@eudiplo/cli 9.1.0-main.52a85b9 → 9.1.0-main.54c58b8

package/dist/index.js

@@ -3099,9 +3099,9 @@ var require_data = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/lib/utils.js
+// ../../node_modules/.pnpm/fast-uri@3.1.9/node_modules/fast-uri/lib/utils.js
 var require_utils = __commonJS({
-  "../../node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/lib/utils.js"(exports, module) {
+  "../../node_modules/.pnpm/fast-uri@3.1.9/node_modules/fast-uri/lib/utils.js"(exports, module) {
     "use strict";
     var isUUID = RegExp.prototype.test.bind(/^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/iu);
     var isIPv4 = RegExp.prototype.test.bind(/^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)$/u);
@@ -3333,6 +3333,37 @@ var require_utils = __commonJS({
       }
       return output.join("");
     }
+    function removeDotSegmentsRelative(path2) {
+      if (path2 === "" || path2[0] === "/") {
+        return removeDotSegments(path2);
+      }
+      const segments = path2.split("/");
+      const last = segments.length - 1;
+      const output = [];
+      let trailingDirectory = false;
+      for (let i2 = 0; i2 <= last; i2++) {
+        const segment = segments[i2];
+        if (segment === "." || segment === "..") {
+          if (segment === "..") {
+            if (output.length !== 0 && output[output.length - 1] !== "..") {
+              output.pop();
+            } else {
+              output.push("..");
+            }
+          }
+          trailingDirectory = i2 === last;
+        } else {
+          output.push(segment);
+        }
+      }
+      if (trailingDirectory && output[output.length - 1] !== "..") {
+        output.push("");
+      }
+      if (output.length === 0 || output[0] === "" || output[0].includes(":")) {
+        output.unshift(".");
+      }
+      return output.join("/");
+    }
     var HOST_DELIMS = { "@": "%40", "/": "%2F", "?": "%3F", "#": "%23", ":": "%3A" };
     var HOST_DELIM_RE = /[@/?#:]/g;
     var HOST_DELIM_NO_COLON_RE = /[@/?#]/g;
@@ -3593,6 +3624,7 @@ var require_utils = __commonJS({
       encodeFragment,
       escapePreservingEscapes,
       removeDotSegments,
+      removeDotSegmentsRelative,
       isIPv4,
       isUUID,
       normalizeIPv6,
@@ -3601,9 +3633,9 @@ var require_utils = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/lib/schemes.js
+// ../../node_modules/.pnpm/fast-uri@3.1.9/node_modules/fast-uri/lib/schemes.js
 var require_schemes = __commonJS({
-  "../../node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/lib/schemes.js"(exports, module) {
+  "../../node_modules/.pnpm/fast-uri@3.1.9/node_modules/fast-uri/lib/schemes.js"(exports, module) {
     "use strict";
     var { isUUID } = require_utils();
     var URN_REG = /^([\da-z][\d\-a-z]{0,31}):((?:[\w!$'()*+,\-./:;=@]|%[\da-f]{2})+)$/iu;
@@ -3812,20 +3844,22 @@ var require_schemes = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/index.js
+// ../../node_modules/.pnpm/fast-uri@3.1.9/node_modules/fast-uri/index.js
 var require_fast_uri = __commonJS({
-  "../../node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/index.js"(exports, module) {
+  "../../node_modules/.pnpm/fast-uri@3.1.9/node_modules/fast-uri/index.js"(exports, module) {
     "use strict";
-    var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
+    var { normalizeIPv6, removeDotSegments, removeDotSegmentsRelative, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
     var { SCHEMES, getSchemeHandler } = require_schemes();
     var VALID_SCHEME = /^[A-Za-z][A-Za-z0-9+.-]*$/u;
     var MALFORMED_SCHEME_ERROR = "URI scheme is malformed.";
-    function decodeValidScheme(scheme) {
-      const decodedScheme = unescape(String(scheme));
-      if (!VALID_SCHEME.test(decodedScheme)) {
+    var MALFORMED_HOST_ERROR = "URI host is malformed.";
+    var FORBIDDEN_DOMAIN_HOST_CHARACTER = /[\0-\x20"#/:<>?@[\\\]^`{|}\x7F]/u;
+    function validateScheme(scheme) {
+      const stringScheme = String(scheme);
+      if (!VALID_SCHEME.test(stringScheme)) {
         throw new TypeError(MALFORMED_SCHEME_ERROR);
       }
-      return decodedScheme;
+      return stringScheme;
     }
     function normalize(uri, options) {
       if (typeof uri === "string") {
@@ -3862,6 +3896,9 @@ var require_fast_uri = __commonJS({
       const resolvedSchemeHandler = getSchemeHandler(options && options.scheme || resolved.scheme);
       const resolvedHost = resolved.host;
