@eudiplo/cli 9.1.0-main.1a18187 → 9.1.0-main.1b295eb

package/dist/index.js

@@ -3099,9 +3099,9 @@ var require_data = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/lib/utils.js
+// ../../node_modules/.pnpm/fast-uri@3.1.9/node_modules/fast-uri/lib/utils.js
 var require_utils = __commonJS({
-  "../../node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/lib/utils.js"(exports, module) {
+  "../../node_modules/.pnpm/fast-uri@3.1.9/node_modules/fast-uri/lib/utils.js"(exports, module) {
     "use strict";
     var isUUID = RegExp.prototype.test.bind(/^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/iu);
     var isIPv4 = RegExp.prototype.test.bind(/^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)$/u);
@@ -3333,6 +3333,37 @@ var require_utils = __commonJS({
       }
       return output.join("");
     }
+    function removeDotSegmentsRelative(path2) {
+      if (path2 === "" || path2[0] === "/") {
+        return removeDotSegments(path2);
+      }
+      const segments = path2.split("/");
+      const last = segments.length - 1;
+      const output = [];
+      let trailingDirectory = false;
+      for (let i2 = 0; i2 <= last; i2++) {
+        const segment = segments[i2];
+        if (segment === "." || segment === "..") {
+          if (segment === "..") {
+            if (output.length !== 0 && output[output.length - 1] !== "..") {
+              output.pop();
+            } else {
+              output.push("..");
+            }
+          }
+          trailingDirectory = i2 === last;
+        } else {
+          output.push(segment);
+        }
+      }
+      if (trailingDirectory && output[output.length - 1] !== "..") {
+        output.push("");
+      }
+      if (output.length === 0 || output[0] === "" || output[0].includes(":")) {
+        output.unshift(".");
+      }
+      return output.join("/");
+    }
     var HOST_DELIMS = { "@": "%40", "/": "%2F", "?": "%3F", "#": "%23", ":": "%3A" };
     var HOST_DELIM_RE = /[@/?#:]/g;
     var HOST_DELIM_NO_COLON_RE = /[@/?#]/g;
@@ -3593,6 +3624,7 @@ var require_utils = __commonJS({
       encodeFragment,
       escapePreservingEscapes,
       removeDotSegments,
+      removeDotSegmentsRelative,
       isIPv4,
       isUUID,
       normalizeIPv6,
@@ -3601,9 +3633,9 @@ var require_utils = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/lib/schemes.js
+// ../../node_modules/.pnpm/fast-uri@3.1.9/node_modules/fast-uri/lib/schemes.js
 var require_schemes = __commonJS({
-  "../../node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/lib/schemes.js"(exports, module) {
+  "../../node_modules/.pnpm/fast-uri@3.1.9/node_modules/fast-uri/lib/schemes.js"(exports, module) {
     "use strict";
     var { isUUID } = require_utils();
     var URN_REG = /^([\da-z][\d\-a-z]{0,31}):((?:[\w!$'()*+,\-./:;=@]|%[\da-f]{2})+)$/iu;
@@ -3812,20 +3844,22 @@ var require_schemes = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/index.js
+// ../../node_modules/.pnpm/fast-uri@3.1.9/node_modules/fast-uri/index.js
 var require_fast_uri = __commonJS({
-  "../../node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/index.js"(exports, module) {
+  "../../node_modules/.pnpm/fast-uri@3.1.9/node_modules/fast-uri/index.js"(exports, module) {
     "use strict";
-    var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
+    var { normalizeIPv6, removeDotSegments, removeDotSegmentsRelative, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
     var { SCHEMES, getSchemeHandler } = require_schemes();
     var VALID_SCHEME = /^[A-Za-z][A-Za-z0-9+.-]*$/u;
     var MALFORMED_SCHEME_ERROR = "URI scheme is malformed.";
-    function decodeValidScheme(scheme) {
-      const decodedScheme = unescape(String(scheme));
-      if (!VALID_SCHEME.test(decodedScheme)) {
+    var MALFORMED_HOST_ERROR = "URI host is malformed.";
+    var FORBIDDEN_DOMAIN_HOST_CHARACTER = /[\0-\x20"#/:<>?@[\\\]^`{|}\x7F]/u;
+    function validateScheme(scheme) {
+      const stringScheme = String(scheme);
+      if (!VALID_SCHEME.test(stringScheme)) {
         throw new TypeError(MALFORMED_SCHEME_ERROR);
       }
-      return decodedScheme;
+      return stringScheme;
     }
     function normalize(uri, options) {
       if (typeof uri === "string") {
@@ -3862,6 +3896,9 @@ var require_fast_uri = __commonJS({
       const resolvedSchemeHandler = getSchemeHandler(options && options.scheme || resolved.scheme);
       const resolvedHost = resolved.host;
       const resolvedHostIsIP = resolvedHost !== void 0 && resolvedHost !== "" && (isIPv4(resolvedHost) || normalizeIPv6(resolvedHost).isIPV6);
+      if (hasForbiddenDomainHost(resolved, options || {}, resolvedSchemeHandler, resolvedHostIsIP)) {
+        throw new Error(MALFORMED_HOST_ERROR);
+      }
       canonicalizeHost(resolved, options || {}, resolvedSchemeHandler, resolvedHostIsIP);
       const encodedASCIIHost = resolvedHost && resolvedHost.indexOf("%") !== -1 && !new RegExp("\\P{ASCII}", "u").test(resolvedHost);
       if (resolved.error && !encodedASCIIHost) {
@@ -3903,14 +3940,15 @@ var require_fast_uri = __commonJS({
             if (relative3.path[0] === "/") {
               target.path = removeDotSegments(relative3.path);
             } else {
-              if ((base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0) && !base.path) {
+              const baseHasAuthority = base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0;
+              if (baseHasAuthority && !base.path) {
                 target.path = "/" + relative3.path;
               } else if (!base.path) {
                 target.path = relative3.path;
               } else {
                 target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative3.path;
               }
-              target.path = removeDotSegments(target.path);
+              target.path = base.scheme === void 0 && !baseHasAuthority && target.path[0] !== "/" ? removeDotSegmentsRelative(target.path) : removeDotSegments(target.path);
             }
             target.query = relative3.query;
           }
@@ -3948,12 +3986,13 @@ var require_fast_uri = __commonJS({
       const options = Object.assign({}, opts);
       const uriTokens = [];
       if (component.scheme) {
-        component.scheme = decodeValidScheme(component.scheme);
+        component.scheme = validateScheme(component.scheme);
       }
       const schemeHandler = getSchemeHandler(options.scheme || component.scheme);
       if (schemeHandler && schemeHandler.serialize) schemeHandler.serialize(component, options);
       const hasAuthority = component.userinfo !== void 0 || component.host !== void 0 || component.port !== void 0;
-      const pathNoScheme = !options.skipEscape && component.scheme === void 0 && !hasAuthority;
+      const schemelessReference = (component.scheme === void 0 || options.reference === "suffix") && !hasAuthority;
+      const pathNoScheme = !options.skipEscape && schemelessReference;
       if (component.path !== void 0) {
         if (!options.skipEscape) {
           component.path = serializePathEncoding(component.path, pathNoScheme);
@@ -3962,7 +4001,7 @@ var require_fast_uri = __commonJS({
         }
       }
       if (options.reference !== "suffix" && component.scheme) {
-        component.scheme = decodeValidScheme(component.scheme);
+        component.scheme = validateScheme(component.scheme);
