@eudiplo/cli 9.0.0 → 9.1.0

package/dist/index.js

@@ -3099,12 +3099,13 @@ var require_data = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/fast-uri@3.1.6/node_modules/fast-uri/lib/utils.js
+// ../../node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/lib/utils.js
 var require_utils = __commonJS({
-  "../../node_modules/.pnpm/fast-uri@3.1.6/node_modules/fast-uri/lib/utils.js"(exports, module) {
+  "../../node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/lib/utils.js"(exports, module) {
     "use strict";
     var isUUID = RegExp.prototype.test.bind(/^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/iu);
     var isIPv4 = RegExp.prototype.test.bind(/^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)$/u);
+    var isPort = RegExp.prototype.test.bind(/^\d*$/u);
     var isHexPair = RegExp.prototype.test.bind(/^[\da-f]{2}$/iu);
     var isUnreserved = RegExp.prototype.test.bind(/^[\da-z\-._~]$/iu);
     var isPathCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:@/]$/u);
@@ -3570,8 +3571,12 @@ var require_utils = __commonJS({
         uriTokens.push(host);
       }
       if (typeof component.port === "number" || typeof component.port === "string") {
+        const port = String(component.port);
+        if (!isPort(port)) {
+          throw new TypeError("URI port is malformed.");
+        }
         uriTokens.push(":");
-        uriTokens.push(String(component.port));
+        uriTokens.push(port);
       }
       return uriTokens.length ? uriTokens.join("") : void 0;
     }
@@ -3596,9 +3601,9 @@ var require_utils = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/fast-uri@3.1.6/node_modules/fast-uri/lib/schemes.js
+// ../../node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/lib/schemes.js
 var require_schemes = __commonJS({
-  "../../node_modules/.pnpm/fast-uri@3.1.6/node_modules/fast-uri/lib/schemes.js"(exports, module) {
+  "../../node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/lib/schemes.js"(exports, module) {
     "use strict";
     var { isUUID } = require_utils();
     var URN_REG = /^([\da-z][\d\-a-z]{0,31}):((?:[\w!$'()*+,\-./:;=@]|%[\da-f]{2})+)$/iu;
@@ -3807,9 +3812,9 @@ var require_schemes = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/fast-uri@3.1.6/node_modules/fast-uri/index.js
+// ../../node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/index.js
 var require_fast_uri = __commonJS({
-  "../../node_modules/.pnpm/fast-uri@3.1.6/node_modules/fast-uri/index.js"(exports, module) {
+  "../../node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/index.js"(exports, module) {
     "use strict";
     var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
     var { SCHEMES, getSchemeHandler } = require_schemes();
@@ -4014,12 +4019,15 @@ var require_fast_uri = __commonJS({
       }
       return false;
     }
+    function isIPLiteral(host) {
+      return host[0] === "[" && host[host.length - 1] === "]";
+    }
     function hasMalformedComponentPercentEncoding(matches) {
       const host = matches[4];
-      return hasMalformedPercentEncoding(matches[3]) || host !== void 0 && !(host[0] === "[" && host[host.length - 1] === "]") && hasMalformedPercentEncoding(host) || hasMalformedPercentEncoding(matches[6]) || hasMalformedPercentEncoding(matches[7]) || hasMalformedPercentEncoding(matches[8]);
+      return hasMalformedPercentEncoding(matches[3]) || host !== void 0 && !isIPLiteral(host) && hasMalformedPercentEncoding(host) || hasMalformedPercentEncoding(matches[6]) || hasMalformedPercentEncoding(matches[7]) || hasMalformedPercentEncoding(matches[8]);
     }
     function canonicalizeHost(parsed, options, schemeHandler, isIP) {
-      if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport) && parsed.host && parsed.host[0] !== "[" && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
+      if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport) && parsed.host && !isIPLiteral(parsed.host) && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
         try {
           parsed.host = new URL("http://" + parsed.host).hostname;
         } catch (e) {
@@ -4106,10 +4114,11 @@ var require_fast_uri = __commonJS({
         if (parsed.host) {
           const ipv4result = isIPv4(parsed.host);
           if (ipv4result === false) {
-            const bracketedIPLiteral = parsed.host[0] === "[" && parsed.host[parsed.host.length - 1] === "]";
+            const bracketedIPLiteral = isIPLiteral(parsed.host);
+            const hasIPLiteralBracket = parsed.host.indexOf("[") !== -1 || parsed.host.indexOf("]") !== -1;
             const ipv6result = normalizeIPv6(parsed.host);
             isIP = ipv6result.isIPV6 || ipv6result.isIPVFuture === true;
-            malformedIPLiteral = bracketedIPLiteral && ipv6result.error === true;
+            malformedIPLiteral = hasIPLiteralBracket && (!bracketedIPLiteral || ipv6result.error === true);
             parsed.host = isIP ? ipv6result.host : ipv6result.host.toLowerCase();
             if (malformedIPLiteral) {
               parsed.error = parsed.error || "URI host is malformed.";
@@ -4132,14 +4141,17 @@ var require_fast_uri = __commonJS({
           parsed.error = parsed.error || "URI is not a " + options.reference + " reference.";
         }
         const schemeHandler = getSchemeHandler(options.scheme || parsed.scheme);
-        malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP);
-        if (!schemeHandler || schemeHandler && !schemeHandler.skipNormalize) {
-          if (uri.indexOf("%") !== -1) {
-            if (parsed.host !== void 0 && !malformedIPLiteral) {
-              const host = isIP ? parsed.host : normalizePercentEncoding(parsed.host, true);
-              parsed.host = reescapeHostDelimiters(host, isIP);
-            }
+        if (!malformedIPLiteral) {
+          malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP);
+        }
+        if (uri.indexOf("%") !== -1 && parsed.host !== void 0 && !malformedIPLiteral) {
+          let host = isIP ? parsed.host : normalizePercentEncoding(parsed.host, true);
+          if (!isIP) {
+            host = normalizePercentEncoding(host.toLowerCase());
           }
+          parsed.host = reescapeHostDelimiters(host, isIP);
+        }
+        if (!schemeHandler || schemeHandler && !schemeHandler.skipNormalize) {
           if (parsed.path) {
             parsed.path = normalizePathEncoding(parsed.path);
           }
@@ -14897,7 +14909,7 @@ var CONFIG_FORMATS = {
   IssuanceConfig: {
     slug: "issuance-config",
     file: "IssuanceConfigFile",
-    version: 2
+    version: 3
   },
   CredentialConfig: {
     slug: "credential-config",
@@ -14980,6 +14992,15 @@ var CONFIG_MIGRATIONS = [
     // valid v2 spec whose offers keep having no lifetime.