       const resolvedHostIsIP = resolvedHost !== void 0 && resolvedHost !== "" && (isIPv4(resolvedHost) || normalizeIPv6(resolvedHost).isIPV6);
+      if (hasForbiddenDomainHost(resolved, options || {}, resolvedSchemeHandler, resolvedHostIsIP)) {
+        throw new Error(MALFORMED_HOST_ERROR);
+      }
       canonicalizeHost(resolved, options || {}, resolvedSchemeHandler, resolvedHostIsIP);
       const encodedASCIIHost = resolvedHost && resolvedHost.indexOf("%") !== -1 && !new RegExp("\\P{ASCII}", "u").test(resolvedHost);
       if (resolved.error && !encodedASCIIHost) {
@@ -3903,14 +3940,15 @@ var require_fast_uri = __commonJS({
             if (relative3.path[0] === "/") {
               target.path = removeDotSegments(relative3.path);
             } else {
-              if ((base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0) && !base.path) {
+              const baseHasAuthority = base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0;
+              if (baseHasAuthority && !base.path) {
                 target.path = "/" + relative3.path;
               } else if (!base.path) {
                 target.path = relative3.path;
               } else {
                 target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative3.path;
               }
-              target.path = removeDotSegments(target.path);
+              target.path = base.scheme === void 0 && !baseHasAuthority && target.path[0] !== "/" ? removeDotSegmentsRelative(target.path) : removeDotSegments(target.path);
             }
             target.query = relative3.query;
           }
@@ -3948,12 +3986,13 @@ var require_fast_uri = __commonJS({
       const options = Object.assign({}, opts);
       const uriTokens = [];
       if (component.scheme) {
-        component.scheme = decodeValidScheme(component.scheme);
+        component.scheme = validateScheme(component.scheme);
       }
       const schemeHandler = getSchemeHandler(options.scheme || component.scheme);
       if (schemeHandler && schemeHandler.serialize) schemeHandler.serialize(component, options);
       const hasAuthority = component.userinfo !== void 0 || component.host !== void 0 || component.port !== void 0;
-      const pathNoScheme = !options.skipEscape && component.scheme === void 0 && !hasAuthority;
+      const schemelessReference = (component.scheme === void 0 || options.reference === "suffix") && !hasAuthority;
+      const pathNoScheme = !options.skipEscape && schemelessReference;
       if (component.path !== void 0) {
         if (!options.skipEscape) {
           component.path = serializePathEncoding(component.path, pathNoScheme);
@@ -3962,7 +4001,7 @@ var require_fast_uri = __commonJS({
         }
       }
       if (options.reference !== "suffix" && component.scheme) {
-        component.scheme = decodeValidScheme(component.scheme);
+        component.scheme = validateScheme(component.scheme);
         uriTokens.push(component.scheme, ":");
       }
       const authority = recomposeAuthority(component);
@@ -3978,9 +4017,9 @@ var require_fast_uri = __commonJS({
       if (component.path !== void 0) {
         let s = component.path;
         if (!options.absolutePath && (!schemeHandler || !schemeHandler.absolutePath)) {
-          s = removeDotSegments(s);
+          s = schemelessReference && s[0] !== "/" ? removeDotSegmentsRelative(s) : removeDotSegments(s);
         }
-        if (pathNoScheme) {
+        if (schemelessReference) {
           s = serializePathEncoding(s, true);
         }
         if (authority === void 0 && s[0] === "/" && s[1] === "/") {
@@ -4027,16 +4066,34 @@ var require_fast_uri = __commonJS({
       return hasMalformedPercentEncoding(matches[3]) || host !== void 0 && !isIPLiteral(host) && hasMalformedPercentEncoding(host) || hasMalformedPercentEncoding(matches[6]) || hasMalformedPercentEncoding(matches[7]) || hasMalformedPercentEncoding(matches[8]);
     }
     function canonicalizeHost(parsed, options, schemeHandler, isIP) {
+      if (hasForbiddenDomainHost(parsed, options, schemeHandler, isIP)) {
+        parsed.error = parsed.error || MALFORMED_HOST_ERROR;
+        return true;
+      }
       if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport) && parsed.host && !isIPLiteral(parsed.host) && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
+        let url;
         try {
-          parsed.host = new URL("http://" + parsed.host).hostname;
+          url = new URL("http://" + parsed.host);
