProperties": false
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "registrationCertificate": {
+            "description": "Optional registration certificate settings.",
+            "anyOf": [
+              {
+                "type": "object",
+                "properties": {
+                  "enabled": {
+                    "description": "Enable issuer registration certificate support.",
+                    "type": "boolean"
+                  },
+                  "mode": {
+                    "description": "How registration certificate data is provided.",
+                    "type": "string",
+                    "enum": [
+                      "import",
+                      "generate"
+                    ]
+                  },
+                  "jwt": {
+                    "description": "Optional registration certificate JWT when using import mode.",
+                    "type": "string"
+                  },
+                  "privacyPolicy": {
+                    "description": "Optional privacy policy URI.",
+                    "type": "string"
+                  },
+                  "supportUri": {
+                    "description": "Optional support URI.",
+                    "type": "string"
+                  }
+                },
+                "additionalProperties": false
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "display": {
+            "description": "Localized issuer metadata shown to wallets.",
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "description": "Issuer display name.",
+                  "type": "string"
+                },
+                "locale": {
+                  "description": "Locale tag for this display entry.",
+                  "type": "string"
+                },
+                "logo": {
+                  "description": "Optional issuer logo metadata.",
+                  "type": "object",
+                  "properties": {
+                    "uri": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Logo URI."
+                    },
+                    "alt_text": {
+                      "description": "Optional localized alternative text.",
+                      "type": "string"
+                    }
+                  },
+                  "required": [
+                    "uri"
+                  ],
+                  "additionalProperties": {}
+                }
+              },
+              "additionalProperties": {}
+            }
+          },
+          "notificationEndpointEnabled": {
+            "description": "Whether the OID4VCI notification endpoint is exposed for this issuance configuration.",
+            "type": "boolean"
+          },
+          "credentialResponseEncryption": {
+            "description": "Enable encrypted credential responses.",
+            "type": "boolean"
+          },
+          "credentialRequestEncryption": {
+            "description": "Require encrypted credential requests.",
+            "type": "boolean"
+          },
+          "txCodeMaxAttempts": {
+            "description": "Maximum verification attempts for transaction codes. Null resets to defaults.",
+            "anyOf": [
+              {
+                "type": "integer",
+                "minimum": 1,
+                "maximum": 9007199254740991
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "offerLifetimeSeconds": {
+            "description": "Default lifetime of credential offers in seconds. Can be overridden per offer request. Null or unset: offers do not expire.",
+            "anyOf": [
+              {
+                "type": "integer",
+                "minimum": 1,
+                "maximum": 9007199254740991
+              },
+              {
+                "type": "null"
+              }
+            ]
+          }
+        },
+        "required": [
+          "authorizationServers"
+        ],
+        "additionalProperties": false,
+        "title": "IssuanceConfig"
+      }
+    }
+  },
+  {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://eudiplo.dev/schemas/v2/PresentationConfigFile.schema.json",
+    "title": "PresentationConfigFile",
+    "type": "object",
+    "properties": {
+      "$schema": {
+        "type": "string",
+        "const": "https://eudiplo.dev/schemas/v2/PresentationConfigFile.schema.json"
+      },
+      "metadata": {
+        "type": "object",
+        "properties": {
+          "generation": {
+            "type": "integer",
+            "minimum": 1,
+            "description": "Monotonically increasing configuration generation."
+          },
+          "ownership": {
+            "type": "string",
+            "enum": [
+              "unmanaged",
+              "file-managed"
+            ],
+            "description": "Requested ownership recorded when the document is applied."
+          }
+        },
+        "additionalProperties": false
+      },
+      "spec": {
+        "allOf": [
+          {
+            "$ref": "#/$defs/PresentationConfigCreateDto"
+          },
+          {
+            "type": "object",
+            "required": [
+              "id"
+            ],
+            "properties": {
+              "id": {
+                "type": "string",
+                "minLength": 1
+              }
+            }
+          }
+        ]
+      }
+    },
+    "required": [
+      "$schema",
+      "spec"
+    ],
+    "additionalProperties": false,
+    "$defs": {
+      "PresentationConfigCreateDto": {
+        "type": "object",
+        "properties": {
+          "id": {
+            "type": "string",
+            "minLength": 1,
+            "description": "Presentation configuration identifier."
+          },
+          "description": {
+            "description": "Optional presentation configuration description.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "lifeTime": {
+            "description": "Presentation request lifetime in seconds.",
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 9007199254740991
+          },
+          "skewSeconds": {
+            "description": "Clock skew tolerance in seconds.",
+            "type": "integer",
+            "minimum": 0,
+            "maximum": 9007199254740991
+          },
+          "statusCheckMode": {
+            "description": "Revocation/status check mode.",
+            "type": "string",
+            "enum": [
+              "strict",
+              "best_effort",
+              "disabled"
+            ]
+          },
+          "dcql_query": {
+            "type": "object",
+            "properties": {
+              "credentials": {
+                "minItems": 1,
+                "type": "array",
+                "items": {
+                  "oneOf": [
+                    {
+                      "type": "object",
+                      "properties": {
+                        "id": {
+                          "type": "string",
+                          "minLength": 1,
+                          "pattern": "^[A-Za-z0-9_-]+$",
+                          "description": "Credential query identifier."
+                        },
+                        "multiple": {
+                          "description": "Allow multiple matching credentials.",
+                          "type": "boolean"
+                        },
+                        "claim_sets": {
+                          "description": "Optional claim set constraints.",
+                          "type": "array",
+                          "items": {
+                            "type": "array",
+                            "items": {
+                              "type": "string"
+                            }
+                          }
+                        },
+                        "trusted_authorities": {
+                          "description": "Optional trusted authority constraints.",
+                          "type": "array",
+                          "items": {
+                            "oneOf": [
+                              {
+                                "type": "object",
+                                "properties": {
+                                  "type": {
+                                    "type": "string",
+                                    "const": "etsi_tl",
+                                    "description": "Trusted authority type discriminator for ETSI trust lists."
+                                  },
+                                  "values": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "object",
+                                      "properties": {
+                                        "trustListId": {
+                                          "description": "Optional trust list id reference.",
+                                          "type": "string"
+                                        },
+                                        "url": {
+                                          "description": "Optional trust list URL reference.",
+                                          "anyOf": [
+                                            {
+                                              "type": "string",
+                                              "format": "uri"
+                                            },
+                                            {
+                                              "type": "string",
+                                              "pattern": "^<TENANT_URL>(?:\\/.*)?$"
+                                            }
+                                          ]
+                                        },
+                                        "verifierKey": {
+                                          "description": "Optional verifier key material.",
+                                          "type": "object",
+                                          "propertyNames": {
+                                            "type": "string"
+                                          },
+                                          "additionalProperties": {}
+                                        },
+                                        "verifierX509Der": {
+                                          "description": "Optional verifier certificate in DER/base64 form.",
+                                          "type": "string"
+                                        }
+                                      },
+                                      "additionalProperties": false
+                                    },
+                                    "description": "Trust list references for ETSI TL verification."
+                                  }
+                                },
+                                "required": [
+                                  "type",
+                                  "values"
+                                ],
+                                "additionalProperties": false
+                              },
+                              {
+                                "type": "object",
+                                "properties": {
+                                  "type": {
+                                    "type": "string",
+                                    "const": "openid_federation",
+                                    "description": "Trusted authority type discriminator for OpenID Federation."