     migrate: (spec) => ({ spec })
   },
+  {
+    id: "issuance-config-v3-trust-list-verifier-pem",
+    kind: "IssuanceConfig",
+    from: 2,
+    to: 3,
+    // v3 only adds the optional verifierKeyPem to wallet provider trust
+    // list references: a v2 spec is a valid v3 spec.
+    migrate: (spec) => ({ spec })
+  },
   presentationConfigV1ToV2,
   {
     id: "presentation-config-v3-typed-claim-values",
@@ -21454,13 +21475,13 @@ var CONFIG_SCHEMAS = [
   },
   {
     "$schema": "https://json-schema.org/draft/2020-12/schema",
-    "$id": "https://eudiplo.dev/schemas/v3/PresentationConfigFile.schema.json",
-    "title": "PresentationConfigFile",
+    "$id": "https://eudiplo.dev/schemas/v3/IssuanceConfigFile.schema.json",
+    "title": "IssuanceConfigFile",
     "type": "object",
     "properties": {
       "$schema": {
         "type": "string",
-        "const": "https://eudiplo.dev/schemas/v3/PresentationConfigFile.schema.json"
+        "const": "https://eudiplo.dev/schemas/v3/IssuanceConfigFile.schema.json"
       },
       "metadata": {
         "type": "object",
@@ -21482,23 +21503,7 @@ var CONFIG_SCHEMAS = [
         "additionalProperties": false
       },
       "spec": {
-        "allOf": [
-          {
-            "$ref": "#/$defs/PresentationConfigCreateDto"
-          },
-          {
-            "type": "object",
-            "required": [
-              "id"
-            ],
-            "properties": {
-              "id": {
-                "type": "string",
-                "minLength": 1
-              }
-            }
-          }
-        ]
+        "$ref": "#/$defs/IssuanceConfig"
       }
     },
     "required": [
@@ -21507,103 +21512,814 @@ var CONFIG_SCHEMAS = [
     ],
     "additionalProperties": false,
     "$defs": {
-      "PresentationConfigCreateDto": {
+      "IssuanceConfig": {
         "type": "object",
         "properties": {
-          "id": {
-            "type": "string",
-            "minLength": 1,
-            "description": "Presentation configuration identifier."
-          },
-          "description": {
-            "description": "Optional presentation configuration description.",
-            "type": [
-              "string",
-              "null"
-            ]
-          },
-          "lifeTime": {
-            "description": "Presentation request lifetime in seconds.",
+          "batchSize": {
+            "description": "Optional issuance batch size.",
             "type": "integer",
             "minimum": 1,
             "maximum": 9007199254740991
           },
-          "skewSeconds": {
-            "description": "Clock skew tolerance in seconds.",
-            "type": "integer",
-            "minimum": 0,
-            "maximum": 9007199254740991
+          "dPopRequired": {
+            "description": "Require DPoP proofs for issuance endpoints.",
+            "type": "boolean"
           },
-          "statusCheckMode": {
-            "description": "Revocation/status check mode.",
+          "walletAttestationRequired": {
+            "description": "Default wallet attestation requirement for managed authorization servers.",
+            "type": "boolean"
+          },
+          "walletProviderTrustLists": {
+            "description": "Shared wallet provider trust lists for key attestations and default authorization server wallet authentication.",
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": {
+                "trustListId": {
+                  "type": "string",
+                  "minLength": 1
+                },
+                "url": {
+                  "description": "URL of the wallet provider trust list.",
+                  "type": "string",
+                  "format": "uri"
+                },
+                "verifierKey": {
+                  "description": "Optional verifier key material used for trust list verification.",
+                  "type": "object",
+                  "propertyNames": {
+                    "type": "string"
+                  },
+                  "additionalProperties": {}
+                },
+                "verifierKeyPem": {
+                  "description": "Optional verifier public key in SPKI PEM form (-----BEGIN PUBLIC KEY-----).",
+                  "type": "string",
+                  "pattern": "^\\s*-----BEGIN PUBLIC KEY-----[A-Za-z0-9+/=\\s]+-----END PUBLIC KEY-----\\s*$"
+                },
+                "verifierX509Der": {
+                  "description": "Optional verifier certificate in DER/base64 form.",
+                  "type": "string"
+                }
+              },
+              "additionalProperties": false
+            }
+          },
+          "signingKeyId": {
+            "description": "Default signing key chain id for credential issuance.",
             "type": "string",
-            "enum": [
-              "strict",
-              "best_effort",
-              "disabled"
-            ]
+            "minLength": 1
           },
-          "dcql_query": {
-            "type": "object",
-            "properties": {
-              "credentials": {
-                "minItems": 1,
-                "type": "array",
-                "items": {
-                  "oneOf": [
-                    {
+          "authorizationServers": {
+            "minItems": 1,
+            "type": "array",
+            "items": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "type": {
+                      "type": "string",
+                      "const": "external",
+                      "description": "Use an externally managed authorization server."