         } catch (e) {
           parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
           return true;
         }
+        if (!isHostOnlyURL(url)) {
+          parsed.error = parsed.error || MALFORMED_HOST_ERROR;
+          return true;
+        }
+        parsed.host = url.hostname;
       }
       return false;
     }
+    function hasForbiddenDomainHost(parsed, options, schemeHandler, isIP) {
+      return Boolean(
+        parsed.host && isIP === false && !isIPLiteral(parsed.host) && (options.domainHost || schemeHandler && schemeHandler.domainHost) && FORBIDDEN_DOMAIN_HOST_CHARACTER.test(parsed.host)
+      );
+    }
+    function isHostOnlyURL(url) {
+      return url.username === "" && url.password === "" && url.port === "" && url.pathname === "/" && url.search === "" && url.hash === "" && url.hostname !== "";
+    }
     function parseWithStatus(uri, opts) {
       const options = Object.assign({}, opts);
       const parsed = {
@@ -4091,9 +4148,8 @@ var require_fast_uri = __commonJS({
         parsed.query = matches[7];
         parsed.fragment = matches[8];
         if (parsed.scheme !== void 0) {
-          const decodedScheme = unescape(parsed.scheme);
-          if (VALID_SCHEME.test(decodedScheme)) {
-            parsed.scheme = decodedScheme.toLowerCase();
+          if (VALID_SCHEME.test(parsed.scheme)) {
+            parsed.scheme = parsed.scheme.toLowerCase();
           } else {
             parsed.error = parsed.error || MALFORMED_SCHEME_ERROR;
             malformedScheme = true;
@@ -4121,7 +4177,7 @@ var require_fast_uri = __commonJS({
             malformedIPLiteral = hasIPLiteralBracket && (!bracketedIPLiteral || ipv6result.error === true);
             parsed.host = isIP ? ipv6result.host : ipv6result.host.toLowerCase();
             if (malformedIPLiteral) {
-              parsed.error = parsed.error || "URI host is malformed.";
+              parsed.error = parsed.error || MALFORMED_HOST_ERROR;
               malformedAuthorityOrPort = true;
             }
           } else {
@@ -4149,7 +4205,7 @@ var require_fast_uri = __commonJS({
           if (!isIP) {
             host = normalizePercentEncoding(host.toLowerCase());
           }
-          parsed.host = reescapeHostDelimiters(host, isIP);
+          parsed.host = isIP || options.scheme !== "null" ? reescapeHostDelimiters(host, isIP) : host;
         }
         if (!schemeHandler || schemeHandler && !schemeHandler.skipNormalize) {
           if (parsed.path) {
@@ -13695,6 +13751,17 @@ var registry_default = [
       "/apps/backend/test/fixtures/*/info.json"
     ]
   },
+  {
+    kind: "file",
+    file: "key-chain-defaults.json",
+    resourceType: "key chain defaults",
+    schemaFile: "KeyChainDefaultsConfigFile.schema.json",
+    required: false,
+    fileMatch: [
+      "/assets/config/*/key-chain-defaults.json",
+      "/apps/backend/test/fixtures/*/key-chain-defaults.json"
+    ]
+  },
   {
     kind: "file",
     file: "registrar.json",
@@ -13749,6 +13816,16 @@ var registry_default = [
       "/apps/backend/test/fixtures/*/attribute-providers/*.json"
     ]
   },
+  {
+    kind: "directory",
+    subfolder: "federation-trust-anchors",
+    resourceType: "federation trust anchor",
+    schemaFile: "FederationTrustAnchorConfigFile.schema.json",
+    fileMatch: [
+      "/assets/config/*/federation-trust-anchors/*.json",
+      "/apps/backend/test/fixtures/*/federation-trust-anchors/*.json"
+    ]
+  },
   {
     kind: "directory",
     subfolder: "webhook-endpoints",
@@ -15081,10 +15158,15 @@ function unzipSync(data, opts) {
 
 // ../../packages/eudiplo-config-format/dist/config-format.js
 var CONFIG_FORMATS = {
-  Tenant: { slug: "tenant", file: "TenantConfigFile", version: 1 },
+  Tenant: { slug: "tenant", file: "TenantConfigFile", version: 4 },
   Client: { slug: "client", file: "ClientConfigFile", version: 2 },
   KmsConfig: { slug: "kms-config", file: "KmsConfigFile", version: 2 },
-  KeyChain: { slug: "key-chain", file: "KeyChainConfigFile", version: 2 },
+  KeyChain: { slug: "key-chain", file: "KeyChainConfigFile", version: 3 },
+  KeyChainDefaults: {
+    slug: "key-chain-defaults",
+    file: "KeyChainDefaultsConfigFile",
+    version: 1
+  },
   RegistrarConfig: {
     slug: "registrar-config",
     file: "RegistrarConfigFile",
@@ -15093,7 +15175,7 @@ var CONFIG_FORMATS = {
   IssuanceConfig: {
     slug: "issuance-config",
     file: "IssuanceConfigFile",