+                                  },
+                                  "values": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "string"
+                                    },
+                                    "description": "OpenID Federation authority identifiers."
+                                  }
+                                },
+                                "required": [
+                                  "type",
+                                  "values"
+                                ],
+                                "additionalProperties": false
+                              }
+                            ]
+                          }
+                        },
+                        "format": {
+                          "type": "string",
+                          "const": "dc+sd-jwt",
+                          "description": "Credential format discriminator."
+                        },
+                        "meta": {
+                          "type": "object",
+                          "properties": {
+                            "vct_values": {
+                              "minItems": 1,
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "description": "Accepted VCT values."
+                            }
+                          },
+                          "required": [
+                            "vct_values"
+                          ],
+                          "additionalProperties": false
+                        },
+                        "claims": {
+                          "description": "Optional claim-level constraints.",
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "id": {
+                                "description": "Optional claim query id.",
+                                "type": "string"
+                              },
+                              "path": {
+                                "type": "array",
+                                "items": {
+                                  "type": [
+                                    "string",
+                                    "number"
+                                  ]
+                                },
+                                "description": "Path to the claim value in presented credentials."
+                              },
+                              "values": {
+                                "description": "Optional allowed values for the claim.",
+                                "type": "array",
+                                "items": {
+                                  "type": "string"
+                                }
+                              }
+                            },
+                            "required": [
+                              "path"
+                            ],
+                            "additionalProperties": false
+                          }
+                        }
+                      },
+                      "required": [
+                        "id",
+                        "format",
+                        "meta"
+                      ],
+                      "additionalProperties": false
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "id": {
+                          "type": "string",
+                          "minLength": 1,
+                          "pattern": "^[A-Za-z0-9_-]+$",
+                          "description": "Credential query identifier."
+                        },
+                        "multiple": {
+                          "description": "Allow multiple matching credentials.",
+                          "type": "boolean"
+                        },
+                        "claim_sets": {
+                          "description": "Optional claim set constraints.",
+                          "type": "array",
+                          "items": {
+                            "type": "array",
                             "items": {
                               "type": "string"
-                            }
+                            }
+                          }
+                        },
+                        "trusted_authorities": {
+                          "description": "Optional trusted authority constraints.",
+                          "type": "array",
+                          "items": {
+                            "oneOf": [
+                              {
+                                "type": "object",
+                                "properties": {
+                                  "type": {
+                                    "type": "string",
+                                    "const": "etsi_tl",
+                                    "description": "Trusted authority type discriminator for ETSI trust lists."
+                                  },
+                                  "values": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "object",
+                                      "properties": {
+                                        "trustListId": {
+                                          "description": "Optional trust list id reference.",
+                                          "type": "string"
+                                        },
+                                        "url": {
+                                          "description": "Optional trust list URL reference.",
+                                          "anyOf": [
+                                            {
+                                              "type": "string",
+                                              "format": "uri"
+                                            },
+                                            {
+                                              "type": "string",
+                                              "pattern": "^<TENANT_URL>(?:\\/.*)?$"
+                                            }
+                                          ]
+                                        },
+                                        "verifierKey": {
+                                          "description": "Optional verifier key material.",
+                                          "type": "object",
+                                          "propertyNames": {
+                                            "type": "string"
+                                          },
+                                          "additionalProperties": {}
+                                        },
+                                        "verifierX509Der": {
+                                          "description": "Optional verifier certificate in DER/base64 form.",
+                                          "type": "string"
+                                        }
+                                      },
+                                      "additionalProperties": false
+                                    },
+                                    "description": "Trust list references for ETSI TL verification."
+                                  }
+                                },
+                                "required": [
+                                  "type",
+                                  "values"
+                                ],
+                                "additionalProperties": false
+                              },
+                              {
+                                "type": "object",
+                                "properties": {
+                                  "type": {
+                                    "type": "string",
+                                    "const": "openid_federation",
+                                    "description": "Trusted authority type discriminator for OpenID Federation."
+                                  },
+                                  "values": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "string"
+                                    },
+                                    "description": "OpenID Federation authority identifiers."
+                                  }
+                                },
+                                "required": [
+                                  "type",
+                                  "values"
+                                ],
+                                "additionalProperties": false
+                              }
+                            ]
+                          }
+                        },
+                        "format": {
+                          "type": "string",
+                          "const": "mso_mdoc",
+                          "description": "Credential format discriminator."
+                        },
+                        "meta": {
+                          "type": "object",
+                          "properties": {
+                            "doctype_value": {
+                              "type": "string",
+                              "minLength": 1,
+                              "description": "Expected mDoc doctype value."
+                            }
+                          },
+                          "required": [
+                            "doctype_value"
+                          ],
+                          "additionalProperties": false
+                        },
+                        "claims": {
+                          "description": "Optional mDoc claim-level constraints.",
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "id": {
+                                "description": "Optional claim query id.",
+                                "type": "string"
+                              },
+                              "path": {
+                                "type": "array",
+                                "items": {
+                                  "type": [
+                                    "string",
+                                    "number"
+                                  ]
+                                },
+                                "description": "Path to the claim value in presented credentials."
+                              },
+                              "values": {
+                                "description": "Optional allowed values for the claim.",
+                                "type": "array",
+                                "items": {
+                                  "type": "string"
+                                }
+                              },
+                              "intent_to_retain": {
+                                "description": "Whether relying party intends to retain the claim.",
+                                "type": "boolean"
+                              }
+                            },
+                            "required": [
+                              "path"
+                            ],
+                            "additionalProperties": false
+                          }
+                        }
+                      },
+                      "required": [
+                        "id",
+                        "format",
+                        "meta"
+                      ],
+                      "additionalProperties": false
+                    }
+                  ]
+                },
+                "description": "Credential queries requested by the verifier."
+              },
+              "credential_sets": {
+                "description": "Optional higher-level credential set requirements.",
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "options": {
+                      "minItems": 1,
+                      "type": "array",
+                      "items": {
+                        "minItems": 1,
+                        "type": "array",
+                        "items": {
+                          "type": "string"
+                        }
+                      },
+                      "description": "Alternative credential query id combinations."
+                    },
+                    "required": {
+                      "description": "Whether this credential set is mandatory.",
+                      "type": "boolean"
+                    }
+                  },
+                  "required": [
+                    "options"
+                  ],
+                  "additionalProperties": false
+                }
+              }
+            },
+            "required": [
+              "credentials"
+            ],
+            "additionalProperties": false,
+            "description": "DCQL query defining requested credentials and claims."
+          },
+          "transaction_data": {
+            "description": "Optional transaction data descriptors.",
+            "anyOf": [
+              {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "type": {
+                      "type": "string",
+                      "description": "Transaction data type identifier."
+                    },
+                    "credential_ids": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "description": "Credential query ids this transaction data applies to."
+                    },
+                    "payload": {
+                      "description": "Transaction details. Required for TS12 SCA transaction data."