+                    },
+                    "id": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Authorization server identifier."
+                    },
+                    "issuer": {
+                      "type": "string",
+                      "format": "uri",
+                      "description": "Issuer URL for the external authorization server."
+                    },
+                    "sessionBinding": {
+                      "description": "Explicit mapping from an external access-token claim to an existing issuance session.",
                       "type": "object",
                       "properties": {
-                        "id": {
+                        "method": {
+                          "type": "string",
+                          "const": "access_token_claim",
+                          "description": "Read the correlation value from a configured access-token claim."
+                        },
+                        "claim": {
                           "type": "string",
                           "minLength": 1,
-                          "pattern": "^[A-Za-z0-9_-]+$",
-                          "description": "Credential query identifier."
+                          "description": "Claim name that contains the issuance-session correlation value."
+                        }
+                      },
+                      "required": [
+                        "method",
+                        "claim"
+                      ],
+                      "additionalProperties": false
+                    },
+                    "label": {
+                      "description": "Optional display label for UI selection.",
+                      "type": "string"
+                    },
+                    "enabled": {
+                      "description": "Whether this authorization server entry is enabled.",
+                      "type": "boolean"
+                    }
+                  },
+                  "required": [
+                    "type",
+                    "id",
+                    "issuer"
+                  ],
+                  "additionalProperties": false
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "type": {
+                      "type": "string",
+                      "const": "oid4vp",
+                      "description": "Use OID4VP-based authorization server chaining."
+                    },
+                    "id": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Authorization server identifier."
+                    },
+                    "presentationConfigId": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Presentation configuration id used during authorization."
+                    },
+                    "immediateWalletRedirect": {
+                      "description": "Redirect wallets immediately after authorization response creation.",
+                      "type": "boolean"
+                    },
+                    "token": {
+                      "description": "Optional token issuance settings.",
+                      "type": "object",
+                      "properties": {
+                        "lifetimeSeconds": {
+                          "description": "Access token lifetime in seconds.",
+                          "type": "number",
+                          "minimum": 60
                         },
-                        "multiple": {
-                          "description": "Allow multiple matching credentials.",
-                          "type": "boolean"
+                        "signingKeyId": {
+                          "description": "Optional key chain id used to sign issued tokens.",
+                          "type": "string",
+                          "minLength": 1
                         },
-                        "claim_sets": {
-                          "description": "Optional claim set constraints.",
-                          "type": "array",
-                          "items": {
-                            "type": "array",
-                            "items": {
-                              "type": "string"
-                            }
-                          }
+                        "refreshTokenEnabled": {
+                          "description": "Enable issuing refresh tokens.",
+                          "type": "boolean"
                         },
-                        "trusted_authorities": {
-                          "description": "Optional trusted authority constraints.",
-                          "type": "array",
-                          "items": {
-                            "oneOf": [
-                              {
-                                "type": "object",
-                                "properties": {
-                                  "type": {
-                                    "type": "string",
-                                    "const": "etsi_tl",
-                                    "description": "Trusted authority type discriminator for ETSI trust lists."