-    version: 4
+    version: 5
   },
   CredentialConfig: {
     slug: "credential-config",
@@ -15116,6 +15198,11 @@ var CONFIG_FORMATS = {
     version: 1
   },
   TrustList: { slug: "trust-list", file: "TrustListConfigFile", version: 1 },
+  FederationTrustAnchor: {
+    slug: "federation-trust-anchor",
+    file: "FederationTrustAnchorConfigFile",
+    version: 1
+  },
   StatusList: {
     slug: "status-list",
     file: "StatusListConfigFile",
@@ -15128,7 +15215,8 @@ var CONFIG_SINGLETON_IDS = {
   Tenant: "tenant",
   KmsConfig: "kms",
   RegistrarConfig: "registrar",
-  IssuanceConfig: "issuance"
+  IssuanceConfig: "issuance",
+  KeyChainDefaults: "defaults"
 };
 function resourceId(input) {
   const { kind } = resolveConfigIdentity(input);
@@ -15143,16 +15231,74 @@ function resourceId(input) {
   return id;
 }
 function bareFileVersion(kind, spec) {
-  if (kind === "KeyChain")
+  if (kind === "KeyChain") {
+    if (spec.usageType === "federation")
+      return 3;
     return "type" in spec ? 2 : 1;
+  }
   if (kind === "RegistrarConfig")
     return "relyingPartyContact" in spec ? 2 : 1;
+  if (kind === "Tenant") {
+    if ("defaultKeyChains" in spec)
+      return 3;
+    return "defaultAccessKeyChainId" in spec ? 2 : 1;
+  }
   if (kind === "KmsConfig") {
     const providers = Array.isArray(spec.providers) ? spec.providers : [];
     return providers.some((provider) => typeof provider === "object" && provider !== null && ("algorithms" in provider || "defaultAlgorithm" in provider)) ? 2 : 1;
   }
   return 1;
 }
+var issuanceConfigV4ToV5 = {
+  id: "issuance-config-v5-federation-entity",
+  kind: "IssuanceConfig",
+  from: 4,
+  to: 5,
+  migrate(spec) {
+    const federation = spec.federation;
+    const problem = object(federation) && typeof federation.entityId === "string" && federation.entityId !== "" ? federationEntityIdProblem(federation.entityId, {
+      allowHttp: true
+    }) : void 0;
+    if (!problem)
+      return { spec };
+    return {
+      spec,
+      issues: [
+        {
+          severity: "required-input",
+          code: "FEDERATION_ENTITY_ID_INVALID",
+          path: "/spec/federation/entityId",
+          message: `${problem}: set an https URL with a host and without query or fragment, usually <PUBLIC_URL>/issuers/<tenant>`
+        }
+      ]
+    };
+  }
+};
+function federationEntityIdProblem(entityId, options) {
+  const value = `federation.entityId '${JSON.stringify(entityId).slice(1, -1)}'`;
+  if (/[\s\u0000-\u001f\u007f]/.test(entityId)) {
+    return `${value} must not contain whitespace or control characters`;
+  }
+  if (entityId.includes("?") || entityId.includes("#")) {
+    return `${value} must not have a query or fragment`;
+  }
+  let url;
+  try {
+    url = new URL(entityId);
+  } catch {
+    return `${value} is not a URL`;
+  }
+  if (url.protocol !== "https:" && !(options.allowHttp && url.protocol === "http:")) {
+    return options.allowHttp ? `${value} must be an https or http URL` : `${value} must be an https URL (http only with OUTBOUND_URL_ALLOW_HTTP=true)`;
+  }
+  if (url.href !== entityId && url.href !== `${entityId}/`) {
+    return `${value} must be written as the URL it stands for: ${url.href}`;
+  }
+  if (url.username || url.password) {
+    return `${value} must not contain credentials`;
+  }
+  return void 0;
+}
 var presentationConfigV1ToV2 = {
   id: "presentation-config-v2-provides-attestations",
   kind: "PresentationConfig",
@@ -15177,6 +15323,32 @@ var presentationConfigV1ToV2 = {
     };
   }
 };
+var tenantConfigV3ToV4 = {
+  id: "tenant-v4-key-chain-defaults",
+  kind: "Tenant",
+  from: 3,
+  to: 4,
+  // v4 moves the tenant's default key chains to their own resource,
+  // KeyChainDefaults (key-chain-defaults.json). Only development builds of
+  // 10.0 wrote defaultKeyChains, so the step drops it with a warning instead
+  // of creating that document.
+  migrate(spec) {
+    if (!("defaultKeyChains" in spec))
+      return { spec };
+    const { defaultKeyChains: _, ...rest } = spec;
+    return {
+      spec: rest,
+      issues: [
+        {
+          severity: "warning",
+          code: "DEFAULT_KEY_CHAINS_MOVED",
+          path: "/spec/defaultKeyChains",
+          message: 'defaultKeyChains is no longer part of the tenant settings and was removed. Set the default key chains in key-chain-defaults.json (KeyChainDefaults), for example { "access": "<key chain ID>" }.'