         uriTokens.push(component.scheme, ":");
       }
       const authority = recomposeAuthority(component);
@@ -3978,9 +4017,9 @@ var require_fast_uri = __commonJS({
       if (component.path !== void 0) {
         let s = component.path;
         if (!options.absolutePath && (!schemeHandler || !schemeHandler.absolutePath)) {
-          s = removeDotSegments(s);
+          s = schemelessReference && s[0] !== "/" ? removeDotSegmentsRelative(s) : removeDotSegments(s);
         }
-        if (pathNoScheme) {
+        if (schemelessReference) {
           s = serializePathEncoding(s, true);
         }
         if (authority === void 0 && s[0] === "/" && s[1] === "/") {
@@ -4027,16 +4066,34 @@ var require_fast_uri = __commonJS({
       return hasMalformedPercentEncoding(matches[3]) || host !== void 0 && !isIPLiteral(host) && hasMalformedPercentEncoding(host) || hasMalformedPercentEncoding(matches[6]) || hasMalformedPercentEncoding(matches[7]) || hasMalformedPercentEncoding(matches[8]);
     }
     function canonicalizeHost(parsed, options, schemeHandler, isIP) {
+      if (hasForbiddenDomainHost(parsed, options, schemeHandler, isIP)) {
+        parsed.error = parsed.error || MALFORMED_HOST_ERROR;
+        return true;
+      }
       if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport) && parsed.host && !isIPLiteral(parsed.host) && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
+        let url;
         try {
-          parsed.host = new URL("http://" + parsed.host).hostname;
+          url = new URL("http://" + parsed.host);
         } catch (e) {
           parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
           return true;
         }
+        if (!isHostOnlyURL(url)) {
+          parsed.error = parsed.error || MALFORMED_HOST_ERROR;
+          return true;
+        }
+        parsed.host = url.hostname;
       }
       return false;
     }
+    function hasForbiddenDomainHost(parsed, options, schemeHandler, isIP) {
+      return Boolean(
+        parsed.host && isIP === false && !isIPLiteral(parsed.host) && (options.domainHost || schemeHandler && schemeHandler.domainHost) && FORBIDDEN_DOMAIN_HOST_CHARACTER.test(parsed.host)
+      );
+    }
+    function isHostOnlyURL(url) {
+      return url.username === "" && url.password === "" && url.port === "" && url.pathname === "/" && url.search === "" && url.hash === "" && url.hostname !== "";
+    }
     function parseWithStatus(uri, opts) {
       const options = Object.assign({}, opts);
       const parsed = {
@@ -4091,9 +4148,8 @@ var require_fast_uri = __commonJS({
         parsed.query = matches[7];
         parsed.fragment = matches[8];
         if (parsed.scheme !== void 0) {
-          const decodedScheme = unescape(parsed.scheme);
-          if (VALID_SCHEME.test(decodedScheme)) {
-            parsed.scheme = decodedScheme.toLowerCase();
+          if (VALID_SCHEME.test(parsed.scheme)) {
+            parsed.scheme = parsed.scheme.toLowerCase();
           } else {
             parsed.error = parsed.error || MALFORMED_SCHEME_ERROR;
             malformedScheme = true;
@@ -4121,7 +4177,7 @@ var require_fast_uri = __commonJS({
             malformedIPLiteral = hasIPLiteralBracket && (!bracketedIPLiteral || ipv6result.error === true);
             parsed.host = isIP ? ipv6result.host : ipv6result.host.toLowerCase();
             if (malformedIPLiteral) {
-              parsed.error = parsed.error || "URI host is malformed.";
+              parsed.error = parsed.error || MALFORMED_HOST_ERROR;
               malformedAuthorityOrPort = true;
             }
           } else {
@@ -4149,7 +4205,7 @@ var require_fast_uri = __commonJS({
           if (!isIP) {
             host = normalizePercentEncoding(host.toLowerCase());
           }
-          parsed.host = reescapeHostDelimiters(host, isIP);
+          parsed.host = isIP || options.scheme !== "null" ? reescapeHostDelimiters(host, isIP) : host;
         }
         if (!schemeHandler || schemeHandler && !schemeHandler.skipNormalize) {
           if (parsed.path) {
@@ -13695,6 +13751,17 @@ var registry_default = [
       "/apps/backend/test/fixtures/*/info.json"
     ]
   },
+  {
+    kind: "file",
+    file: "key-chain-defaults.json",
+    resourceType: "key chain defaults",
+    schemaFile: "KeyChainDefaultsConfigFile.schema.json",
+    required: false,
+    fileMatch: [
+      "/assets/config/*/key-chain-defaults.json",
+      "/apps/backend/test/fixtures/*/key-chain-defaults.json"
+    ]
+  },
   {
     kind: "file",
     file: "registrar.json",
@@ -15089,12 +15156,152 @@ function unzipSync(data, opts) {
   return files;
 }
 
+// ../../packages/eudiplo-config-format/dist/claim-constraints.js
+var CONSTRAINT_VALUE_KEYWORDS = [
+  "type",
+  "enum",
+  "const",
+  "multipleOf",
+  "maximum",
+  "exclusiveMaximum",
+  "minimum",
+  "exclusiveMinimum",
+  "maxLength",
+  "minLength",
+  "pattern",
+  "maxItems",
+  "minItems",
+  "uniqueItems",
+  "maxContains",
+  "minContains",
+  "maxProperties",
+  "minProperties",
+  "required",
+  "dependentRequired",
+  "title",
+  "description",
+  "default",
+  "examples",
+  "deprecated",
+  "readOnly",
+  "writeOnly",
+  "$comment"
+];
+var CONSTRAINT_SCHEMA_KEYWORDS = [
+  "items",
+  "contains",
+  "additionalProperties",
+  "propertyNames",
+  "not",
+  "if",
+  "then",
+  "else",
+  "unevaluatedItems",
+  "unevaluatedProperties"
+];
+var CONSTRAINT_SCHEMA_LIST_KEYWORDS = [
+  "prefixItems",
+  "allOf",
+  "anyOf",
+  "oneOf"
+];
+var CONSTRAINT_SCHEMA_MAP_KEYWORDS = [
+  "properties",
+  "patternProperties",
+  "dependentSchemas"
+];
+var VALUE_KEYWORDS = new Set(CONSTRAINT_VALUE_KEYWORDS);
+var SCHEMA_KEYWORDS = new Set(CONSTRAINT_SCHEMA_KEYWORDS);
+var SCHEMA_LIST_KEYWORDS = new Set(CONSTRAINT_SCHEMA_LIST_KEYWORDS);
+var SCHEMA_MAP_KEYWORDS = new Set(CONSTRAINT_SCHEMA_MAP_KEYWORDS);
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function pointer(path2, segment) {
+  return `${path2}/${String(segment).replaceAll("~", "~0").replaceAll("/", "~1")}`;
+}
+function sanitizeSchema(value, path2, removed) {
+  if (typeof value === "boolean") {
+    return value;
+  }
+  if (!isPlainObject(value)) {
+    removed.push(path2);
+    return void 0;
+  }
+  const entries = [];
+  for (const [key, child] of Object.entries(value)) {
+    const childPath = pointer(path2, key);
+    if (VALUE_KEYWORDS.has(key)) {
+      entries.push([key, child]);
+    } else if (SCHEMA_KEYWORDS.has(key)) {
+      const schema = sanitizeSchema(child, childPath, removed);
+      if (schema !== void 0) {
+        entries.push([key, schema]);
+      }
+    } else if (SCHEMA_LIST_KEYWORDS.has(key) && Array.isArray(child)) {
+      entries.push([
+        key,
+        child.map((schema, index) => sanitizeSchema(schema, pointer(childPath, index), removed)).filter((schema) => schema !== void 0)
+      ]);
+    } else if (SCHEMA_MAP_KEYWORDS.has(key) && isPlainObject(child)) {
+      entries.push([
+        key,
+        Object.fromEntries(Object.entries(child).map(([name, schema]) => [
+          name,
+          sanitizeSchema(schema, pointer(childPath, name), removed)
+        ]).filter(([, schema]) => schema !== void 0))
+      ]);
+    } else {
+      removed.push(childPath);
+    }
+  }
+  return Object.fromEntries(entries);
+}
+function sanitizeClaimConstraints(constraints) {
+  const removed = [];