+                    }
+                  },
+                  "required": [
+                    "type",
+                    "credential_ids"
+                  ],
+                  "additionalProperties": {}
+                }
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "registration_cert": {
+            "description": "Optional registration certificate request settings.",
+            "anyOf": [
+              {
+                "type": "object",
+                "properties": {
+                  "id": {
+                    "type": "string"
+                  },
+                  "body": {
+                    "type": "object",
+                    "properties": {
+                      "privacy_policy": {
+                        "type": "string"
+                      },
+                      "support_uri": {
+                        "type": "string"
+                      },
+                      "intermediary": {
+                        "type": "string"
+                      },
+                      "purpose": {
+                        "type": "array",
+                        "items": {
+                          "type": "object",
+                          "properties": {
+                            "lang": {
+                              "type": "string"
+                            },
+                            "content": {
+                              "type": "string"
+                            }
+                          },
+                          "required": [
+                            "lang",
+                            "content"
+                          ],
+                          "additionalProperties": false
+                        }
+                      },
+                      "credentials": {
+                        "type": "array",
+                        "items": {
+                          "type": "object",
+                          "propertyNames": {
+                            "type": "string"
+                          },
+                          "additionalProperties": {}
+                        }
+                      },
+                      "provides_attestations": {
+                        "type": "array",
+                        "items": {
+                          "type": "string",
+                          "minLength": 1
+                        }
+                      }
+                    },
+                    "additionalProperties": false
+                  },
+                  "jwt": {
+                    "type": "string"
+                  }
+                },
+                "additionalProperties": false
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "registrationCertImportJwt": {
+            "description": "Optional imported registration certificate JWT.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "registrationCertImportId": {
+            "description": "Optional registrar-side registration certificate id.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "registrationCertBodyPrivacyPolicy": {
+            "description": "Optional registration certificate privacy policy URI.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "registrationCertBodySupportUri": {
+            "description": "Optional registration certificate support URI.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "registrationCertBodyIntermediary": {
+            "description": "Optional registration certificate intermediary.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "registrationCertBodyPurpose": {
+            "description": "Optional registration certificate purpose entries.",
+            "anyOf": [
+              {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "lang": {
+                      "type": "string"
+                    },
+                    "content": {
+                      "type": "string"
+                    }
+                  },
+                  "additionalProperties": false
+                }
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "webhookEndpointId": {
+            "description": "Optional webhook endpoint id for presentation callbacks.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "attached": {
+            "description": "Optional attachments included with presentation requests.",
+            "anyOf": [
+              {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "format": {
+                      "type": "string",
+                      "description": "Attachment format identifier."
+                    },
+                    "data": {
+                      "description": "Attachment payload."
+                    },
+                    "credential_ids": {
+                      "description": "Optional credential query ids bound to this attachment.",
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      }
+                    }
+                  },
+                  "required": [
+                    "format",
+                    "data"
+                  ],
+                  "additionalProperties": false
+                }
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "redirectUri": {
+            "description": "Optional redirect URI after presentation completion.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "accessKeyChainId": {
+            "description": "Optional key chain id for access token/auth operations.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "readerAuth": {
+            "description": "Whether reader authentication is required for mDoc requests.",
+            "type": [
+              "boolean",
+              "null"
+            ]
+          }
+        },
+        "required": [
+          "id",
+          "dcql_query"
+        ],
+        "additionalProperties": false,
+        "title": "PresentationConfigCreateDto"
+      }
+    }
+  },
+  {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://eudiplo.dev/schemas/v3/IssuanceConfigFile.schema.json",
+    "title": "IssuanceConfigFile",
+    "type": "object",
+    "properties": {
+      "$schema": {
+        "type": "string",
+        "const": "https://eudiplo.dev/schemas/v3/IssuanceConfigFile.schema.json"
+      },
+      "metadata": {
+        "type": "object",
+        "properties": {
+          "generation": {
+            "type": "integer",
+            "minimum": 1,
+            "description": "Monotonically increasing configuration generation."
+          },
+          "ownership": {
+            "type": "string",
+            "enum": [
+              "unmanaged",
+              "file-managed"
+            ],
+            "description": "Requested ownership recorded when the document is applied."
+          }
+        },
+        "additionalProperties": false
+      },
+      "spec": {
+        "$ref": "#/$defs/IssuanceConfig"
+      }
+    },
+    "required": [
+      "$schema",
+      "spec"
+    ],
+    "additionalProperties": false,
+    "$defs": {
+      "IssuanceConfig": {
+        "type": "object",
+        "properties": {
+          "batchSize": {
+            "description": "Optional issuance batch size.",
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 9007199254740991
+          },
+          "dPopRequired": {
+            "description": "Require DPoP proofs for issuance endpoints.",
+            "type": "boolean"
+          },
+          "walletAttestationRequired": {
+            "description": "Default wallet attestation requirement for managed authorization servers.",
+            "type": "boolean"
+          },
+          "walletProviderTrustLists": {
+            "description": "Shared wallet provider trust lists for key attestations and default authorization server wallet authentication.",
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": {
+                "trustListId": {
+                  "type": "string",
+                  "minLength": 1
+                },
+                "url": {
+                  "description": "URL of the wallet provider trust list.",
+                  "type": "string",
+                  "format": "uri"
+                },
+                "verifierKey": {
+                  "description": "Optional verifier key material used for trust list verification.",
+                  "type": "object",
+                  "propertyNames": {
+                    "type": "string"
+                  },
+                  "additionalProperties": {}
+                },
+                "verifierKeyPem": {
+                  "description": "Optional verifier public key in SPKI PEM form (-----BEGIN PUBLIC KEY-----).",
+                  "type": "string",
+                  "pattern": "^\\s*-----BEGIN PUBLIC KEY-----[A-Za-z0-9+/=\\s]+-----END PUBLIC KEY-----\\s*$"
+                },
+                "verifierX509Der": {
+                  "description": "Optional verifier certificate in DER/base64 form.",
+                  "type": "string"
+                }
+              },
+              "additionalProperties": false
+            }
+          },
+          "signingKeyId": {
+            "description": "Default signing key chain id for credential issuance.",
+            "type": "string",
+            "minLength": 1
+          },
+          "authorizationServers": {
+            "minItems": 1,
+            "type": "array",
+            "items": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "type": {
+                      "type": "string",
+                      "const": "external",
+                      "description": "Use an externally managed authorization server."
+                    },
+                    "id": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Authorization server identifier."
+                    },
+                    "issuer": {
+                      "type": "string",
+                      "format": "uri",
+                      "description": "Issuer URL for the external authorization server."
+                    },
+                    "sessionBinding": {
+                      "description": "Explicit mapping from an external access-token claim to an existing issuance session.",
+                      "type": "object",
+                      "properties": {
+                        "method": {
+                          "type": "string",
+                          "const": "access_token_claim",
+                          "description": "Read the correlation value from a configured access-token claim."
+                        },
+                        "claim": {
+                          "type": "string",
+                          "minLength": 1,
+                          "description": "Claim name that contains the issuance-session correlation value."
+                        }
+                      },
+                      "required": [
+                        "method",
+                        "claim"
+                      ],
+                      "additionalProperties": false
+                    },
+                    "label": {
+                      "description": "Optional display label for UI selection.",
+                      "type": "string"
+                    },
+                    "enabled": {
+                      "description": "Whether this authorization server entry is enabled.",
+                      "type": "boolean"
+                    }
+                  },
+                  "required": [
+                    "type",
+                    "id",
+                    "issuer"
+                  ],
+                  "additionalProperties": false
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "type": {
+                      "type": "string",
+                      "const": "oid4vp",
+                      "description": "Use OID4VP-based authorization server chaining."