-                                  },
-                                  "values": {
-                                    "type": "array",
-                                    "items": {
-                                      "type": "object",
-                                      "properties": {
-                                        "trustListId": {
-                                          "description": "Optional trust list id reference.",
-                                          "type": "string"
-                                        },
-                                        "url": {
-                                          "description": "Optional trust list URL reference.",
-                                          "anyOf": [
-                                            {
-                                              "type": "string",
-                                              "format": "uri"
-                                            },
-                                            {
+                        "refreshTokenExpiresInSeconds": {
+                          "description": "Refresh token lifetime in seconds.",
+                          "type": "number",
+                          "minimum": 60
+                        }
+                      },
+                      "additionalProperties": false
+                    },
+                    "requireDPoP": {
+                      "description": "Require DPoP proofs for token/credential requests.",
+                      "type": "boolean"
+                    },
+                    "walletAttestationRequired": {
+                      "description": "Require wallet attestation for this authorization server.",
+                      "type": "boolean"
+                    },
+                    "walletProviderTrustLists": {
+                      "description": "Optional wallet provider trust list references for this authorization server.",
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "trustListId": {
+                            "type": "string",
+                            "minLength": 1
+                          },
+                          "url": {
+                            "description": "URL of the wallet provider trust list.",
+                            "type": "string",
+                            "format": "uri"
+                          },
+                          "verifierKey": {
+                            "description": "Optional verifier key material used for trust list verification.",
+                            "type": "object",
+                            "propertyNames": {
+                              "type": "string"
+                            },
+                            "additionalProperties": {}
+                          },
+                          "verifierKeyPem": {
+                            "description": "Optional verifier public key in SPKI PEM form (-----BEGIN PUBLIC KEY-----).",
+                            "type": "string",
+                            "pattern": "^\\s*-----BEGIN PUBLIC KEY-----[A-Za-z0-9+/=\\s]+-----END PUBLIC KEY-----\\s*$"
+                          },
+                          "verifierX509Der": {
+                            "description": "Optional verifier certificate in DER/base64 form.",
+                            "type": "string"
+                          }
+                        },
+                        "additionalProperties": false
+                      }
+                    },
+                    "label": {
+                      "description": "Optional display label for UI selection.",
+                      "type": "string"
+                    },
+                    "enabled": {
+                      "description": "Whether this authorization server entry is enabled.",
+                      "type": "boolean"
+                    }
+                  },
+                  "required": [
+                    "type",
+                    "id",
+                    "presentationConfigId"
+                  ],
+                  "additionalProperties": false
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "type": {
+                      "type": "string",
+                      "const": "chained",
+                      "description": "Use upstream OIDC as authorization source."
+                    },
+                    "id": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Authorization server identifier."
+                    },
+                    "upstream": {
+                      "type": "object",
+                      "properties": {
+                        "issuer": {
+                          "type": "string",
+                          "format": "uri",
+                          "description": "Upstream OIDC issuer URL."
+                        },
+                        "clientId": {
+                          "type": "string",
+                          "minLength": 1,
+                          "description": "Client id for upstream OIDC authentication."
+                        },
+                        "clientSecret": {
+                          "description": "Optional client secret for upstream OIDC authentication.",
+                          "type": "string",
+                          "minLength": 1
+                        },
+                        "scopes": {
+                          "description": "Optional scopes requested from the upstream issuer.",
+                          "type": "array",
+                          "items": {
+                            "type": "string",
+                            "minLength": 1
+                          }
+                        }
+                      },
+                      "required": [
+                        "issuer",
+                        "clientId"
+                      ],
+                      "additionalProperties": false,
+                      "description": "Upstream OIDC connection settings."
+                    },
+                    "token": {
+                      "description": "Optional token issuance settings.",
+                      "type": "object",
+                      "properties": {
+                        "lifetimeSeconds": {
+                          "description": "Access token lifetime in seconds.",
+                          "type": "number",
+                          "minimum": 60
+                        },
+                        "signingKeyId": {
+                          "description": "Optional key chain id used to sign issued tokens.",
+                          "type": "string",
+                          "minLength": 1
+                        },
+                        "refreshTokenEnabled": {
+                          "description": "Enable issuing refresh tokens.",
+                          "type": "boolean"
+                        },
+                        "refreshTokenExpiresInSeconds": {
+                          "description": "Refresh token lifetime in seconds.",
+                          "type": "number",
+                          "minimum": 60
+                        }
+                      },
+                      "additionalProperties": false
+                    },
+                    "requireDPoP": {
+                      "description": "Require DPoP proofs for token/credential requests.",
+                      "type": "boolean"
+                    },
+                    "walletAttestationRequired": {
+                      "description": "Require wallet attestation for this authorization server.",
+                      "type": "boolean"
+                    },
+                    "walletProviderTrustLists": {
+                      "description": "Optional wallet provider trust list references for this authorization server.",
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "trustListId": {
+                            "type": "string",
+                            "minLength": 1
+                          },
+                          "url": {
+                            "description": "URL of the wallet provider trust list.",
+                            "type": "string",
+                            "format": "uri"
+                          },
+                          "verifierKey": {
+                            "description": "Optional verifier key material used for trust list verification.",
+                            "type": "object",
+                            "propertyNames": {
+                              "type": "string"
+                            },
+                            "additionalProperties": {}
+                          },
+                          "verifierKeyPem": {
+                            "description": "Optional verifier public key in SPKI PEM form (-----BEGIN PUBLIC KEY-----).",
+                            "type": "string",
+                            "pattern": "^\\s*-----BEGIN PUBLIC KEY-----[A-Za-z0-9+/=\\s]+-----END PUBLIC KEY-----\\s*$"
+                          },
+                          "verifierX509Der": {
+                            "description": "Optional verifier certificate in DER/base64 form.",
+                            "type": "string"
+                          }
+                        },
+                        "additionalProperties": false
+                      }
+                    },
+                    "label": {
+                      "description": "Optional display label for UI selection.",
+                      "type": "string"
+                    },
+                    "enabled": {
+                      "description": "Whether this authorization server entry is enabled.",
+                      "type": "boolean"
+                    }
+                  },
+                  "required": [
+                    "type",
+                    "id",
+                    "upstream"
+                  ],
+                  "additionalProperties": false
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "type": {
+                      "type": "string",
+                      "const": "built-in",
+                      "description": "Use EUDIPLO built-in authorization server."