+  const schema = sanitizeSchema(constraints, "", removed);
+  return {
+    constraints: isPlainObject(schema) ? schema : {},
+    removed
+  };
+}
+function sanitizeClaimFields(fields, path2 = "") {
+  const removed = [];
+  const sanitized = fields.map((field, index) => {
+    if (!isPlainObject(field))
+      return field;
+    const fieldPath = pointer(path2, index);
+    let next = field;
+    if (isPlainObject(field.constraints)) {
+      const result = sanitizeClaimConstraints(field.constraints);
+      if (result.removed.length > 0) {
+        next = { ...next, constraints: result.constraints };
+        removed.push(...result.removed.map((removedPath) => `${fieldPath}/constraints${removedPath}`));
+      }
+    }
+    if (Array.isArray(field.children)) {
+      const children = sanitizeClaimFields(field.children, pointer(fieldPath, "children"));
+      if (children.removed.length > 0) {
+        next = { ...next, children: children.fields };
+        removed.push(...children.removed);
+      }
+    }
+    return next;
+  });
+  return { fields: sanitized, removed };
+}
+
 // ../../packages/eudiplo-config-format/dist/config-format.js
 var CONFIG_FORMATS = {
-  Tenant: { slug: "tenant", file: "TenantConfigFile", version: 1 },
+  Tenant: { slug: "tenant", file: "TenantConfigFile", version: 4 },
   Client: { slug: "client", file: "ClientConfigFile", version: 2 },
   KmsConfig: { slug: "kms-config", file: "KmsConfigFile", version: 2 },
   KeyChain: { slug: "key-chain", file: "KeyChainConfigFile", version: 3 },
+  KeyChainDefaults: {
+    slug: "key-chain-defaults",
+    file: "KeyChainDefaultsConfigFile",
+    version: 1
+  },
   RegistrarConfig: {
     slug: "registrar-config",
     file: "RegistrarConfigFile",
@@ -15108,7 +15315,7 @@ var CONFIG_FORMATS = {
   CredentialConfig: {
     slug: "credential-config",
     file: "CredentialConfigFile",
-    version: 2
+    version: 3
   },
   PresentationConfig: {
     slug: "presentation-config",
@@ -15143,7 +15350,8 @@ var CONFIG_SINGLETON_IDS = {
   Tenant: "tenant",
   KmsConfig: "kms",
   RegistrarConfig: "registrar",
-  IssuanceConfig: "issuance"
+  IssuanceConfig: "issuance",
+  KeyChainDefaults: "defaults"
 };
 function resourceId(input) {
   const { kind } = resolveConfigIdentity(input);
@@ -15165,6 +15373,11 @@ function bareFileVersion(kind, spec) {
   }
   if (kind === "RegistrarConfig")
     return "relyingPartyContact" in spec ? 2 : 1;
+  if (kind === "Tenant") {
+    if ("defaultKeyChains" in spec)
+      return 3;
+    return "defaultAccessKeyChainId" in spec ? 2 : 1;
+  }
   if (kind === "KmsConfig") {
     const providers = Array.isArray(spec.providers) ? spec.providers : [];
     return providers.some((provider) => typeof provider === "object" && provider !== null && ("algorithms" in provider || "defaultAlgorithm" in provider)) ? 2 : 1;
@@ -15245,6 +15458,54 @@ var presentationConfigV1ToV2 = {
     };
   }
 };
+var tenantConfigV3ToV4 = {
+  id: "tenant-v4-key-chain-defaults",
+  kind: "Tenant",
+  from: 3,
+  to: 4,
+  // v4 moves the tenant's default key chains to their own resource,
+  // KeyChainDefaults (key-chain-defaults.json). Only development builds of
+  // 10.0 wrote defaultKeyChains, so the step drops it with a warning instead
+  // of creating that document.
+  migrate(spec) {
+    if (!("defaultKeyChains" in spec))
+      return { spec };
+    const { defaultKeyChains: _, ...rest } = spec;
+    return {
+      spec: rest,
+      issues: [
+        {
+          severity: "warning",
+          code: "DEFAULT_KEY_CHAINS_MOVED",
+          path: "/spec/defaultKeyChains",
+          message: 'defaultKeyChains is no longer part of the tenant settings and was removed. Set the default key chains in key-chain-defaults.json (KeyChainDefaults), for example { "access": "<key chain ID>" }.'
+        }
+      ]
+    };
+  }
+};
+var credentialConfigV2ToV3 = {
+  id: "credential-config-v3-claim-constraint-keywords",
+  kind: "CredentialConfig",
+  from: 2,
+  to: 3,
+  migrate(spec) {
+    if (!Array.isArray(spec.fields))
+      return { spec };
+    const { fields, removed } = sanitizeClaimFields(spec.fields, "/spec/fields");
+    if (removed.length === 0)
+      return { spec };
+    return {
+      spec: { ...spec, fields },
+      issues: removed.map((path2) => ({
+        severity: "warning",
+        code: "CLAIM_CONSTRAINT_KEYWORD_REMOVED",
+        path: path2,
+        message: "Removed: constraints accept only JSON Schema validation and annotation keywords."
+      }))
+    };
+  }
+};
 var CONFIG_MIGRATIONS = [
   {
     id: "issuance-config-v2-offer-lifetime",
@@ -15304,6 +15565,36 @@ var CONFIG_MIGRATIONS = [
     // as before.
     migrate: (spec) => ({ spec })
   },
+  {
+    id: "tenant-v2-default-access-key-chain",
+    kind: "Tenant",
+    from: 1,
+    to: 2,
+    // v2 only adds the optional defaultAccessKeyChainId: a v1 spec is a
+    // valid v2 spec, whose tenant keeps picking its access key chain by
+    // rule.
+    migrate: (spec) => ({ spec })
+  },
+  {
+    id: "tenant-v3-default-key-chains",
+    kind: "Tenant",
+    from: 2,
+    to: 3,
+    // v3 keeps the tenant's default key chains in a map by usage type:
+    // defaultAccessKeyChainId becomes defaultKeyChains.access.
+    migrate: (spec) => {
+      const { defaultAccessKeyChainId, ...rest } = spec;
+      return {
+        spec: typeof defaultAccessKeyChainId === "string" ? {
+          ...rest,
+          defaultKeyChains: {
+            access: defaultAccessKeyChainId
+          }
+        } : rest
+      };
+    }
+  },
+  tenantConfigV3ToV4,
   {
     id: "key-chain-v2-type",
     kind: "KeyChain",
@@ -15332,6 +15623,7 @@ var CONFIG_MIGRATIONS = [
     // spec is a valid v2 spec.
     migrate: (spec) => ({ spec })
   },
+  credentialConfigV2ToV3,
   presentationConfigV1ToV2,
   {
     id: "presentation-config-v3-typed-claim-values",
@@ -18042,6 +18334,54 @@ var CONFIG_SCHEMAS = [
     ],
     "additionalProperties": false
   },
+  {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://eudiplo.dev/schemas/v1/KeyChainDefaultsConfigFile.schema.json",
+    "title": "KeyChainDefaultsConfigFile",
+    "type": "object",
+    "properties": {
+      "$schema": {
+        "type": "string",
+        "const": "https://eudiplo.dev/schemas/v1/KeyChainDefaultsConfigFile.schema.json"
+      },
+      "metadata": {
+        "type": "object",
+        "properties": {
+          "generation": {
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 9007199254740991
+          },
+          "ownership": {
+            "type": "string",
+            "enum": [
+              "unmanaged",
+              "file-managed"
+            ]
+          }
+        },
+        "additionalProperties": false
+      },
+      "spec": {
+        "type": "object",
+        "properties": {
+          "access": {
+            "description": "ID of the access key chain used where no configuration names one: presentation requests of configurations without accessKeyChainId and the signed issuer metadata. Without it, EUDIPLO picks one of the tenant's access key chains by rule.",
+            "type": "string",
+            "minLength": 1
+          }
+        },
+        "additionalProperties": false,
+        "description": "The tenant's key chain per usage type, used where no configuration names one. A usage type without an entry uses a key chain picked by rule."