+        }
+      ]
+    };
+  }
+};
 var CONFIG_MIGRATIONS = [
   {
     id: "issuance-config-v2-offer-lifetime",
@@ -15206,6 +15378,7 @@ var CONFIG_MIGRATIONS = [
     // a valid v4 spec.
     migrate: (spec) => ({ spec })
   },
+  issuanceConfigV4ToV5,
   {
     id: "client-v2-read-and-status-roles",
     kind: "Client",
@@ -15235,6 +15408,36 @@ var CONFIG_MIGRATIONS = [
     // as before.
     migrate: (spec) => ({ spec })
   },
+  {
+    id: "tenant-v2-default-access-key-chain",
+    kind: "Tenant",
+    from: 1,
+    to: 2,
+    // v2 only adds the optional defaultAccessKeyChainId: a v1 spec is a
+    // valid v2 spec, whose tenant keeps picking its access key chain by
+    // rule.
+    migrate: (spec) => ({ spec })
+  },
+  {
+    id: "tenant-v3-default-key-chains",
+    kind: "Tenant",
+    from: 2,
+    to: 3,
+    // v3 keeps the tenant's default key chains in a map by usage type:
+    // defaultAccessKeyChainId becomes defaultKeyChains.access.
+    migrate: (spec) => {
+      const { defaultAccessKeyChainId, ...rest } = spec;
+      return {
+        spec: typeof defaultAccessKeyChainId === "string" ? {
+          ...rest,
+          defaultKeyChains: {
+            access: defaultAccessKeyChainId
+          }
+        } : rest
+      };
+    }
+  },
+  tenantConfigV3ToV4,
   {
     id: "key-chain-v2-type",
     kind: "KeyChain",
@@ -15244,6 +15447,15 @@ var CONFIG_MIGRATIONS = [
     // spec, imported as before.
     migrate: (spec) => ({ spec })
   },
+  {
+    id: "key-chain-v3-federation-usage",
+    kind: "KeyChain",
+    from: 2,
+    to: 3,
+    // v3 only adds the usage type `federation`: a v2 spec is a valid v3
+    // spec.
+    migrate: (spec) => ({ spec })
+  },
   {
     id: "credential-config-v2-x509-trusted-authority",
     kind: "CredentialConfig",
@@ -16806,6 +17018,143 @@ var CONFIG_SCHEMAS = [
       }
     }
   },
+  {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://eudiplo.dev/schemas/v1/FederationTrustAnchorConfigFile.schema.json",
+    "title": "FederationTrustAnchorConfigFile",
+    "type": "object",
+    "properties": {
+      "$schema": {
+        "type": "string",
+        "const": "https://eudiplo.dev/schemas/v1/FederationTrustAnchorConfigFile.schema.json"
+      },
+      "metadata": {
+        "type": "object",
+        "properties": {
+          "generation": {
+            "type": "integer",
+            "minimum": 1,
+            "description": "Monotonically increasing configuration generation."
+          },
+          "ownership": {
+            "type": "string",
+            "enum": [
+              "unmanaged",
+              "file-managed"
+            ],
+            "description": "Requested ownership recorded when the document is applied."
+          }
+        },
+        "additionalProperties": false
+      },
+      "spec": {
+        "allOf": [
+          {
+            "$ref": "#/$defs/CreateFederationTrustAnchorDto"
+          },
+          {
+            "type": "object",
+            "required": [
+              "id"
+            ],
+            "properties": {
+              "id": {
+                "type": "string",
+                "minLength": 1
+              }
+            }
+          }
+        ]
+      }
+    },
+    "required": [
+      "$schema",
+      "spec"
+    ],
+    "additionalProperties": false,
+    "$defs": {
+      "CreateFederationTrustAnchorDto": {
+        "type": "object",
+        "properties": {
+          "id": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 255,
+            "pattern": "^[A-Za-z0-9._-]+$",
+            "description": "Unique identifier of the trust anchor in the tenant."
+          },
+          "entityId": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 2048,
+            "description": "Entity identifier of the trust anchor, exactly as configured in `federation.trustAnchors` and DCQL `openid_federation` values."
+          },
+          "description": {
+            "anyOf": [
+              {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 1e3
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "Optional description of the trust anchor."
+          },
+          "jwks": {
+            "type": "object",
+            "properties": {
+              "keys": {
+                "minItems": 1,
+                "maxItems": 20,
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "kty": {
+                      "type": "string",
+                      "enum": [
+                        "EC",
+                        "RSA",
+                        "OKP"
+                      ],
+                      "description": "Key type of the public federation key."
+                    },
+                    "kid": {
+                      "type": "string",
+                      "minLength": 1,
+                      "maxLength": 256,
+                      "description": "Key ID. Federation statements name their signing key with `kid`."
+                    }
+                  },
+                  "required": [
+                    "kty",
+                    "kid"
+                  ],
+                  "additionalProperties": {},
+                  "description": "Public federation key of the trust anchor as a JWK."
+                },
+                "description": "The trust anchor's federation keys."