+                    },
+                    "id": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Authorization server identifier."
+                    },
+                    "token": {
+                      "description": "Optional token issuance settings.",
+                      "type": "object",
+                      "properties": {
+                        "lifetimeSeconds": {
+                          "description": "Access token lifetime in seconds.",
+                          "type": "number",
+                          "minimum": 60
+                        },
+                        "signingKeyId": {
+                          "description": "Optional key chain id used to sign issued tokens.",
+                          "type": "string",
+                          "minLength": 1
+                        },
+                        "refreshTokenEnabled": {
+                          "description": "Enable issuing refresh tokens.",
+                          "type": "boolean"
+                        },
+                        "refreshTokenExpiresInSeconds": {
+                          "description": "Refresh token lifetime in seconds.",
+                          "type": "number",
+                          "minimum": 60
+                        }
+                      },
+                      "additionalProperties": false
+                    },
+                    "requireDPoP": {
+                      "description": "Require DPoP proofs for token/credential requests.",
+                      "type": "boolean"
+                    },
+                    "walletAttestationRequired": {
+                      "description": "Require wallet attestation for this authorization server.",
+                      "type": "boolean"
+                    },
+                    "walletProviderTrustLists": {
+                      "description": "Optional wallet provider trust list references for this authorization server.",
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "trustListId": {
+                            "type": "string",
+                            "minLength": 1
+                          },
+                          "url": {
+                            "description": "URL of the wallet provider trust list.",
+                            "type": "string",
+                            "format": "uri"
+                          },
+                          "verifierKey": {
+                            "description": "Optional verifier key material used for trust list verification.",
+                            "type": "object",
+                            "propertyNames": {
+                              "type": "string"
+                            },
+                            "additionalProperties": {}
+                          },
+                          "verifierKeyPem": {
+                            "description": "Optional verifier public key in SPKI PEM form (-----BEGIN PUBLIC KEY-----).",
+                            "type": "string",
+                            "pattern": "^\\s*-----BEGIN PUBLIC KEY-----[A-Za-z0-9+/=\\s]+-----END PUBLIC KEY-----\\s*$"
+                          },
+                          "verifierX509Der": {
+                            "description": "Optional verifier certificate in DER/base64 form.",
+                            "type": "string"
+                          }
+                        },
+                        "additionalProperties": false
+                      }
+                    },
+                    "label": {
+                      "description": "Optional display label for UI selection.",
+                      "type": "string"
+                    },
+                    "enabled": {
+                      "description": "Whether this authorization server entry is enabled.",
+                      "type": "boolean"
+                    }
+                  },
+                  "required": [
+                    "type",
+                    "id"
+                  ],
+                  "additionalProperties": false
+                }
+              ],
+              "description": "Supported authorization server configurations."
+            },
+            "description": "Configured authorization server entries."
+          },
+          "federation": {
+            "description": "Optional OpenID Federation settings.",
+            "anyOf": [
+              {
+                "type": "object",
+                "properties": {
+                  "role": {
+                    "description": "Federation role for this issuer.",
+                    "type": "string",
+                    "enum": [
+                      "trust_anchor",
+                      "intermediate",
+                      "leaf"
+                    ]
+                  },
+                  "mode": {
+                    "description": "Federation operation mode.",
+                    "type": "string",
+                    "enum": [
+                      "federation-only",
+                      "hybrid"
+                    ]
+                  },
+                  "entityId": {
+                    "description": "Optional local federation entity id.",
+                    "type": "string"
+                  },
+                  "enforceSigningPolicy": {
+                    "description": "Enforce strict signing policy checks.",
+                    "type": "boolean"
+                  },
+                  "cacheTtlSeconds": {
+                    "description": "Cache time-to-live for federation metadata in seconds.",
+                    "type": "integer",
+                    "minimum": 1,
+                    "maximum": 9007199254740991
+                  },
+                  "trustAnchors": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "entityId": {
+                          "type": "string",
+                          "minLength": 1,
+                          "description": "Federation trust anchor entity id."
+                        },
+                        "entityConfigurationUri": {
+                          "type": "string",
+                          "format": "uri",
+                          "description": "Entity configuration URI for the trust anchor."
+                        }
+                      },
+                      "required": [
+                        "entityId",
+                        "entityConfigurationUri"
+                      ],
+                      "additionalProperties": false
+                    },
+                    "description": "Federation trust anchors."