+      }
+    },
+    "required": [
+      "$schema",
+      "metadata",
+      "spec"
+    ],
+    "additionalProperties": false
+  },
   {
     "$schema": "https://json-schema.org/draft/2020-12/schema",
     "$id": "https://eudiplo.dev/schemas/v1/KmsConfigFile.schema.json",
@@ -24583,13 +24923,13 @@ var CONFIG_SCHEMAS = [
   },
   {
     "$schema": "https://json-schema.org/draft/2020-12/schema",
-    "$id": "https://eudiplo.dev/schemas/v3/IssuanceConfigFile.schema.json",
-    "title": "IssuanceConfigFile",
+    "$id": "https://eudiplo.dev/schemas/v2/TenantConfigFile.schema.json",
+    "title": "TenantConfigFile",
     "type": "object",
     "properties": {
       "$schema": {
         "type": "string",
-        "const": "https://eudiplo.dev/schemas/v3/IssuanceConfigFile.schema.json"
+        "const": "https://eudiplo.dev/schemas/v2/TenantConfigFile.schema.json"
       },
       "metadata": {
         "type": "object",
@@ -24597,33 +24937,1190 @@ var CONFIG_SCHEMAS = [
           "generation": {
             "type": "integer",
             "minimum": 1,
-            "description": "Monotonically increasing configuration generation."
+            "maximum": 9007199254740991
           },
           "ownership": {
             "type": "string",
             "enum": [
               "unmanaged",
               "file-managed"
-            ],
-            "description": "Requested ownership recorded when the document is applied."
+            ]
           }
         },
         "additionalProperties": false
       },
       "spec": {
-        "$ref": "#/$defs/IssuanceConfig"
+        "type": "object",
+        "properties": {
+          "name": {
+            "default": "EUDIPLO",
+            "description": "Display name of the tenant.",
+            "type": "string",
+            "minLength": 1
+          },
+          "description": {
+            "description": "Optional tenant description.",
+            "type": "string",
+            "minLength": 1
+          },
+          "sessionConfig": {
+            "description": "Optional tenant-specific session storage configuration.",
+            "type": "object",
+            "properties": {
+              "ttlSeconds": {
+                "description": "Session time-to-live in seconds.",
+                "type": "integer",
+                "minimum": 60,
+                "maximum": 9007199254740991
+              },
+              "cleanupMode": {
+                "description": "Whether to fully delete or anonymize expired sessions.",
+                "type": "string",
+                "enum": [
+                  "full",
+                  "anonymize"
+                ]
+              }
+            },
+            "additionalProperties": false
+          },
+          "statusListConfig": {
+            "description": "Optional tenant-specific status list defaults.",
+            "type": "object",
+            "properties": {
+              "capacity": {
+                "description": "Default status list capacity.",
+                "type": "integer",
+                "minimum": 100,
+                "maximum": 9007199254740991
+              },
+              "bits": {
+                "description": "Bits-per-status setting (1, 2, 4, or 8).",
+                "anyOf": [
+                  {
+                    "type": "number",
+                    "const": 1
+                  },
+                  {
+                    "type": "number",
+                    "const": 2
+                  },
+                  {
+                    "type": "number",
+                    "const": 4
+                  },
+                  {
+                    "type": "number",
+                    "const": 8
+                  }
+                ]
+              },
+              "ttl": {
+                "description": "JWT TTL for status list tokens in seconds.",
+                "type": "integer",
+                "minimum": 60,
+                "maximum": 9007199254740991
+              },
+              "immediateUpdate": {
+                "description": "Regenerate status list JWTs immediately after status updates.",
+                "type": "boolean"
+              },
+              "enableAggregation": {
+                "description": "Include aggregation_uri in generated status list JWTs.",
+                "type": "boolean"
+              }
+            },
+            "additionalProperties": false
+          },
+          "defaultAccessKeyChainId": {
+            "description": "ID of the access key chain used where no configuration names one: presentation requests of configurations without accessKeyChainId and the signed issuer metadata. Without it, EUDIPLO picks one of the tenant's access key chains by rule.",
+            "type": "string",
+            "minLength": 1
+          }
+        },
+        "required": [
+          "name"
+        ],
+        "additionalProperties": false,
+        "description": "Payload used when importing tenant metadata from config files."
       }
     },
     "required": [
       "$schema",
+      "metadata",
       "spec"
     ],
-    "additionalProperties": false,
-    "$defs": {
-      "IssuanceConfig": {
+    "additionalProperties": false
+  },
+  {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://eudiplo.dev/schemas/v3/CredentialConfigFile.schema.json",
+    "title": "CredentialConfigFile",
+    "type": "object",
+    "properties": {
+      "$schema": {
+        "type": "string",
+        "const": "https://eudiplo.dev/schemas/v3/CredentialConfigFile.schema.json"
+      },
+      "metadata": {
         "type": "object",
         "properties": {
-          "batchSize": {
+          "generation": {
+            "type": "integer",
+            "minimum": 1,
+            "description": "Monotonically increasing configuration generation."
+          },
+          "ownership": {
+            "type": "string",
+            "enum": [
+              "unmanaged",
+              "file-managed"
+            ],
+            "description": "Requested ownership recorded when the document is applied."
+          }
+        },
+        "additionalProperties": false
+      },
+      "spec": {
+        "allOf": [
+          {
+            "$ref": "#/$defs/CredentialConfigCreate"
+          },
+          {
+            "type": "object",
+            "required": [
+              "id"
+            ],
+            "properties": {
+              "id": {
+                "type": "string",
+                "minLength": 1
+              }
+            }
+          }
+        ]
+      }
+    },
+    "required": [
+      "$schema",
+      "spec"
+    ],
+    "additionalProperties": false,
+    "$defs": {
+      "CredentialConfigCreate": {
+        "type": "object",
+        "properties": {
+          "id": {
+            "type": "string",
+            "minLength": 1,
+            "description": "Credential configuration identifier."
+          },
+          "description": {
+            "description": "Optional description for operators and tooling.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "config": {
+            "type": "object",
+            "properties": {
+              "format": {
+                "type": "string",
+                "enum": [
+                  "mso_mdoc",
+                  "dc+sd-jwt"
+                ],
+                "description": "Credential format emitted by this configuration."
+              },
+              "display": {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "locale": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Locale tag for the display entry."
+                    },
+                    "name": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Human-readable field name."
+                    },
+                    "description": {
+                      "description": "Optional field description for this locale.",
+                      "type": "string"
+                    },
+                    "background_color": {
+                      "description": "Optional background color for card-style rendering.",
+                      "type": "string"
+                    },
+                    "text_color": {
+                      "description": "Optional text color for card-style rendering.",
+                      "type": "string"
+                    },
+                    "background_image": {
+                      "description": "Optional background image.",
+                      "type": "object",
+                      "properties": {
+                        "uri": {
+                          "type": "string",
+                          "minLength": 1,
+                          "description": "Image URI."
+                        }
+                      },
+                      "required": [
+                        "uri"
+                      ],
+                      "additionalProperties": false
+                    },
+                    "logo": {
+                      "description": "Optional logo image.",
+                      "type": "object",
+                      "properties": {
+                        "uri": {
+                          "type": "string",
+                          "minLength": 1,
+                          "description": "Image URI."
+                        }
+                      },
+                      "required": [
+                        "uri"
+                      ],
+                      "additionalProperties": false
+                    }
+                  },
+                  "required": [
+                    "locale",
+                    "name"
+                  ],
+                  "additionalProperties": false
+                },
+                "description": "Display metadata shown by wallets."