+              }
+            },
+            "required": [
+              "keys"
+            ],
+            "additionalProperties": false,
+            "description": "JWK set with the federation keys of the trust anchor, obtained out of band (OpenID Federation 1.0 Section 10.2)."
+          }
+        },
+        "required": [
+          "id",
+          "entityId",
+          "jwks"
+        ],
+        "additionalProperties": false,
+        "title": "CreateFederationTrustAnchorDto"
+      }
+    }
+  },
   {
     "$schema": "https://json-schema.org/draft/2020-12/schema",
     "$id": "https://eudiplo.dev/schemas/v1/IssuanceConfigFile.schema.json",
@@ -17827,6 +18176,54 @@ var CONFIG_SCHEMAS = [
     ],
     "additionalProperties": false
   },
+  {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://eudiplo.dev/schemas/v1/KeyChainDefaultsConfigFile.schema.json",
+    "title": "KeyChainDefaultsConfigFile",
+    "type": "object",
+    "properties": {
+      "$schema": {
+        "type": "string",
+        "const": "https://eudiplo.dev/schemas/v1/KeyChainDefaultsConfigFile.schema.json"
+      },
+      "metadata": {
+        "type": "object",
+        "properties": {
+          "generation": {
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 9007199254740991
+          },
+          "ownership": {
+            "type": "string",
+            "enum": [
+              "unmanaged",
+              "file-managed"
+            ]
+          }
+        },
+        "additionalProperties": false
+      },
+      "spec": {
+        "type": "object",
+        "properties": {
+          "access": {
+            "description": "ID of the access key chain used where no configuration names one: presentation requests of configurations without accessKeyChainId and the signed issuer metadata. Without it, EUDIPLO picks one of the tenant's access key chains by rule.",
+            "type": "string",
+            "minLength": 1
+          }
+        },
+        "additionalProperties": false,
+        "description": "The tenant's key chain per usage type, used where no configuration names one. A usage type without an entry uses a key chain picked by rule."
+      }
+    },
+    "required": [
+      "$schema",
+      "metadata",
+      "spec"
+    ],
+    "additionalProperties": false
+  },
   {
     "$schema": "https://json-schema.org/draft/2020-12/schema",
     "$id": "https://eudiplo.dev/schemas/v1/KmsConfigFile.schema.json",
@@ -24368,13 +24765,13 @@ var CONFIG_SCHEMAS = [
   },
   {
     "$schema": "https://json-schema.org/draft/2020-12/schema",
-    "$id": "https://eudiplo.dev/schemas/v3/IssuanceConfigFile.schema.json",
-    "title": "IssuanceConfigFile",
+    "$id": "https://eudiplo.dev/schemas/v2/TenantConfigFile.schema.json",
+    "title": "TenantConfigFile",
     "type": "object",
     "properties": {
       "$schema": {
         "type": "string",
-        "const": "https://eudiplo.dev/schemas/v3/IssuanceConfigFile.schema.json"
+        "const": "https://eudiplo.dev/schemas/v2/TenantConfigFile.schema.json"
       },
       "metadata": {
         "type": "object",
@@ -24382,37 +24779,168 @@ var CONFIG_SCHEMAS = [
           "generation": {
             "type": "integer",
             "minimum": 1,
-            "description": "Monotonically increasing configuration generation."
+            "maximum": 9007199254740991
           },
           "ownership": {
             "type": "string",
             "enum": [
               "unmanaged",
               "file-managed"
-            ],
-            "description": "Requested ownership recorded when the document is applied."