+                    },
+                    "id": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Authorization server identifier."
+                    },
+                    "presentationConfigId": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Presentation configuration id used during authorization."
+                    },
+                    "immediateWalletRedirect": {
+                      "description": "Redirect wallets immediately after authorization response creation.",
+                      "type": "boolean"
+                    },
+                    "token": {
+                      "description": "Optional token issuance settings.",
+                      "type": "object",
+                      "properties": {
+                        "lifetimeSeconds": {
+                          "description": "Access token lifetime in seconds.",
+                          "type": "number",
+                          "minimum": 60
+                        },
+                        "signingKeyId": {
+                          "description": "Optional key chain id used to sign issued tokens.",
+                          "type": "string",
+                          "minLength": 1
+                        },
+                        "refreshTokenEnabled": {
+                          "description": "Enable issuing refresh tokens.",
+                          "type": "boolean"
+                        },
+                        "refreshTokenExpiresInSeconds": {
+                          "description": "Refresh token lifetime in seconds.",
+                          "type": "number",
+                          "minimum": 60
+                        }
+                      },
+                      "additionalProperties": false
+                    },
+                    "requireDPoP": {
+                      "description": "Require DPoP proofs for token/credential requests.",
+                      "type": "boolean"
+                    },
+                    "walletAttestationRequired": {
+                      "description": "Require wallet attestation for this authorization server.",
+                      "type": "boolean"
+                    },
+                    "walletProviderTrustLists": {
+                      "description": "Optional wallet provider trust list references for this authorization server.",
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "trustListId": {
+                            "type": "string",
+                            "minLength": 1
+                          },
+                          "url": {
+                            "description": "URL of the wallet provider trust list.",
+                            "type": "string",
+                            "format": "uri"
+                          },
+                          "verifierKey": {
+                            "description": "Optional verifier key material used for trust list verification.",
+                            "type": "object",
+                            "propertyNames": {
+                              "type": "string"
+                            },
+                            "additionalProperties": {}
+                          },
+                          "verifierKeyPem": {
+                            "description": "Optional verifier public key in SPKI PEM form (-----BEGIN PUBLIC KEY-----).",
+                            "type": "string",
+                            "pattern": "^\\s*-----BEGIN PUBLIC KEY-----[A-Za-z0-9+/=\\s]+-----END PUBLIC KEY-----\\s*$"
+                          },
+                          "verifierX509Der": {
+                            "description": "Optional verifier certificate in DER/base64 form.",
+                            "type": "string"
                           }
                         },
-                        "trusted_authorities": {
-                          "description": "Optional trusted authority constraints.",
-                          "type": "array",
-                          "items": {
-                            "oneOf": [
-                              {
-                                "type": "object",
-                                "properties": {
-                                  "type": {
-                                    "type": "string",
-                                    "const": "etsi_tl",
-                                    "description": "Trusted authority type discriminator for ETSI trust lists."
-                                  },
-                                  "values": {
-                                    "type": "array",
-                                    "items": {
-                                      "type": "object",
-                                      "properties": {
-                                        "trustListId": {
-                                          "description": "Optional trust list id reference.",
-                                          "type": "string"
-                                        },
-                                        "url": {
-                                          "description": "Optional trust list URL reference.",
-                                          "anyOf": [
-                                            {
-                                              "type": "string",
-                                              "format": "uri"
-                                            },
-                                            {
-                                              "type": "string",
-                                              "pattern": "^<TENANT_URL>(?:\\/.*)?$"
-                                            }
-                                          ]
-                                        },
-                                        "verifierKey": {
-                                          "description": "Optional verifier key material.",
-                                          "type": "object",
-                                          "propertyNames": {
-                                            "type": "string"
-                                          },
-                                          "additionalProperties": {}
-                                        },
-                                        "verifierX509Der": {
-                                          "description": "Optional verifier certificate in DER/base64 form.",
-                                          "type": "string"
-                                        }
-                                      },
-                                      "additionalProperties": false
-                                    },
-                                    "description": "Trust list references for ETSI TL verification."
-                                  }
-                                },
-                                "required": [
-                                  "type",
-                                  "values"
-                                ],
-                                "additionalProperties": false
-                              },
-                              {
-                                "type": "object",
-                                "properties": {
-                                  "type": {
-                                    "type": "string",
-                                    "const": "openid_federation",
-                                    "description": "Trusted authority type discriminator for OpenID Federation."
-                                  },
-                                  "values": {
-                                    "type": "array",
-                                    "items": {
-                                      "type": "string"
-                                    },
-                                    "description": "OpenID Federation authority identifiers."
-                                  }
-                                },
-                                "required": [
-                                  "type",
-                                  "values"
-                                ],
-                                "additionalProperties": false
-                              }
-                            ]
-                          }
+                        "additionalProperties": false
+                      }
+                    },
+                    "label": {
+                      "description": "Optional display label for UI selection.",
+                      "type": "string"
+                    },
+                    "enabled": {
+                      "description": "Whether this authorization server entry is enabled.",
+                      "type": "boolean"
+                    }
+                  },
+                  "required": [
+                    "type",
+                    "id",
+                    "presentationConfigId"
+                  ],
+                  "additionalProperties": false
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "type": {
+                      "type": "string",
+                      "const": "chained",
+                      "description": "Use upstream OIDC as authorization source."
+                    },
+                    "id": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Authorization server identifier."
+                    },
+                    "upstream": {
+                      "type": "object",
+                      "properties": {
+                        "issuer": {
+                          "type": "string",
+                          "format": "uri",
+                          "description": "Upstream OIDC issuer URL."
                         },
-                        "format": {
+                        "clientId": {
                           "type": "string",
-                          "const": "dc+sd-jwt",
-                          "description": "Credential format discriminator."
+                          "minLength": 1,
+                          "description": "Client id for upstream OIDC authentication."
                         },
-                        "meta": {
-                          "type": "object",
-                          "properties": {
-                            "vct_values": {
-                              "minItems": 1,
-                              "type": "array",
-                              "items": {
-                                "type": "string"
-                              },
-                              "description": "Accepted VCT values."
-                            }
-                          },
-                          "required": [
-                            "vct_values"
-                          ],
-                          "additionalProperties": false
+                        "clientSecret": {
+                          "description": "Optional client secret for upstream OIDC authentication.",
+                          "type": "string",
+                          "minLength": 1
                         },
-                        "claims": {
-                          "description": "Optional claim-level constraints.",
+                        "scopes": {
+                          "description": "Optional scopes requested from the upstream issuer.",
                           "type": "array",
                           "items": {
-                            "type": "object",
-                            "properties": {
-                              "id": {
-                                "description": "Optional claim query id.",
-                                "type": "string"
-                              },
-                              "path": {
-                                "type": "array",
-                                "items": {
-                                  "type": [
-                                    "string",
-                                    "number"
-                                  ]
-                                },
-                                "description": "Path to the claim value in presented credentials."
-                              },
-                              "values": {
-                                "description": "Optional allowed values for the claim.",
-                                "type": "array",
-                                "items": {
-                                  "type": "string"
-                                }
-                              }
-                            },
-                            "required": [
-                              "path"
-                            ],
-                            "additionalProperties": false
+                            "type": "string",
+                            "minLength": 1
                           }
                         }
                       },
                       "required": [
-                        "id",
-                        "format",
-                        "meta"
+                        "issuer",
+                        "clientId"
                       ],
-                      "additionalProperties": false
+                      "additionalProperties": false,
+                      "description": "Upstream OIDC connection settings."