+              },
+              "scope": {
+                "description": "Optional OAuth scope associated with this credential type.",
+                "type": "string"
+              },
+              "docType": {
+                "description": "Optional mDoc document type.",
+                "type": "string"
+              },
+              "keyAttestationsRequired": {
+                "description": "Optional key attestation requirements.",
+                "type": "object",
+                "properties": {
+                  "key_storage": {
+                    "description": "Required key storage attestations.",
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    }
+                  },
+                  "user_authentication": {
+                    "description": "Required user authentication attestations.",
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    }
+                  }
+                },
+                "additionalProperties": false
+              },
+              "proofTypesSupported": {
+                "description": "Supported proof types for issuance requests.",
+                "type": "array",
+                "items": {
+                  "type": "string",
+                  "enum": [
+                    "jwt",
+                    "attestation"
+                  ]
+                }
+              },
+              "credentialReusePolicy": {
+                "description": "Optional PID/EAA reuse policy published in credential metadata.",
+                "type": "object",
+                "properties": {
+                  "id": {
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "options": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "details": {
+                          "minItems": 1,
+                          "type": "array",
+                          "items": {
+                            "type": "string",
+                            "enum": [
+                              "once_only",
+                              "limited_time",
+                              "limited-time",
+                              "rotating-batch",
+                              "per-relying-party"
+                            ]
+                          }
+                        },
+                        "batch_size": {
+                          "type": "integer",
+                          "minimum": 2,
+                          "maximum": 9007199254740991
+                        },
+                        "reissue_trigger_unused": {
+                          "type": "integer",
+                          "minimum": 0,
+                          "maximum": 9007199254740991
+                        },
+                        "reissue_trigger_lifetime_left": {
+                          "type": "integer",
+                          "minimum": 0,
+                          "maximum": 9007199254740991
+                        }
+                      },
+                      "required": [
+                        "details"
+                      ],
+                      "additionalProperties": false
+                    }
+                  }
+                },
+                "required": [
+                  "id"
+                ],
+                "additionalProperties": false
+              }
+            },
+            "required": [
+              "format",
+              "display"
+            ],
+            "additionalProperties": false,
+            "description": "Issuer metadata-facing credential configuration."
+          },
+          "fields": {
+            "type": "array",
+            "items": {
+              "$ref": "#/$defs/CredentialConfigCreate/$defs/__schema0"
+            },
+            "description": "Claim field definitions for credential issuance."
+          },
+          "attributeProviderId": {
+            "description": "Optional attribute provider id used to resolve claim values.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "webhookEndpointId": {
+            "description": "Not used for notifications: they go to the webhook endpoint of the offer.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "vct": {
+            "description": "Optional VCT value or structured VCT metadata.",
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "object",
+                "properties": {
+                  "vct": {
+                    "description": "VCT identifier.",
+                    "type": "string"
+                  },
+                  "name": {
+                    "description": "Human-readable VCT name.",
+                    "type": "string"
+                  },
+                  "description": {
+                    "description": "Optional VCT description.",
+                    "type": "string"
+                  },
+                  "extends": {
+                    "description": "Optional base VCT reference.",
+                    "type": "string"
+                  },
+                  "extends#integrity": {
+                    "description": "Integrity hash for the extends reference.",
+                    "type": "string"
+                  },
+                  "schema_uri": {
+                    "description": "Optional schema URI for the VCT.",
+                    "type": "string"
+                  },
+                  "schema_uri#integrity": {
+                    "description": "Integrity hash for schema_uri.",
+                    "type": "string"
+                  }
+                },
+                "additionalProperties": false
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "keyBinding": {
+            "description": "Enable key binding requirements.",
+            "type": "boolean"
+          },
+          "keyChainId": {
+            "description": "Optional key chain id used for credential signing.",
+            "type": "string",
+            "minLength": 1
+          },
+          "statusManagement": {
+            "description": "Enable status management for issued credentials.",
+            "type": "boolean"
+          },
+          "activeCredentials": {
+            "description": "Optional issuer-side policy limiting simultaneously active credentials per subject. Requires statusManagement.",
+            "anyOf": [
+              {
+                "type": "object",
+                "properties": {
+                  "enabled": {
+                    "type": "boolean",
+                    "description": "Ensure a subject has at most one active credential of this configuration."
+                  },
+                  "tracking": {
+                    "description": "How the subject's active credential set is tracked. Only 'internal' (pseudonymous, issuer-side) is currently supported.",
+                    "type": "string",
+                    "enum": [
+                      "internal"
+                    ]
+                  }
+                },
+                "required": [
+                  "enabled"
+                ],
+                "additionalProperties": false,
+                "description": "Issuer-side policy limiting the number of simultaneously active credentials per subject."
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "iaeActions": {
+            "description": "Interactive authorization steps (a presentation or a web flow) that the wallet completes, in order, before the credential is issued.",
+            "anyOf": [
+              {
+                "type": "array",
+                "items": {
+                  "oneOf": [
+                    {
+                      "type": "object",
+                      "properties": {
+                        "type": {
+                          "type": "string",
+                          "const": "openid4vp_presentation",
+                          "description": "Trigger an OpenID4VP presentation action."
+                        },
+                        "label": {
+                          "description": "Optional UI label for the action.",
+                          "type": "string"
+                        },
+                        "presentationConfigId": {
+                          "type": "string",
+                          "minLength": 1,
+                          "description": "Presentation configuration id to execute."
+                        }
+                      },
+                      "required": [
+                        "type",
+                        "presentationConfigId"
+                      ],
+                      "additionalProperties": false
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "type": {
+                          "type": "string",
+                          "const": "redirect_to_web",
+                          "description": "Trigger a redirect-to-web action."
+                        },
+                        "label": {
+                          "description": "Optional UI label for the action.",
+                          "type": "string"
+                        },
+                        "url": {
+                          "type": "string",
+                          "format": "uri",
+                          "description": "Destination URL for the redirect action."
+                        },
+                        "callbackUrl": {
+                          "description": "Optional callback URL after redirect completion.",
+                          "type": "string",
+                          "format": "uri"
+                        },
+                        "description": {
+                          "description": "Optional action description.",
+                          "type": "string"
+                        }
+                      },
+                      "required": [
+                        "type",
+                        "url"
+                      ],
+                      "additionalProperties": false
+                    }
+                  ],
+                  "description": "In-app experience action definitions."
+                }
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "sdJwtTrustFormat": {
+            "description": "Trust format used for SD-JWT verification metadata.",
+            "anyOf": [
+              {
+                "type": "string",
+                "enum": [
+                  "x5c",
+                  "federation"
+                ]
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "lifeTime": {
+            "description": "Credential lifetime in seconds.",
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 9007199254740991
+          },
+          "schemaMeta": {
+            "description": "Optional schema metadata and trust bindings.",
+            "anyOf": [
+              {
+                "type": "object",
+                "properties": {
+                  "id": {
+                    "description": "Optional schema metadata identifier.",
+                    "type": "string"
+                  },
+                  "name": {
+                    "description": "Optional schema metadata name.",
+                    "type": "string"
+                  },
+                  "version": {
+                    "type": "string",
+                    "description": "Schema metadata version."
+                  },
+                  "rulebookURI": {
+                    "description": "Optional rulebook URI reference.",
+                    "type": "string"
+                  },
+                  "attestationLoS": {
+                    "type": "string",
+                    "enum": [
+                      "iso_18045_high",
+                      "iso_18045_moderate",
+                      "iso_18045_enhanced-basic",
+                      "iso_18045_basic"
+                    ],
+                    "description": "Assurance level for attestation requirements."
+                  },
+                  "bindingType": {
+                    "type": "string",
+                    "enum": [
+                      "claim",
+                      "key",
+                      "biometric",
+                      "none"
+                    ],
+                    "description": "Subject binding type."