+                  }
+                },
+                "required": [
+                  "trustAnchors"
+                ],
+                "additionalProperties": false
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "registrationCertificate": {
+            "description": "Optional registration certificate settings.",
+            "anyOf": [
+              {
+                "type": "object",
+                "properties": {
+                  "enabled": {
+                    "description": "Enable issuer registration certificate support.",
+                    "type": "boolean"
+                  },
+                  "mode": {
+                    "description": "How registration certificate data is provided.",
+                    "type": "string",
+                    "enum": [
+                      "import",
+                      "generate"
+                    ]
+                  },
+                  "jwt": {
+                    "description": "Optional registration certificate JWT when using import mode.",
+                    "type": "string"
+                  },
+                  "privacyPolicy": {
+                    "description": "Optional privacy policy URI.",
+                    "type": "string"
+                  },
+                  "supportUri": {
+                    "description": "Optional support URI.",
+                    "type": "string"
+                  }
+                },
+                "additionalProperties": false
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "display": {
+            "description": "Localized issuer metadata shown to wallets.",
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "description": "Issuer display name.",
+                  "type": "string"
+                },
+                "locale": {
+                  "description": "Locale tag for this display entry.",
+                  "type": "string"
+                },
+                "logo": {
+                  "description": "Optional issuer logo metadata.",
+                  "type": "object",
+                  "properties": {
+                    "uri": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Logo URI."
+                    },
+                    "alt_text": {
+                      "description": "Optional localized alternative text.",
+                      "type": "string"
+                    }
+                  },
+                  "required": [
+                    "uri"
+                  ],
+                  "additionalProperties": {}
+                }
+              },
+              "additionalProperties": {}
+            }
+          },
+          "notificationEndpointEnabled": {
+            "description": "Whether the OID4VCI notification endpoint is exposed for this issuance configuration.",
+            "type": "boolean"
+          },
+          "credentialResponseEncryption": {
+            "description": "Enable encrypted credential responses.",
+            "type": "boolean"
+          },
+          "credentialRequestEncryption": {
+            "description": "Require encrypted credential requests.",
+            "type": "boolean"
+          },
+          "txCodeMaxAttempts": {
+            "description": "Maximum verification attempts for transaction codes. Null resets to defaults.",
+            "anyOf": [
+              {
+                "type": "integer",
+                "minimum": 1,
+                "maximum": 9007199254740991
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "offerLifetimeSeconds": {
+            "description": "Default lifetime of credential offers in seconds. Can be overridden per offer request. Null or unset: offers do not expire.",
+            "anyOf": [
+              {
+                "type": "integer",
+                "minimum": 1,
+                "maximum": 9007199254740991
+              },
+              {
+                "type": "null"
+              }
+            ]
+          }
+        },
+        "required": [
+          "authorizationServers"
+        ],
+        "additionalProperties": false,
+        "title": "IssuanceConfig"
+      }
+    }
+  },
+  {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://eudiplo.dev/schemas/v3/PresentationConfigFile.schema.json",
+    "title": "PresentationConfigFile",
+    "type": "object",
+    "properties": {
+      "$schema": {
+        "type": "string",
+        "const": "https://eudiplo.dev/schemas/v3/PresentationConfigFile.schema.json"
+      },
+      "metadata": {
+        "type": "object",
+        "properties": {
+          "generation": {
+            "type": "integer",
+            "minimum": 1,
+            "description": "Monotonically increasing configuration generation."
+          },
+          "ownership": {
+            "type": "string",
+            "enum": [
+              "unmanaged",
+              "file-managed"
+            ],
+            "description": "Requested ownership recorded when the document is applied."
+          }
+        },
+        "additionalProperties": false
+      },
+      "spec": {
+        "allOf": [
+          {
+            "$ref": "#/$defs/PresentationConfigCreateDto"
+          },
+          {
+            "type": "object",
+            "required": [
+              "id"
+            ],
+            "properties": {
+              "id": {
+                "type": "string",
+                "minLength": 1
+              }
+            }
+          }
+        ]
+      }
+    },
+    "required": [
+      "$schema",
+      "spec"
+    ],
+    "additionalProperties": false,
+    "$defs": {
+      "PresentationConfigCreateDto": {
+        "type": "object",
+        "properties": {
+          "id": {
+            "type": "string",
+            "minLength": 1,
+            "description": "Presentation configuration identifier."
+          },
+          "description": {
+            "description": "Optional presentation configuration description.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "lifeTime": {
+            "description": "Presentation request lifetime in seconds.",
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 9007199254740991
+          },
+          "skewSeconds": {
+            "description": "Clock skew tolerance in seconds.",
+            "type": "integer",
+            "minimum": 0,
+            "maximum": 9007199254740991
+          },
+          "statusCheckMode": {
+            "description": "Revocation/status check mode.",
+            "type": "string",
+            "enum": [
+              "strict",
+              "best_effort",
+              "disabled"
+            ]
+          },
+          "dcql_query": {
+            "type": "object",
+            "properties": {
+              "credentials": {
+                "minItems": 1,
+                "type": "array",
+                "items": {
+                  "oneOf": [
+                    {
+                      "type": "object",
+                      "properties": {
+                        "id": {
+                          "type": "string",
+                          "minLength": 1,
+                          "pattern": "^[A-Za-z0-9_-]+$",
+                          "description": "Credential query identifier."
+                        },
+                        "multiple": {
+                          "description": "Allow multiple matching credentials.",
+                          "type": "boolean"
+                        },
+                        "claim_sets": {
+                          "description": "Optional claim set constraints.",
+                          "type": "array",
+                          "items": {
+                            "type": "array",
+                            "items": {
+                              "type": "string"
+                            }
+                          }
+                        },
+                        "trusted_authorities": {
+                          "description": "Optional trusted authority constraints.",
+                          "type": "array",
+                          "items": {
+                            "oneOf": [
+                              {
+                                "type": "object",
+                                "properties": {
+                                  "type": {
+                                    "type": "string",
+                                    "const": "etsi_tl",
+                                    "description": "Trusted authority type discriminator for ETSI trust lists."