                     },
-                    {
+                    "token": {
+                      "description": "Optional token issuance settings.",
                       "type": "object",
                       "properties": {
-                        "id": {
-                          "type": "string",
-                          "minLength": 1,
-                          "pattern": "^[A-Za-z0-9_-]+$",
-                          "description": "Credential query identifier."
-                        },
-                        "multiple": {
-                          "description": "Allow multiple matching credentials.",
-                          "type": "boolean"
-                        },
-                        "claim_sets": {
-                          "description": "Optional claim set constraints.",
-                          "type": "array",
-                          "items": {
-                            "type": "array",
-                            "items": {
-                              "type": "string"
-                            }
-                          }
-                        },
-                        "trusted_authorities": {
-                          "description": "Optional trusted authority constraints.",
-                          "type": "array",
-                          "items": {
-                            "oneOf": [
-                              {
-                                "type": "object",
-                                "properties": {
-                                  "type": {
-                                    "type": "string",
-                                    "const": "etsi_tl",
-                                    "description": "Trusted authority type discriminator for ETSI trust lists."
-                                  },
-                                  "values": {
-                                    "type": "array",
-                                    "items": {
-                                      "type": "object",
-                                      "properties": {
-                                        "trustListId": {
-                                          "description": "Optional trust list id reference.",
-                                          "type": "string"
-                                        },
-                                        "url": {
-                                          "description": "Optional trust list URL reference.",
-                                          "anyOf": [
-                                            {
-                                              "type": "string",
-                                              "format": "uri"
-                                            },
-                                            {
-                                              "type": "string",
-                                              "pattern": "^<TENANT_URL>(?:\\/.*)?$"
-                                            }
-                                          ]
-                                        },
-                                        "verifierKey": {
-                                          "description": "Optional verifier key material.",
-                                          "type": "object",
-                                          "propertyNames": {
-                                            "type": "string"
-                                          },
-                                          "additionalProperties": {}
-                                        },
-                                        "verifierX509Der": {
-                                          "description": "Optional verifier certificate in DER/base64 form.",
-                                          "type": "string"
-                                        }
-                                      },
-                                      "additionalProperties": false
-                                    },
-                                    "description": "Trust list references for ETSI TL verification."
-                                  }
-                                },
-                                "required": [
-                                  "type",
-                                  "values"
-                                ],
-                                "additionalProperties": false
-                              },
-                              {
-                                "type": "object",
-                                "properties": {
-                                  "type": {
-                                    "type": "string",
-                                    "const": "openid_federation",
-                                    "description": "Trusted authority type discriminator for OpenID Federation."
-                                  },
-                                  "values": {
-                                    "type": "array",
-                                    "items": {
-                                      "type": "string"
-                                    },
-                                    "description": "OpenID Federation authority identifiers."
-                                  }
-                                },
-                                "required": [
-                                  "type",
-                                  "values"
-                                ],
-                                "additionalProperties": false
-                              }
-                            ]
-                          }
+                        "lifetimeSeconds": {
+                          "description": "Access token lifetime in seconds.",
+                          "type": "number",
+                          "minimum": 60
                         },
-                        "format": {
+                        "signingKeyId": {
+                          "description": "Optional key chain id used to sign issued tokens.",
                           "type": "string",
-                          "const": "mso_mdoc",
-                          "description": "Credential format discriminator."
+                          "minLength": 1
                         },
-                        "meta": {
-                          "type": "object",
-                          "properties": {
-                            "doctype_value": {
-                              "type": "string",
-                              "minLength": 1,
-                              "description": "Expected mDoc doctype value."
-                            }
-                          },
-                          "required": [
-                            "doctype_value"
-                          ],
-                          "additionalProperties": false
+                        "refreshTokenEnabled": {
+                          "description": "Enable issuing refresh tokens.",
+                          "type": "boolean"
                         },
-                        "claims": {
-                          "description": "Optional mDoc claim-level constraints.",
-                          "type": "array",
-                          "items": {
-                            "type": "object",
-                            "properties": {
-                              "id": {
-                                "description": "Optional claim query id.",
-                                "type": "string"
-                              },
-                              "path": {
-                                "type": "array",
-                                "items": {
-                                  "type": [
-                                    "string",
-                                    "number"
-                                  ]
-                                },
-                                "description": "Path to the claim value in presented credentials."
-                              },
-                              "values": {
-                                "description": "Optional allowed values for the claim.",
-                                "type": "array",
-                                "items": {
-                                  "type": "string"
-                                }
-                              },
-                              "intent_to_retain": {
-                                "description": "Whether relying party intends to retain the claim.",
-                                "type": "boolean"
-                              }
-                            },
-                            "required": [
-                              "path"
-                            ],
-                            "additionalProperties": false
-                          }
-                        }
-                      },
-                      "required": [
-                        "id",
-                        "format",
-                        "meta"
-                      ],
+                        "refreshTokenExpiresInSeconds": {
+                          "description": "Refresh token lifetime in seconds.",
+                          "type": "number",
+                          "minimum": 60
+                        }
+                      },
                       "additionalProperties": false
-                    }
-                  ]
-                },
-                "description": "Credential queries requested by the verifier."
-              },
-              "credential_sets": {
-                "description": "Optional higher-level credential set requirements.",
-                "type": "array",
-                "items": {
-                  "type": "object",
-                  "properties": {
-                    "options": {
-                      "minItems": 1,
+                    },
+                    "requireDPoP": {
+                      "description": "Require DPoP proofs for token/credential requests.",
+                      "type": "boolean"
+                    },
+                    "walletAttestationRequired": {
+                      "description": "Require wallet attestation for this authorization server.",
+                      "type": "boolean"
+                    },
+                    "walletProviderTrustLists": {
+                      "description": "Optional wallet provider trust list references for this authorization server.",
                       "type": "array",
                       "items": {
-                        "minItems": 1,
-                        "type": "array",
-                        "items": {
-                          "type": "string"
-                        }
-                      },
-                      "description": "Alternative credential query id combinations."
+                        "type": "object",
+                        "properties": {
+                          "trustListId": {
+                            "type": "string",
+                            "minLength": 1
+                          },
+                          "url": {
+                            "description": "URL of the wallet provider trust list.",
+                            "type": "string",
+                            "format": "uri"
+                          },
+                          "verifierKey": {
+                            "description": "Optional verifier key material used for trust list verification.",
+                            "type": "object",
+                            "propertyNames": {
+                              "type": "string"
+                            },
+                            "additionalProperties": {}
+                          },
+                          "verifierKeyPem": {
+                            "description": "Optional verifier public key in SPKI PEM form (-----BEGIN PUBLIC KEY-----).",
+                            "type": "string",
+                            "pattern": "^\\s*-----BEGIN PUBLIC KEY-----[A-Za-z0-9+/=\\s]+-----END PUBLIC KEY-----\\s*$"
+                          },
+                          "verifierX509Der": {
+                            "description": "Optional verifier certificate in DER/base64 form.",
+                            "type": "string"
+                          }
+                        },
+                        "additionalProperties": false
+                      }
                     },
-                    "required": {
-                      "description": "Whether this credential set is mandatory.",
+                    "label": {
+                      "description": "Optional display label for UI selection.",
+                      "type": "string"
+                    },
+                    "enabled": {
+                      "description": "Whether this authorization server entry is enabled.",
                       "type": "boolean"
                     }
                   },
                   "required": [
-                    "options"
+                    "type",
+                    "id",
+                    "upstream"
                   ],
                   "additionalProperties": false
-                }
-              }
-            },
-            "required": [
-              "credentials"
-            ],
-            "additionalProperties": false,
-            "description": "DCQL query defining requested credentials and claims."