+                  },
+                  "schemaURIs": {
+                    "description": "Optional schema URI entries.",
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "credentialConfigId": {
+                          "description": "Optional credential configuration id this schema URI applies to.",
+                          "type": "string"
+                        },
+                        "format": {
+                          "description": "Optional credential format for this schema URI.",
+                          "type": "string"
+                        },
+                        "uri": {
+                          "description": "Schema URI reference.",
+                          "type": "string"
+                        },
+                        "meta": {
+                          "description": "Optional metadata attached to the schema URI.",
+                          "type": "object",
+                          "propertyNames": {
+                            "type": "string"
+                          },
+                          "additionalProperties": {}
+                        }
+                      },
+                      "additionalProperties": false
+                    }
+                  },
+                  "trustedAuthorities": {
+                    "description": "Optional trusted authority entries.",
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "trustListId": {
+                          "description": "Optional trust list id.",
+                          "type": "string"
+                        },
+                        "frameworkType": {
+                          "description": "Trust framework type. `x509` takes a root certificate in `value` and no `verificationMethod`.",
+                          "type": "string",
+                          "enum": [
+                            "aki",
+                            "etsi_tl",
+                            "openid_federation",
+                            "x509"
+                          ]
+                        },
+                        "value": {
+                          "description": "Framework-specific authority value, for example the trust list URL for `etsi_tl` or the root certificate (base64 DER or PEM) for `x509`.",
+                          "type": "string"
+                        },
+                        "verificationMethod": {
+                          "description": "Verification method descriptor.",
+                          "anyOf": [
+                            {
+                              "type": "object",
+                              "propertyNames": {
+                                "type": "string"
+                              },
+                              "additionalProperties": {}
+                            },
+                            {
+                              "type": "string"
+                            }
+                          ]
+                        }
+                      },
+                      "additionalProperties": false
+                    }
+                  }
+                },
+                "required": [
+                  "version",
+                  "attestationLoS",
+                  "bindingType"
+                ],
+                "additionalProperties": false
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "embeddedDisclosurePolicy": {
+            "description": "Optional embedded disclosure policy.",
+            "anyOf": [
+              {
+                "oneOf": [
+                  {
+                    "type": "object",
+                    "properties": {
+                      "policy": {
+                        "type": "string",
+                        "const": "attestationBased",
+                        "description": "Attestation-based policy discriminator."
+                      },
+                      "values": {
+                        "type": "array",
+                        "items": {
+                          "type": "object",
+                          "properties": {
+                            "claims": {
+                              "description": "Claims constraints considered by policy evaluation.",
+                              "type": "array",
+                              "items": {}
+                            },
+                            "credentials": {
+                              "type": "array",
+                              "items": {},
+                              "description": "Credential constraints considered by policy evaluation."
+                            },
+                            "credential_sets": {
+                              "description": "Optional credential set constraints.",
+                              "type": "array",
+                              "items": {}
+                            }
+                          },
+                          "required": [
+                            "credentials"
+                          ],
+                          "additionalProperties": false
+                        },
+                        "description": "Attestation requirements used for policy enforcement."
+                      }
+                    },
+                    "required": [
+                      "policy",
+                      "values"
+                    ],
+                    "additionalProperties": false
+                  },
+                  {
+                    "type": "object",
+                    "properties": {
+                      "policy": {
+                        "type": "string",
+                        "const": "none",
+                        "description": "No disclosure policy enforcement."
+                      }
+                    },
+                    "required": [
+                      "policy"
+                    ],
+                    "additionalProperties": false
+                  },
+                  {
+                    "type": "object",
+                    "properties": {
+                      "policy": {
+                        "type": "string",
+                        "const": "allowList",
+                        "description": "Allow-list based policy discriminator."
+                      },
+                      "values": {
+                        "type": "array",
+                        "items": {
+                          "type": "string"
+                        },
+                        "description": "Allowed values for policy checks."
+                      }
+                    },
+                    "required": [
+                      "policy",
+                      "values"
+                    ],
+                    "additionalProperties": false
+                  },
+                  {
+                    "type": "object",
+                    "properties": {
+                      "policy": {
+                        "type": "string",
+                        "const": "rootOfTrust",
+                        "description": "Root-of-trust policy discriminator."
+                      },
+                      "values": {
+                        "type": "string",
+                        "description": "Root-of-trust identifier or reference."
+                      }
+                    },
+                    "required": [
+                      "policy",
+                      "values"
+                    ],
+                    "additionalProperties": false
+                  }
+                ],
+                "description": "Embedded disclosure policy configuration."
+              },
+              {
+                "type": "null"
+              }
+            ]
+          }
+        },
+        "required": [
+          "id",
+          "config",
+          "fields"
+        ],
+        "additionalProperties": false,
+        "description": "Payload for creating credential issuance configuration.",
+        "$defs": {
+          "__schema0": {
+            "type": "object",
+            "properties": {
+              "path": {
+                "type": "array",
+                "items": {
+                  "type": [
+                    "string",
+                    "number",
+                    "null"
+                  ]
+                },
+                "description": "Path to this claim inside the credential payload."
+              },
+              "type": {
+                "type": "string",
+                "enum": [
+                  "string",
+                  "number",
+                  "integer",
+                  "boolean",
+                  "object",
+                  "array"
+                ],
+                "description": "Data type of the claim value."
+              },
+              "defaultValue": {
+                "description": "Optional default value for this field."
+              },
+              "mandatory": {
+                "description": "Whether the field is required at issuance time.",
+                "type": "boolean"
+              },
+              "disclosable": {
+                "description": "Whether the claim is selectively disclosable.",
+                "type": "boolean"
+              },
+              "namespace": {
+                "description": "Optional namespace for claim grouping.",
+                "type": "string"
+              },
+              "display": {
+                "description": "Localized display metadata for this field.",
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "locale": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Locale tag for the display entry."
+                    },
+                    "name": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Human-readable field name."
+                    },
+                    "description": {
+                      "description": "Optional field description for this locale.",
+                      "type": "string"
+                    }
+                  },
+                  "required": [
+                    "locale",
+                    "name"
+                  ],
+                  "additionalProperties": false
+                }
+              },
+              "constraints": {
+                "description": "Optional JSON Schema 2020-12 validation keywords for the claim value. Only the JSON Schema keywords listed under Constraints in the claims documentation are accepted (validation keywords such as pattern, minLength or enum, subschemas such as items or properties, and annotations); other keys, such as format or $ref, are refused.",
+                "$ref": "#/$defs/CredentialConfigCreate/$defs/ClaimConstraints"
+              },
+              "children": {
+                "description": "Nested child claim definitions for object or array fields.",
+                "type": "array",
+                "items": {
+                  "$ref": "#/$defs/CredentialConfigCreate/$defs/__schema0"
+                }
+              }
+            },
+            "required": [
+              "path",
+              "type"
+            ],
+            "additionalProperties": false
+          },
+          "ClaimConstraints": {
+            "type": "object",
+            "properties": {
+              "type": {},
+              "enum": {},
+              "const": {},
+              "multipleOf": {},
+              "maximum": {},
+              "exclusiveMaximum": {},
+              "minimum": {},
+              "exclusiveMinimum": {},
+              "maxLength": {},
+              "minLength": {},
+              "pattern": {},
+              "maxItems": {},
+              "minItems": {},
+              "uniqueItems": {},
+              "maxContains": {},
+              "minContains": {},
+              "maxProperties": {},
+              "minProperties": {},
+              "required": {},
+              "dependentRequired": {},
+              "title": {},
+              "description": {},
+              "default": {},
+              "examples": {},
+              "deprecated": {},
+              "readOnly": {},
+              "writeOnly": {},
+              "$comment": {},
+              "items": {