+                                  },
+                                  "values": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "object",
+                                      "properties": {
+                                        "trustListId": {
+                                          "description": "Optional trust list id reference.",
+                                          "type": "string"
+                                        },
+                                        "url": {
+                                          "description": "Optional trust list URL reference.",
+                                          "anyOf": [
+                                            {
+                                              "type": "string",
+                                              "format": "uri"
+                                            },
+                                            {
                                               "type": "string",
                                               "pattern": "^<TENANT_URL>(?:\\/.*)?$"
                                             }
@@ -23723,7 +24439,10 @@ function createTenantCommand(context, setExitCode) {
 
 // src/commands/config/validate/index.ts
 function createValidateCommand(context, setExitCode) {
-  return new Command("validate").description("Validate CLI or tenant config-import files").argument("[scope]").argument("[path]").addOption(
+  return new Command("validate").description("Validate CLI or tenant config-import files").argument(
+    "[scope]",
+    '"tenant" for one tenant folder or "tenants" for a folder of tenant folders; omit it to validate the CLI config file'
+  ).argument("[path]", "the folder to validate (required with a scope)").addOption(
     new Option("--format <text|json>", "tenant report format").choices(["text", "json"]).default("text")
   ).action(async (scope, path2, options) => {
     const state = await loadCliState(context);
@@ -23842,9 +24561,9 @@ function buildComposeLogsArgs(service, options = {}) {
   }
   return args;
 }
-function buildComposePullArgs(service) {
+function buildComposePullArgs(services) {
   const args = ["pull"];
-  if (service !== void 0) {
+  for (const service of typeof services === "string" ? [services] : services ?? []) {
     assertServiceName(service);
     args.push(service);
   }
@@ -23882,23 +24601,28 @@ function parseContainerStates(stdout) {
   return entries.map((entry) => {
     const record = entry;
     const names = record.Names;
+    const status = String(record.Status ?? "");
+    const exitCode2 = typeof record.ExitCode === "number" ? record.ExitCode : /^Exited \((\d+)\)/.exec(status)?.[1];
     return {
       name: Array.isArray(names) ? String(names[0] ?? "") : String(names ?? record.Name ?? ""),
       state: String(record.State ?? ""),
-      status: String(record.Status ?? "")
+      status,
+      exitCode: exitCode2 === void 0 ? void 0 : Number(exitCode2)
     };
   });
 }
 function summarizeContainerStates(containers, projectName) {
   const name = "service containers";
-  if (containers.length === 0) {
+  const services = containers.filter((container) => !hasCompleted(container));
+  const completed = containers.length - services.length;
+  if (services.length === 0) {
     return {
       name,
       status: "warn",
       message: `No containers found for project ${projectName}. Start it with eudiplo up.`
     };
   }
-  const unhealthy = containers.filter(
+  const unhealthy = services.filter(
     (container) => container.status.toLowerCase().includes("unhealthy")
   );
   if (unhealthy.length > 0) {
@@ -23908,25 +24632,28 @@ function summarizeContainerStates(containers, projectName) {
       message: `Unhealthy: ${describe(unhealthy)}`
     };
   }
-  const notRunning = containers.filter(
+  const notRunning = services.filter(
     (container) => container.state.toLowerCase() !== "running"
   );
   if (notRunning.length > 0) {
     return {
       name,
       status: "warn",
-      message: `${containers.length - notRunning.length}/${containers.length} running. Not running: ${describe(notRunning)}`
+      message: `${services.length - notRunning.length}/${services.length} running. Not running: ${describe(notRunning)}`
     };
   }
-  const starting = containers.filter(
+  const starting = services.filter(
     (container) => container.status.toLowerCase().includes("starting")
   ).length;
   return {
     name,
     status: "pass",
-    message: `${containers.length} container(s) running${starting > 0 ? `, ${starting} still starting` : ""}.`
+    message: `${services.length} container(s) running${starting > 0 ? `, ${starting} still starting` : ""}${completed > 0 ? `, ${completed} completed` : ""}.`
   };
 }
+function hasCompleted(container) {
+  return container.state.toLowerCase() === "exited" && container.exitCode === 0;
+}
 function asArray(value) {
   return Array.isArray(value) ? value : [];
 }
@@ -24860,11 +25587,57 @@ async function runDriverCommand(config, command, parsed, context) {
   });
 }
 
+// src/commands/deployment/pass-through.ts
+function runtimeArguments(command, args) {