-          },
-          "transaction_data": {
-            "description": "Optional transaction data descriptors.",
-            "anyOf": [
-              {
-                "type": "array",
-                "items": {
+                },
+                {
                   "type": "object",
                   "properties": {
                     "type": {
                       "type": "string",
-                      "description": "Transaction data type identifier."
+                      "const": "built-in",
+                      "description": "Use EUDIPLO built-in authorization server."
                     },
-                    "credential_ids": {
+                    "id": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Authorization server identifier."
+                    },
+                    "token": {
+                      "description": "Optional token issuance settings.",
+                      "type": "object",
+                      "properties": {
+                        "lifetimeSeconds": {
+                          "description": "Access token lifetime in seconds.",
+                          "type": "number",
+                          "minimum": 60
+                        },
+                        "signingKeyId": {
+                          "description": "Optional key chain id used to sign issued tokens.",
+                          "type": "string",
+                          "minLength": 1
+                        },
+                        "refreshTokenEnabled": {
+                          "description": "Enable issuing refresh tokens.",
+                          "type": "boolean"
+                        },
+                        "refreshTokenExpiresInSeconds": {
+                          "description": "Refresh token lifetime in seconds.",
+                          "type": "number",
+                          "minimum": 60
+                        }
+                      },
+                      "additionalProperties": false
+                    },
+                    "requireDPoP": {
+                      "description": "Require DPoP proofs for token/credential requests.",
+                      "type": "boolean"
+                    },
+                    "walletAttestationRequired": {
+                      "description": "Require wallet attestation for this authorization server.",
+                      "type": "boolean"
+                    },
+                    "walletProviderTrustLists": {
+                      "description": "Optional wallet provider trust list references for this authorization server.",
                       "type": "array",
                       "items": {
-                        "type": "string"
-                      },
-                      "description": "Credential query ids this transaction data applies to."
+                        "type": "object",
+                        "properties": {
+                          "trustListId": {
+                            "type": "string",
+                            "minLength": 1
+                          },
+                          "url": {
+                            "description": "URL of the wallet provider trust list.",
+                            "type": "string",
+                            "format": "uri"
+                          },
+                          "verifierKey": {
+                            "description": "Optional verifier key material used for trust list verification.",
+                            "type": "object",
+                            "propertyNames": {
+                              "type": "string"
+                            },
+                            "additionalProperties": {}
+                          },
+                          "verifierKeyPem": {
+                            "description": "Optional verifier public key in SPKI PEM form (-----BEGIN PUBLIC KEY-----).",
+                            "type": "string",
+                            "pattern": "^\\s*-----BEGIN PUBLIC KEY-----[A-Za-z0-9+/=\\s]+-----END PUBLIC KEY-----\\s*$"
+                          },
+                          "verifierX509Der": {
+                            "description": "Optional verifier certificate in DER/base64 form.",
+                            "type": "string"
+                          }
+                        },
+                        "additionalProperties": false
+                      }
                     },
-                    "payload": {
-                      "description": "Transaction details. Required for TS12 SCA transaction data."
+                    "label": {
+                      "description": "Optional display label for UI selection.",
+                      "type": "string"
+                    },
+                    "enabled": {
+                      "description": "Whether this authorization server entry is enabled.",
+                      "type": "boolean"
                     }
                   },
                   "required": [
                     "type",
-                    "credential_ids"
+                    "id"
                   ],
-                  "additionalProperties": {}
+                  "additionalProperties": false
                 }
-              },
-              {
-                "type": "null"
-              }
-            ]
+              ],
+              "description": "Supported authorization server configurations."
+            },
+            "description": "Configured authorization server entries."
           },
-          "registration_cert": {
-            "description": "Optional registration certificate request settings.",
+          "federation": {
+            "description": "Optional OpenID Federation settings.",
             "anyOf": [
               {
                 "type": "object",
                 "properties": {
-                  "id": {
-                    "type": "string"
+                  "role": {
+                    "description": "Federation role for this issuer.",
+                    "type": "string",
+                    "enum": [
+                      "trust_anchor",
+                      "intermediate",
+                      "leaf"
+                    ]
                   },
-                  "body": {
-                    "type": "object",
-                    "properties": {
-                      "privacy_policy": {
-                        "type": "string"
-                      },
-                      "support_uri": {
-                        "type": "string"
-                      },
-                      "intermediary": {
-                        "type": "string"
-                      },
-                      "purpose": {
-                        "type": "array",
-                        "items": {
-                          "type": "object",
-                          "properties": {
-                            "lang": {
-                              "type": "string"
-                            },
-                            "content": {
-                              "type": "string"
-                            }
-                          },
-                          "required": [
-                            "lang",
-                            "content"
-                          ],
-                          "additionalProperties": false
-                        }
-                      },
-                      "credentials": {
-                        "type": "array",
-                        "items": {
-                          "type": "object",
-                          "propertyNames": {
-                            "type": "string"
-                          },
-                          "additionalProperties": {}
-                        }
-                      },
-                      "provides_attestations": {
-                        "type": "array",
-                        "items": {
+                  "mode": {
+                    "description": "Federation operation mode.",
+                    "type": "string",
+                    "enum": [
+                      "federation-only",
+                      "hybrid"
+                    ]
+                  },
+                  "entityId": {
+                    "description": "Optional local federation entity id.",
+                    "type": "string"
+                  },
+                  "enforceSigningPolicy": {
+                    "description": "Enforce strict signing policy checks.",
+                    "type": "boolean"
+                  },
+                  "cacheTtlSeconds": {
+                    "description": "Cache time-to-live for federation metadata in seconds.",
+                    "type": "integer",
+                    "minimum": 1,
+                    "maximum": 9007199254740991
+                  },
+                  "trustAnchors": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "entityId": {
                           "type": "string",
-                          "minLength": 1
+                          "minLength": 1,
+                          "description": "Federation trust anchor entity id."
+                        },
+                        "entityConfigurationUri": {
+                          "type": "string",
+                          "format": "uri",
+                          "description": "Entity configuration URI for the trust anchor."
                         }
-                      }
+                      },
+                      "required": [
+                        "entityId",
+                        "entityConfigurationUri"
+                      ],
+                      "additionalProperties": false
                     },
-                    "additionalProperties": false
-                  },
-                  "jwt": {
-                    "type": "string"
+                    "description": "Federation trust anchors."