+                "anyOf": [
+                  {
+                    "type": "boolean"
+                  },
+                  {
+                    "$ref": "#/$defs/CredentialConfigCreate/$defs/ClaimConstraints"
+                  }
+                ]
+              },
+              "contains": {
+                "anyOf": [
+                  {
+                    "type": "boolean"
+                  },
+                  {
+                    "$ref": "#/$defs/CredentialConfigCreate/$defs/ClaimConstraints"
+                  }
+                ]
+              },
+              "additionalProperties": {
+                "anyOf": [
+                  {
+                    "type": "boolean"
+                  },
+                  {
+                    "$ref": "#/$defs/CredentialConfigCreate/$defs/ClaimConstraints"
+                  }
+                ]
+              },
+              "propertyNames": {
+                "anyOf": [
+                  {
+                    "type": "boolean"
+                  },
+                  {
+                    "$ref": "#/$defs/CredentialConfigCreate/$defs/ClaimConstraints"
+                  }
+                ]
+              },
+              "not": {
+                "anyOf": [
+                  {
+                    "type": "boolean"
+                  },
+                  {
+                    "$ref": "#/$defs/CredentialConfigCreate/$defs/ClaimConstraints"
+                  }
+                ]
+              },
+              "if": {
+                "anyOf": [
+                  {
+                    "type": "boolean"
+                  },
+                  {
+                    "$ref": "#/$defs/CredentialConfigCreate/$defs/ClaimConstraints"
+                  }
+                ]
+              },
+              "then": {
+                "anyOf": [
+                  {
+                    "type": "boolean"
+                  },
+                  {
+                    "$ref": "#/$defs/CredentialConfigCreate/$defs/ClaimConstraints"
+                  }
+                ]
+              },
+              "else": {
+                "anyOf": [
+                  {
+                    "type": "boolean"
+                  },
+                  {
+                    "$ref": "#/$defs/CredentialConfigCreate/$defs/ClaimConstraints"
+                  }
+                ]
+              },
+              "unevaluatedItems": {
+                "anyOf": [
+                  {
+                    "type": "boolean"
+                  },
+                  {
+                    "$ref": "#/$defs/CredentialConfigCreate/$defs/ClaimConstraints"
+                  }
+                ]
+              },
+              "unevaluatedProperties": {
+                "anyOf": [
+                  {
+                    "type": "boolean"
+                  },
+                  {
+                    "$ref": "#/$defs/CredentialConfigCreate/$defs/ClaimConstraints"
+                  }
+                ]
+              },
+              "prefixItems": {
+                "type": "array",
+                "items": {
+                  "anyOf": [
+                    {
+                      "type": "boolean"
+                    },
+                    {
+                      "$ref": "#/$defs/CredentialConfigCreate/$defs/ClaimConstraints"
+                    }
+                  ]
+                }
+              },
+              "allOf": {
+                "type": "array",
+                "items": {
+                  "anyOf": [
+                    {
+                      "type": "boolean"
+                    },
+                    {
+                      "$ref": "#/$defs/CredentialConfigCreate/$defs/ClaimConstraints"
+                    }
+                  ]
+                }
+              },
+              "anyOf": {
+                "type": "array",
+                "items": {
+                  "anyOf": [
+                    {
+                      "type": "boolean"
+                    },
+                    {
+                      "$ref": "#/$defs/CredentialConfigCreate/$defs/ClaimConstraints"
+                    }
+                  ]
+                }
+              },
+              "oneOf": {
+                "type": "array",
+                "items": {
+                  "anyOf": [
+                    {
+                      "type": "boolean"
+                    },
+                    {
+                      "$ref": "#/$defs/CredentialConfigCreate/$defs/ClaimConstraints"
+                    }
+                  ]
+                }
+              },
+              "properties": {
+                "type": "object",
+                "propertyNames": {
+                  "type": "string"
+                },
+                "additionalProperties": {
+                  "anyOf": [
+                    {
+                      "type": "boolean"
+                    },
+                    {
+                      "$ref": "#/$defs/CredentialConfigCreate/$defs/ClaimConstraints"
+                    }
+                  ]
+                }
+              },
+              "patternProperties": {
+                "type": "object",
+                "propertyNames": {
+                  "type": "string"
+                },
+                "additionalProperties": {
+                  "anyOf": [
+                    {
+                      "type": "boolean"
+                    },
+                    {
+                      "$ref": "#/$defs/CredentialConfigCreate/$defs/ClaimConstraints"
+                    }
+                  ]
+                }
+              },
+              "dependentSchemas": {
+                "type": "object",
+                "propertyNames": {
+                  "type": "string"
+                },
+                "additionalProperties": {
+                  "anyOf": [
+                    {
+                      "type": "boolean"
+                    },
+                    {
+                      "$ref": "#/$defs/CredentialConfigCreate/$defs/ClaimConstraints"
+                    }
+                  ]
+                }
+              }
+            },
+            "additionalProperties": false
+          }
+        },
+        "title": "CredentialConfigCreate"
+      }
+    }
+  },
+  {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://eudiplo.dev/schemas/v3/IssuanceConfigFile.schema.json",
+    "title": "IssuanceConfigFile",
+    "type": "object",
+    "properties": {
+      "$schema": {
+        "type": "string",
+        "const": "https://eudiplo.dev/schemas/v3/IssuanceConfigFile.schema.json"
+      },
+      "metadata": {
+        "type": "object",
+        "properties": {
+          "generation": {
+            "type": "integer",
+            "minimum": 1,
+            "description": "Monotonically increasing configuration generation."
+          },
+          "ownership": {
+            "type": "string",
+            "enum": [
+              "unmanaged",
+              "file-managed"
+            ],
+            "description": "Requested ownership recorded when the document is applied."
+          }
+        },
+        "additionalProperties": false
+      },
+      "spec": {
+        "$ref": "#/$defs/IssuanceConfig"
+      }
+    },
+    "required": [
+      "$schema",
+      "spec"
+    ],
+    "additionalProperties": false,
+    "$defs": {
+      "IssuanceConfig": {
+        "type": "object",
+        "properties": {
+          "batchSize": {
             "description": "Optional issuance batch size.",
             "type": "integer",
             "minimum": 1,
@@ -26314,80 +27811,218 @@ var CONFIG_SCHEMAS = [
               {
                 "type": "null"
               }
-            ]
-          },
-          "webhookEndpointId": {
-            "description": "Optional webhook endpoint id for presentation callbacks.",
-            "type": [
-              "string",
-              "null"
-            ]
+            ]
+          },
+          "webhookEndpointId": {
+            "description": "Optional webhook endpoint id for presentation callbacks.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "attached": {
+            "description": "Optional attachments included with presentation requests.",
+            "anyOf": [
+              {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "format": {
+                      "type": "string",
+                      "description": "Attachment format identifier."
+                    },
+                    "data": {
+                      "description": "Attachment payload."
+                    },
+                    "credential_ids": {
+                      "description": "Optional credential query ids bound to this attachment.",
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      }
+                    }
+                  },
+                  "required": [
+                    "format",
+                    "data"
+                  ],
+                  "additionalProperties": false
+                }
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "redirectUri": {
+            "description": "Optional redirect URI after presentation completion.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "accessKeyChainId": {
+            "description": "Optional key chain id for access token/auth operations.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "readerAuth": {
+            "description": "Whether reader authentication is required for mDoc requests.",
+            "type": [
+              "boolean",
+              "null"
+            ]
+          }
+        },
+        "required": [
+          "id",
+          "dcql_query"
+        ],
+        "additionalProperties": false,
+        "title": "PresentationConfigCreateDto"
+      }
+    }
+  },
+  {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://eudiplo.dev/schemas/v3/TenantConfigFile.schema.json",
+    "title": "TenantConfigFile",
+    "type": "object",
+    "properties": {
+      "$schema": {
+        "type": "string",
+        "const": "https://eudiplo.dev/schemas/v3/TenantConfigFile.schema.json"
+      },
+      "metadata": {
+        "type": "object",
+        "properties": {
+          "generation": {
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 9007199254740991
+          },
+          "ownership": {
+            "type": "string",
+            "enum": [
+              "unmanaged",
+              "file-managed"
+            ]
+          }
+        },
+        "additionalProperties": false
+      },
+      "spec": {
+        "type": "object",
+        "properties": {
+          "name": {
+            "default": "EUDIPLO",
+            "description": "Display name of the tenant.",
+            "type": "string",
+            "minLength": 1
+          },
+          "description": {
+            "description": "Optional tenant description.",
+            "type": "string",
+            "minLength": 1
+          },
+          "sessionConfig": {
+            "description": "Optional tenant-specific session storage configuration.",
+            "type": "object",
+            "properties": {
+              "ttlSeconds": {
+                "description": "Session time-to-live in seconds.",
+                "type": "integer",
+                "minimum": 60,
+                "maximum": 9007199254740991
+              },
+              "cleanupMode": {
+                "description": "Whether to fully delete or anonymize expired sessions.",
+                "type": "string",
+                "enum": [
+                  "full",
+                  "anonymize"
+                ]
+              }
+            },
+            "additionalProperties": false
           },
-          "attached": {
-            "description": "Optional attachments included with presentation requests.",
-            "anyOf": [
-              {
-                "type": "array",
-                "items": {
-                  "type": "object",
-                  "properties": {
-                    "format": {
-                      "type": "string",
-                      "description": "Attachment format identifier."