+            ]
           }
         },
         "additionalProperties": false
       },
       "spec": {
-        "$ref": "#/$defs/IssuanceConfig"
-      }
-    },
-    "required": [
-      "$schema",
-      "spec"
-    ],
-    "additionalProperties": false,
-    "$defs": {
-      "IssuanceConfig": {
         "type": "object",
         "properties": {
-          "batchSize": {
-            "description": "Optional issuance batch size.",
-            "type": "integer",
-            "minimum": 1,
-            "maximum": 9007199254740991
+          "name": {
+            "default": "EUDIPLO",
+            "description": "Display name of the tenant.",
+            "type": "string",
+            "minLength": 1
+          },
+          "description": {
+            "description": "Optional tenant description.",
+            "type": "string",
+            "minLength": 1
+          },
+          "sessionConfig": {
+            "description": "Optional tenant-specific session storage configuration.",
+            "type": "object",
+            "properties": {
+              "ttlSeconds": {
+                "description": "Session time-to-live in seconds.",
+                "type": "integer",
+                "minimum": 60,
+                "maximum": 9007199254740991
+              },
+              "cleanupMode": {
+                "description": "Whether to fully delete or anonymize expired sessions.",
+                "type": "string",
+                "enum": [
+                  "full",
+                  "anonymize"
+                ]
+              }
+            },
+            "additionalProperties": false
+          },
+          "statusListConfig": {
+            "description": "Optional tenant-specific status list defaults.",
+            "type": "object",
+            "properties": {
+              "capacity": {
+                "description": "Default status list capacity.",
+                "type": "integer",
+                "minimum": 100,
+                "maximum": 9007199254740991
+              },
+              "bits": {
+                "description": "Bits-per-status setting (1, 2, 4, or 8).",
+                "anyOf": [
+                  {
+                    "type": "number",
+                    "const": 1
+                  },
+                  {
+                    "type": "number",
+                    "const": 2
+                  },
+                  {
+                    "type": "number",
+                    "const": 4
+                  },
+                  {
+                    "type": "number",
+                    "const": 8
+                  }
+                ]
+              },
+              "ttl": {
+                "description": "JWT TTL for status list tokens in seconds.",
+                "type": "integer",
+                "minimum": 60,
+                "maximum": 9007199254740991
+              },
+              "immediateUpdate": {
+                "description": "Regenerate status list JWTs immediately after status updates.",
+                "type": "boolean"
+              },
+              "enableAggregation": {
+                "description": "Include aggregation_uri in generated status list JWTs.",
+                "type": "boolean"
+              }
+            },
+            "additionalProperties": false
+          },
+          "defaultAccessKeyChainId": {
+            "description": "ID of the access key chain used where no configuration names one: presentation requests of configurations without accessKeyChainId and the signed issuer metadata. Without it, EUDIPLO picks one of the tenant's access key chains by rule.",
+            "type": "string",
+            "minLength": 1
+          }
+        },
+        "required": [
+          "name"
+        ],
+        "additionalProperties": false,
+        "description": "Payload used when importing tenant metadata from config files."
+      }
+    },
+    "required": [
+      "$schema",
+      "metadata",
+      "spec"
+    ],
+    "additionalProperties": false
+  },
+  {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://eudiplo.dev/schemas/v3/IssuanceConfigFile.schema.json",
+    "title": "IssuanceConfigFile",
+    "type": "object",
+    "properties": {
+      "$schema": {
+        "type": "string",
+        "const": "https://eudiplo.dev/schemas/v3/IssuanceConfigFile.schema.json"
+      },
+      "metadata": {
+        "type": "object",
+        "properties": {
+          "generation": {
+            "type": "integer",
+            "minimum": 1,
+            "description": "Monotonically increasing configuration generation."
+          },
+          "ownership": {
+            "type": "string",
+            "enum": [
+              "unmanaged",
+              "file-managed"
+            ],
+            "description": "Requested ownership recorded when the document is applied."
+          }
+        },
+        "additionalProperties": false
+      },
+      "spec": {
+        "$ref": "#/$defs/IssuanceConfig"
+      }
+    },
+    "required": [
+      "$schema",
+      "spec"
+    ],
+    "additionalProperties": false,
+    "$defs": {
+      "IssuanceConfig": {
+        "type": "object",
+        "properties": {
+          "batchSize": {
+            "description": "Optional issuance batch size.",
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 9007199254740991
           },
           "dPopRequired": {
             "description": "Require DPoP proofs for issuance endpoints.",
@@ -25063,13 +25591,13 @@ var CONFIG_SCHEMAS = [
   },
   {
     "$schema": "https://json-schema.org/draft/2020-12/schema",
-    "$id": "https://eudiplo.dev/schemas/v3/PresentationConfigFile.schema.json",
-    "title": "PresentationConfigFile",
+    "$id": "https://eudiplo.dev/schemas/v3/KeyChainConfigFile.schema.json",
+    "title": "KeyChainConfigFile",
     "type": "object",
     "properties": {
       "$schema": {
         "type": "string",
-        "const": "https://eudiplo.dev/schemas/v3/PresentationConfigFile.schema.json"
+        "const": "https://eudiplo.dev/schemas/v3/KeyChainConfigFile.schema.json"
       },
       "metadata": {
         "type": "object",
@@ -25077,118 +25605,670 @@ var CONFIG_SCHEMAS = [
           "generation": {
             "type": "integer",
             "minimum": 1,
-            "description": "Monotonically increasing configuration generation."
+            "maximum": 9007199254740991
           },
           "ownership": {
             "type": "string",
             "enum": [
               "unmanaged",
               "file-managed"
-            ],
-            "description": "Requested ownership recorded when the document is applied."
+            ]
           }
         },
         "additionalProperties": false
       },
       "spec": {
-        "allOf": [
-          {
-            "$ref": "#/$defs/PresentationConfigCreateDto"
-          },
-          {
-            "type": "object",
-            "required": [
-              "id"
-            ],
-            "properties": {
-              "id": {
-                "type": "string",
-                "minLength": 1
-              }
-            }
-          }
-        ]
-      }
-    },
-    "required": [
-      "$schema",
-      "spec"
-    ],
-    "additionalProperties": false,
-    "$defs": {
-      "PresentationConfigCreateDto": {
         "type": "object",
         "properties": {
           "id": {
-            "type": "string",
-            "minLength": 1,
-            "description": "Presentation configuration identifier."