                   }
                 },
+                "required": [
+                  "trustAnchors"
+                ],
                 "additionalProperties": false
               },
               {
@@ -21321,134 +22852,125 @@ var CONFIG_SCHEMAS = [
               }
             ]
           },
-          "registrationCertImportJwt": {
-            "description": "Optional imported registration certificate JWT.",
-            "type": [
-              "string",
-              "null"
-            ]
-          },
-          "registrationCertImportId": {
-            "description": "Optional registrar-side registration certificate id.",
-            "type": [
-              "string",
-              "null"
-            ]
-          },
-          "registrationCertBodyPrivacyPolicy": {
-            "description": "Optional registration certificate privacy policy URI.",
-            "type": [
-              "string",
-              "null"
-            ]
-          },
-          "registrationCertBodySupportUri": {
-            "description": "Optional registration certificate support URI.",
-            "type": [
-              "string",
-              "null"
-            ]
-          },
-          "registrationCertBodyIntermediary": {
-            "description": "Optional registration certificate intermediary.",
-            "type": [
-              "string",
-              "null"
-            ]
-          },
-          "registrationCertBodyPurpose": {
-            "description": "Optional registration certificate purpose entries.",
+          "registrationCertificate": {
+            "description": "Optional registration certificate settings.",
             "anyOf": [
               {
-                "type": "array",
-                "items": {
-                  "type": "object",
-                  "properties": {
-                    "lang": {
-                      "type": "string"
-                    },
-                    "content": {
-                      "type": "string"
-                    }
+                "type": "object",
+                "properties": {
+                  "enabled": {
+                    "description": "Enable issuer registration certificate support.",
+                    "type": "boolean"
                   },
-                  "additionalProperties": false
-                }
+                  "mode": {
+                    "description": "How registration certificate data is provided.",
+                    "type": "string",
+                    "enum": [
+                      "import",
+                      "generate"
+                    ]
+                  },
+                  "jwt": {
+                    "description": "Optional registration certificate JWT when using import mode.",
+                    "type": "string"
+                  },
+                  "privacyPolicy": {
+                    "description": "Optional privacy policy URI.",
+                    "type": "string"
+                  },
+                  "supportUri": {
+                    "description": "Optional support URI.",
+                    "type": "string"
+                  }
+                },
+                "additionalProperties": false
               },
               {
                 "type": "null"
               }
             ]
           },
-          "webhookEndpointId": {
-            "description": "Optional webhook endpoint id for presentation callbacks.",
-            "type": [
-              "string",
-              "null"
-            ]
-          },
-          "attached": {
-            "description": "Optional attachments included with presentation requests.",
-            "anyOf": [
-              {
-                "type": "array",
-                "items": {
+          "display": {
+            "description": "Localized issuer metadata shown to wallets.",
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "description": "Issuer display name.",
+                  "type": "string"
+                },
+                "locale": {
+                  "description": "Locale tag for this display entry.",
+                  "type": "string"
+                },
+                "logo": {
+                  "description": "Optional issuer logo metadata.",
                   "type": "object",
                   "properties": {
-                    "format": {
+                    "uri": {
                       "type": "string",
-                      "description": "Attachment format identifier."
-                    },
-                    "data": {
-                      "description": "Attachment payload."
+                      "minLength": 1,
+                      "description": "Logo URI."
                     },
-                    "credential_ids": {
-                      "description": "Optional credential query ids bound to this attachment.",
-                      "type": "array",
-                      "items": {
-                        "type": "string"
-                      }
+                    "alt_text": {
+                      "description": "Optional localized alternative text.",
+                      "type": "string"
                     }
                   },
                   "required": [
-                    "format",
-                    "data"
+                    "uri"
                   ],
-                  "additionalProperties": false
+                  "additionalProperties": {}
                 }
               },
+              "additionalProperties": {}
+            }
+          },
+          "notificationEndpointEnabled": {
+            "description": "Whether the OID4VCI notification endpoint is exposed for this issuance configuration.",
+            "type": "boolean"
+          },
+          "credentialResponseEncryption": {
+            "description": "Enable encrypted credential responses.",
+            "type": "boolean"
+          },
+          "credentialRequestEncryption": {
+            "description": "Require encrypted credential requests.",
+            "type": "boolean"
+          },
+          "txCodeMaxAttempts": {
+            "description": "Maximum verification attempts for transaction codes. Null resets to defaults.",
+            "anyOf": [
+              {
+                "type": "integer",
+                "minimum": 1,
+                "maximum": 9007199254740991
+              },
               {
                 "type": "null"
               }
             ]
           },
-          "redirectUri": {
-            "description": "Optional redirect URI after presentation completion.",
-            "type": [
-              "string",
-              "null"
-            ]
-          },
-          "accessKeyChainId": {
-            "description": "Optional key chain id for access token/auth operations.",
-            "type": [
-              "string",
-              "null"
-            ]
-          },
-          "readerAuth": {
-            "description": "Whether reader authentication is required for mDoc requests.",
-            "type": [
-              "boolean",
-              "null"
+          "offerLifetimeSeconds": {
+            "description": "Default lifetime of credential offers in seconds. Can be overridden per offer request. Null or unset: offers do not expire.",
+            "anyOf": [
+              {
+                "type": "integer",
+                "minimum": 1,
+                "maximum": 9007199254740991
+              },
+              {
+                "type": "null"
+              }
             ]
           }
         },
         "required": [
-          "id",
-          "dcql_query"
+          "authorizationServers"
         ],
         "additionalProperties": false,
-        "title": "PresentationConfigCreateDto"
+        "title": "IssuanceConfig"
       }
     }
   },
@@ -23723,7 +25245,10 @@ function createTenantCommand(context, setExitCode) {
 
 // src/commands/config/validate/index.ts
 function createValidateCommand(context, setExitCode) {
-  return new Command("validate").description("Validate CLI or tenant config-import files").argument("[scope]").argument("[path]").addOption(
+  return new Command("validate").description("Validate CLI or tenant config-import files").argument(
+    "[scope]",
+    '"tenant" for one tenant folder or "tenants" for a folder of tenant folders; omit it to validate the CLI config file'
+  ).argument("[path]", "the folder to validate (required with a scope)").addOption(