+  const options = command.options.flatMap((option) => option.long ?? []);
+  for (const arg of args) {
+    if (!arg.startsWith("--") || arg === "--") {
+      continue;
+    }
+    const flag = arg.split("=", 1)[0];
+    const similar = options.filter(
+      (option) => option !== flag && editDistance2(flag, option) <= 2
+    );
+    if (similar.length > 0) {
+      const suggestion = similar.length === 1 ? similar[0] : `one of ${similar.join(", ")}`;
+      command.error(
+        `error: unknown option '${arg}'
+(Did you mean ${suggestion}?)`,
+        { code: "commander.unknownOption" }
+      );
+    }
+  }
+  const separator = args.indexOf("--");
+  return separator === -1 ? args : [...args.slice(0, separator), ...args.slice(separator + 1)];
+}
+function editDistance2(a, b) {
+  const distances = Array.from(
+    { length: a.length + 1 },
+    (_, i2) => Array.from({ length: b.length + 1 }, (_2, j) => Math.max(i2, j))
+  );
+  for (let i2 = 1; i2 <= a.length; i2++) {
+    for (let j = 1; j <= b.length; j++) {
+      distances[i2][j] = Math.min(
+        distances[i2 - 1][j] + 1,
+        distances[i2][j - 1] + 1,
+        distances[i2 - 1][j - 1] + (a[i2 - 1] === b[j - 1] ? 0 : 1)
+      );
+      if (i2 > 1 && j > 1 && a[i2 - 1] === b[j - 2] && a[i2 - 2] === b[j - 1]) {
+        distances[i2][j] = Math.min(
+          distances[i2][j],
+          distances[i2 - 2][j - 2] + 1
+        );
+      }
+    }
+  }
+  return distances[a.length][b.length];
+}
+
 // src/commands/deployment/index.ts
 var descriptions = {
   up: "Start the selected Compose deployment",
   down: "Stop the selected Compose deployment",
-  logs: "Stream logs for the selected deployment",
+  logs: "Print the logs of the selected deployment, or stream them with --follow",
   ps: "List the running containers or pods for the selected deployment",
   restart: "Restart the workloads of the selected deployment",
   pull: "Download the configured images without changing configuration"
@@ -24879,8 +25652,8 @@ function createDeploymentCommands(context, setExitCode) {
     (name) => {
       const command = new Command(name).description(descriptions[name]).argument(
         "[args...]",
-        "additional arguments passed to the deployment runtime"
-      ).option("--instance <name>", "select a configured instance");
+        "additional arguments and options passed to the deployment runtime"
+      ).allowUnknownOption().option("--instance <name>", "select a configured instance");
       if (serviceScoped.has(name)) {
         command.option(
           "--service <name>",
@@ -24900,12 +25673,13 @@ function createDeploymentCommands(context, setExitCode) {
         );
       }
       return command.action(async (args, options) => {
+        const runtimeArgs = runtimeArguments(command, args);
         const { config } = await loadCliState(context);
         setExitCode(
           await runDriverCommand(
             config,
             name,
-            parsedArgs(name, void 0, args, options),
+            parsedArgs(name, void 0, runtimeArgs, options),
             context
           )
         );
@@ -24917,7 +25691,7 @@ function createDeploymentCommands(context, setExitCode) {
 // package.json
 var package_default = {
   name: "@eudiplo/cli",
-  version: "9.0.0",
+  version: "9.1.0",
   description: "Deployment-aware command line tools for EUDIPLO",
   private: false,
   type: "module",
@@ -24977,12 +25751,12 @@ var package_default = {
     "jsonc-parser": "^3.3.1"
   },
   devDependencies: {
-    "@biomejs/biome": "2.5.14",
-    "@types/node": "^26.4.0",
+    "@biomejs/biome": "2.5.15",
+    "@types/node": "^26.6.4",
     esbuild: "^0.28.2",
-    tsx: "^4.23.13",
+    tsx: "^4.23.15",
     typescript: "^7.0.2",
-    vitest: "5.0.2"
+    vitest: "5.0.3"
   }
 };
 
@@ -25360,6 +26134,13 @@ var kmsHealthCheck = {
           message: "This backend does not expose the KMS provider health endpoint."
         };
       }
+      if (response.status === 401 || response.status === 403) {
+        return {
+          name: "KMS providers",
+          status: "skip",
+          message: `Needs a tenant client with issuance:manage or presentation:manage (${response.reason}).`
+        };
+      }
       return {
         name: "KMS providers",
         status: "fail",
@@ -26270,6 +27051,10 @@ var managedImages = {
   EUDIPLO_IMAGE: "ghcr.io/eudiplo/eudiplo",
   EUDIPLO_CLIENT_IMAGE: "ghcr.io/eudiplo/eudiplo-client"
 };
+var managedServices = {
+  EUDIPLO_IMAGE: "eudiplo",
+  EUDIPLO_CLIENT_IMAGE: "eudiplo-client"
+};
 var legacyImages = {
   EUDIPLO_IMAGE: "ghcr.io/openwallet-foundation/eudiplo",
   EUDIPLO_CLIENT_IMAGE: "ghcr.io/openwallet-foundation/eudiplo-client"
@@ -26436,7 +27221,12 @@ async function runUpgradeCommand(config, parsed, context) {
     return 0;
   }
   await writeFile6(envPath, plan.content, "utf8");
-  const pulled = await runCompose(buildComposePullArgs(void 0), options);
+  const pulled = await runCompose(
+    buildComposePullArgs(
+      plan.changes.map((change) => managedServices[change.key])
+    ),
+    options
+  );
   if (pulled !== 0) {
     await writeFile6(envPath, original, "utf8");
     context.stderr.write(