-                    },
-                    "data": {
-                      "description": "Attachment payload."
-                    },
-                    "credential_ids": {
-                      "description": "Optional credential query ids bound to this attachment.",
-                      "type": "array",
-                      "items": {
-                        "type": "string"
-                      }
-                    }
+          "statusListConfig": {
+            "description": "Optional tenant-specific status list defaults.",
+            "type": "object",
+            "properties": {
+              "capacity": {
+                "description": "Default status list capacity.",
+                "type": "integer",
+                "minimum": 100,
+                "maximum": 9007199254740991
+              },
+              "bits": {
+                "description": "Bits-per-status setting (1, 2, 4, or 8).",
+                "anyOf": [
+                  {
+                    "type": "number",
+                    "const": 1
                   },
-                  "required": [
-                    "format",
-                    "data"
-                  ],
-                  "additionalProperties": false
-                }
+                  {
+                    "type": "number",
+                    "const": 2
+                  },
+                  {
+                    "type": "number",
+                    "const": 4
+                  },
+                  {
+                    "type": "number",
+                    "const": 8
+                  }
+                ]
               },
-              {
-                "type": "null"
+              "ttl": {
+                "description": "JWT TTL for status list tokens in seconds.",
+                "type": "integer",
+                "minimum": 60,
+                "maximum": 9007199254740991
+              },
+              "immediateUpdate": {
+                "description": "Regenerate status list JWTs immediately after status updates.",
+                "type": "boolean"
+              },
+              "enableAggregation": {
+                "description": "Include aggregation_uri in generated status list JWTs.",
+                "type": "boolean"
               }
-            ]
-          },
-          "redirectUri": {
-            "description": "Optional redirect URI after presentation completion.",
-            "type": [
-              "string",
-              "null"
-            ]
-          },
-          "accessKeyChainId": {
-            "description": "Optional key chain id for access token/auth operations.",
-            "type": [
-              "string",
-              "null"
-            ]
+            },
+            "additionalProperties": false
           },
-          "readerAuth": {
-            "description": "Whether reader authentication is required for mDoc requests.",
-            "type": [
-              "boolean",
-              "null"
-            ]
+          "defaultKeyChains": {
+            "type": "object",
+            "properties": {
+              "access": {
+                "description": "ID of the access key chain used where no configuration names one: presentation requests of configurations without accessKeyChainId and the signed issuer metadata. Without it, EUDIPLO picks one of the tenant's access key chains by rule.",
+                "type": "string",
+                "minLength": 1
+              }
+            },
+            "additionalProperties": false,
+            "description": "The tenant's key chain per usage type, used where no configuration names one. A usage type without an entry uses a key chain picked by rule."
           }
         },
         "required": [
-          "id",
-          "dcql_query"
+          "name"
         ],
         "additionalProperties": false,
-        "title": "PresentationConfigCreateDto"
+        "description": "Payload used when importing tenant metadata from config files."
       }
-    }
+    },
+    "required": [
+      "$schema",
+      "metadata",
+      "spec"
+    ],
+    "additionalProperties": false
   },
   {
     "$schema": "https://json-schema.org/draft/2020-12/schema",
@@ -27127,6 +28762,132 @@ var CONFIG_SCHEMAS = [
       }
     }
   },
+  {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://eudiplo.dev/schemas/v4/TenantConfigFile.schema.json",
+    "title": "TenantConfigFile",
+    "type": "object",
+    "properties": {
+      "$schema": {
+        "type": "string",
+        "const": "https://eudiplo.dev/schemas/v4/TenantConfigFile.schema.json"
+      },
+      "metadata": {
+        "type": "object",
+        "properties": {
+          "generation": {
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 9007199254740991
+          },
+          "ownership": {
+            "type": "string",
+            "enum": [
+              "unmanaged",
+              "file-managed"
+            ]
+          }
+        },
+        "additionalProperties": false
+      },
+      "spec": {
+        "type": "object",
+        "properties": {
+          "name": {
+            "default": "EUDIPLO",
+            "description": "Display name of the tenant.",
+            "type": "string",
+            "minLength": 1
+          },
+          "description": {
+            "description": "Optional tenant description.",
+            "type": "string",
+            "minLength": 1
+          },
+          "sessionConfig": {
+            "description": "Optional tenant-specific session storage configuration.",
+            "type": "object",
+            "properties": {
+              "ttlSeconds": {
+                "description": "Session time-to-live in seconds.",
+                "type": "integer",
+                "minimum": 60,
+                "maximum": 9007199254740991
+              },
+              "cleanupMode": {
+                "description": "Whether to fully delete or anonymize expired sessions.",
+                "type": "string",
+                "enum": [
+                  "full",
+                  "anonymize"
+                ]
+              }
+            },
+            "additionalProperties": false
+          },
+          "statusListConfig": {
+            "description": "Optional tenant-specific status list defaults.",
+            "type": "object",
+            "properties": {
+              "capacity": {
+                "description": "Default status list capacity.",
+                "type": "integer",
+                "minimum": 100,
+                "maximum": 9007199254740991
+              },
+              "bits": {
+                "description": "Bits-per-status setting (1, 2, 4, or 8).",
+                "anyOf": [
+                  {
+                    "type": "number",
+                    "const": 1
+                  },
+                  {
+                    "type": "number",
+                    "const": 2
+                  },
+                  {
+                    "type": "number",
+                    "const": 4
+                  },
+                  {
+                    "type": "number",
+                    "const": 8
+                  }
+                ]
+              },
+              "ttl": {
+                "description": "JWT TTL for status list tokens in seconds.",
+                "type": "integer",
+                "minimum": 60,
+                "maximum": 9007199254740991
+              },
+              "immediateUpdate": {
+                "description": "Regenerate status list JWTs immediately after status updates.",
+                "type": "boolean"
+              },
+              "enableAggregation": {
+                "description": "Include aggregation_uri in generated status list JWTs.",
+                "type": "boolean"
+              }
+            },
+            "additionalProperties": false
+          }
+        },
+        "required": [
+          "name"
+        ],
+        "additionalProperties": false,
+        "description": "Payload used when importing tenant metadata from config files."
+      }
+    },
+    "required": [
+      "$schema",
+      "metadata",
+      "spec"
+    ],
+    "additionalProperties": false
+  },
   {
     "$schema": "https://json-schema.org/draft/2020-12/schema",
     "$id": "https://eudiplo.dev/schemas/v5/IssuanceConfigFile.schema.json",
@@ -28065,12 +29826,7 @@ function inferredKind(path2) {
 function wrapBare(kind, input, path2) {
   if (!input || typeof input !== "object" || Array.isArray(input))
     throw new Error(`${path2}: configuration must be an object`);
-  const singleton = {
-    Tenant: "tenant",
-    KmsConfig: "kms",
-    RegistrarConfig: "registrar",
-    IssuanceConfig: "issuance"
-  };
+  const singleton = CONFIG_SINGLETON_IDS;
   const spec = structuredClone(input);
   if (kind === "KeyChain" && spec.key && !spec.keySource) {
     spec.keySource = { type: "private-jwk", jwk: spec.key };
@@ -30720,7 +32476,7 @@ function createDeploymentCommands(context, setExitCode) {
 // package.json
 var package_default = {
   name: "@eudiplo/cli",
-  version: "9.1.0-main.1a18187",
+  version: "9.1.0-main.1b295eb",
   description: "Deployment-aware command line tools for EUDIPLO",
   private: false,
   type: "module",
@@ -30781,12 +32537,12 @@ var package_default = {
     "jsonc-parser": "^3.3.1"
   },
   devDependencies: {
-    "@biomejs/biome": "2.5.15",
-    "@types/node": "^26.6.4",
+    "@biomejs/biome": "2.6.3",
+    "@types/node": "^26.6.5",
     esbuild: "^0.28.2",
     tsx: "^4.23.15",
     typescript: "^7.0.2",
-    vitest: "5.0.3"
+    vitest: "5.0.5"
   }
 };