     new Option("--format <text|json>", "tenant report format").choices(["text", "json"]).default("text")
   ).action(async (scope, path2, options) => {
     const state = await loadCliState(context);
@@ -23842,9 +25367,9 @@ function buildComposeLogsArgs(service, options = {}) {
   }
   return args;
 }
-function buildComposePullArgs(service) {
+function buildComposePullArgs(services) {
   const args = ["pull"];
-  if (service !== void 0) {
+  for (const service of typeof services === "string" ? [services] : services ?? []) {
     assertServiceName(service);
     args.push(service);
   }
@@ -23882,23 +25407,28 @@ function parseContainerStates(stdout) {
   return entries.map((entry) => {
     const record = entry;
     const names = record.Names;
+    const status = String(record.Status ?? "");
+    const exitCode2 = typeof record.ExitCode === "number" ? record.ExitCode : /^Exited \((\d+)\)/.exec(status)?.[1];
     return {
       name: Array.isArray(names) ? String(names[0] ?? "") : String(names ?? record.Name ?? ""),
       state: String(record.State ?? ""),
-      status: String(record.Status ?? "")
+      status,
+      exitCode: exitCode2 === void 0 ? void 0 : Number(exitCode2)
     };
   });
 }
 function summarizeContainerStates(containers, projectName) {
   const name = "service containers";
-  if (containers.length === 0) {
+  const services = containers.filter((container) => !hasCompleted(container));
+  const completed = containers.length - services.length;
+  if (services.length === 0) {
     return {
       name,
       status: "warn",
       message: `No containers found for project ${projectName}. Start it with eudiplo up.`
     };
   }
-  const unhealthy = containers.filter(
+  const unhealthy = services.filter(
     (container) => container.status.toLowerCase().includes("unhealthy")
   );
   if (unhealthy.length > 0) {
@@ -23908,25 +25438,28 @@ function summarizeContainerStates(containers, projectName) {
       message: `Unhealthy: ${describe(unhealthy)}`
     };
   }
-  const notRunning = containers.filter(
+  const notRunning = services.filter(
     (container) => container.state.toLowerCase() !== "running"
   );
   if (notRunning.length > 0) {
     return {
       name,
       status: "warn",
-      message: `${containers.length - notRunning.length}/${containers.length} running. Not running: ${describe(notRunning)}`
+      message: `${services.length - notRunning.length}/${services.length} running. Not running: ${describe(notRunning)}`
     };
   }
-  const starting = containers.filter(
+  const starting = services.filter(
     (container) => container.status.toLowerCase().includes("starting")
   ).length;
   return {
     name,
     status: "pass",
-    message: `${containers.length} container(s) running${starting > 0 ? `, ${starting} still starting` : ""}.`
+    message: `${services.length} container(s) running${starting > 0 ? `, ${starting} still starting` : ""}${completed > 0 ? `, ${completed} completed` : ""}.`
   };
 }
+function hasCompleted(container) {
+  return container.state.toLowerCase() === "exited" && container.exitCode === 0;
+}
 function asArray(value) {
   return Array.isArray(value) ? value : [];
 }
@@ -24860,11 +26393,57 @@ async function runDriverCommand(config, command, parsed, context) {
   });
 }
 
+// src/commands/deployment/pass-through.ts
+function runtimeArguments(command, args) {
+  const options = command.options.flatMap((option) => option.long ?? []);
+  for (const arg of args) {
+    if (!arg.startsWith("--") || arg === "--") {
+      continue;
+    }
+    const flag = arg.split("=", 1)[0];
+    const similar = options.filter(
+      (option) => option !== flag && editDistance2(flag, option) <= 2
+    );
+    if (similar.length > 0) {
+      const suggestion = similar.length === 1 ? similar[0] : `one of ${similar.join(", ")}`;
+      command.error(
+        `error: unknown option '${arg}'
+(Did you mean ${suggestion}?)`,
+        { code: "commander.unknownOption" }
+      );
+    }
+  }
+  const separator = args.indexOf("--");
+  return separator === -1 ? args : [...args.slice(0, separator), ...args.slice(separator + 1)];
+}
+function editDistance2(a, b) {
+  const distances = Array.from(
+    { length: a.length + 1 },
+    (_, i2) => Array.from({ length: b.length + 1 }, (_2, j) => Math.max(i2, j))
+  );
+  for (let i2 = 1; i2 <= a.length; i2++) {
+    for (let j = 1; j <= b.length; j++) {
+      distances[i2][j] = Math.min(
+        distances[i2 - 1][j] + 1,
+        distances[i2][j - 1] + 1,
+        distances[i2 - 1][j - 1] + (a[i2 - 1] === b[j - 1] ? 0 : 1)
+      );
+      if (i2 > 1 && j > 1 && a[i2 - 1] === b[j - 2] && a[i2 - 2] === b[j - 1]) {
+        distances[i2][j] = Math.min(
+          distances[i2][j],
+          distances[i2 - 2][j - 2] + 1
+        );
+      }
+    }
+  }
+  return distances[a.length][b.length];
+}
+
 // src/commands/deployment/index.ts
 var descriptions = {
   up: "Start the selected Compose deployment",
   down: "Stop the selected Compose deployment",
-  logs: "Stream logs for the selected deployment",
+  logs: "Print the logs of the selected deployment, or stream them with --follow",
   ps: "List the running containers or pods for the selected deployment",
   restart: "Restart the workloads of the selected deployment",
   pull: "Download the configured images without changing configuration"
@@ -24879,8 +26458,8 @@ function createDeploymentCommands(context, setExitCode) {
     (name) => {
       const command = new Command(name).description(descriptions[name]).argument(
         "[args...]",
-        "additional arguments passed to the deployment runtime"
-      ).option("--instance <name>", "select a configured instance");
+        "additional arguments and options passed to the deployment runtime"
+      ).allowUnknownOption().option("--instance <name>", "select a configured instance");
       if (serviceScoped.has(name)) {
         command.option(
           "--service <name>",
@@ -24900,12 +26479,13 @@ function createDeploymentCommands(context, setExitCode) {
         );
       }
       return command.action(async (args, options) => {
+        const runtimeArgs = runtimeArguments(command, args);
         const { config } = await loadCliState(context);
         setExitCode(
           await runDriverCommand(
             config,
             name,
-            parsedArgs(name, void 0, args, options),
+            parsedArgs(name, void 0, runtimeArgs, options),
             context
           )
         );
@@ -24917,7 +26497,7 @@ function createDeploymentCommands(context, setExitCode) {
 // package.json
 var package_default = {
   name: "@eudiplo/cli",
-  version: "9.0.0",
+  version: "9.1.0-main.021024e",
   description: "Deployment-aware command line tools for EUDIPLO",
   private: false,
   type: "module",
@@ -24977,12 +26557,12 @@ var package_default = {
     "jsonc-parser": "^3.3.1"
   },
   devDependencies: {
-    "@biomejs/biome": "2.5.14",
-    "@types/node": "^26.4.0",
+    "@biomejs/biome": "2.5.15",
+    "@types/node": "^26.6.4",
     esbuild: "^0.28.2",
-    tsx: "^4.23.13",
+    tsx: "^4.23.15",
     typescript: "^7.0.2",
-    vitest: "5.0.2"
+    vitest: "5.0.3"
   }
 };
 
@@ -25360,6 +26940,13 @@ var kmsHealthCheck = {
           message: "This backend does not expose the KMS provider health endpoint."
         };
       }
+      if (response.status === 401 || response.status === 403) {
+        return {
+          name: "KMS providers",
+          status: "skip",
+          message: `Needs a tenant client with issuance:manage or presentation:manage (${response.reason}).`
+        };
+      }
       return {
         name: "KMS providers",
         status: "fail",
@@ -26270,6 +27857,10 @@ var managedImages = {
   EUDIPLO_IMAGE: "ghcr.io/eudiplo/eudiplo",
   EUDIPLO_CLIENT_IMAGE: "ghcr.io/eudiplo/eudiplo-client"
 };
+var managedServices = {
+  EUDIPLO_IMAGE: "eudiplo",
+  EUDIPLO_CLIENT_IMAGE: "eudiplo-client"
+};
 var legacyImages = {
   EUDIPLO_IMAGE: "ghcr.io/openwallet-foundation/eudiplo",
   EUDIPLO_CLIENT_IMAGE: "ghcr.io/openwallet-foundation/eudiplo-client"
@@ -26436,7 +28027,12 @@ async function runUpgradeCommand(config, parsed, context) {
     return 0;
   }
   await writeFile6(envPath, plan.content, "utf8");
-  const pulled = await runCompose(buildComposePullArgs(void 0), options);
+  const pulled = await runCompose(
+    buildComposePullArgs(
+      plan.changes.map((change) => managedServices[change.key])
+    ),
+    options
+  );
   if (pulled !== 0) {
     await writeFile6(envPath, original, "utf8");
     context.stderr.write(