+            "type": "string"
           },
           "description": {
-            "description": "Optional presentation configuration description.",
-            "type": [
-              "string",
-              "null"
-            ]
-          },
-          "lifeTime": {
-            "description": "Presentation request lifetime in seconds.",
-            "type": "integer",
-            "minimum": 1,
-            "maximum": 9007199254740991
+            "type": "string"
           },
-          "skewSeconds": {
-            "description": "Clock skew tolerance in seconds.",
-            "type": "integer",
-            "minimum": 0,
-            "maximum": 9007199254740991
+          "usageType": {
+            "type": "string",
+            "enum": [
+              "access",
+              "attestation",
+              "trustList",
+              "statusList",
+              "federation",
+              "encrypt"
+            ]
           },
-          "statusCheckMode": {
-            "description": "Revocation/status check mode.",
+          "type": {
+            "description": "Key chain type. For a `private-jwk` key source without `activeJwk`, `standalone` makes `jwk` the signing key and `crt` its chain, leaf first; `internalChain` makes `jwk` a CA key and the last `crt` entry its CA certificate (created if `crt` is omitted), and the import generates a new signing key with a certificate issued by it. Without `type`, `jwk` is a CA key only if `rotationPolicy.enabled` is true and `crt` is not a single self-signed certificate that is not a CA. For `regenerate`, it is the type of the new key chain and must equal `keySource.keyChainType` if both are set. For the other key sources, it must match the key chain they describe.",
             "type": "string",
             "enum": [
-              "strict",
-              "best_effort",
-              "disabled"
+              "standalone",
+              "internalChain"
             ]
           },
-          "dcql_query": {
-            "type": "object",
-            "properties": {
-              "credentials": {
-                "minItems": 1,
-                "type": "array",
-                "items": {
-                  "oneOf": [
-                    {
-                      "type": "object",
-                      "properties": {
-                        "id": {
-                          "type": "string",
-                          "minLength": 1,
-                          "pattern": "^[A-Za-z0-9_-]+$",
-                          "description": "Credential query identifier."
-                        },
-                        "multiple": {
-                          "description": "Allow multiple matching credentials.",
-                          "type": "boolean"
-                        },
-                        "claim_sets": {
-                          "description": "Optional claim set constraints.",
-                          "type": "array",
-                          "items": {
-                            "type": "array",
-                            "items": {
-                              "type": "string"
-                            }
-                          }
-                        },
-                        "trusted_authorities": {
-                          "description": "Optional trusted authority constraints.",
-                          "type": "array",
-                          "items": {
-                            "oneOf": [
-                              {
+          "keySource": {
+            "oneOf": [
+              {
+                "type": "object",
+                "properties": {
+                  "type": {
+                    "type": "string",
+                    "const": "private-jwk"
+                  },
+                  "jwk": {
+                    "type": "object",
+                    "properties": {
+                      "kty": {
+                        "type": "string",
+                        "description": "Key type (for example EC)."
+                      },
+                      "x": {
+                        "type": "string",
+                        "description": "Elliptic curve public x coordinate."
+                      },
+                      "y": {
+                        "type": "string",
+                        "description": "Elliptic curve public y coordinate."
+                      },
+                      "crv": {
+                        "type": "string",
+                        "description": "Elliptic curve name."
+                      },
+                      "d": {
+                        "type": "string",
+                        "description": "Private key value."
+                      },
+                      "alg": {
+                        "description": "Optional algorithm hint.",
+                        "type": "string"
+                      },
+                      "kid": {
+                        "description": "Optional key identifier.",
+                        "type": "string"
+                      }
+                    },
+                    "required": [
+                      "kty",
+                      "x",
+                      "y",
+                      "crv",
+                      "d"
+                    ],
+                    "additionalProperties": false
+                  },
+                  "activeJwk": {
+                    "type": "object",
+                    "properties": {
+                      "kty": {
+                        "type": "string",
+                        "description": "Key type (for example EC)."
+                      },
+                      "x": {
+                        "type": "string",
+                        "description": "Elliptic curve public x coordinate."
+                      },
+                      "y": {
+                        "type": "string",
+                        "description": "Elliptic curve public y coordinate."
+                      },
+                      "crv": {
+                        "type": "string",
+                        "description": "Elliptic curve name."
+                      },
+                      "d": {
+                        "type": "string",
+                        "description": "Private key value."
+                      },
+                      "alg": {
+                        "description": "Optional algorithm hint.",
+                        "type": "string"
+                      },
+                      "kid": {
+                        "description": "Optional key identifier.",
+                        "type": "string"
+                      }
+                    },
+                    "required": [
+                      "kty",
+                      "x",
+                      "y",
+                      "crv",
+                      "d"
+                    ],
+                    "additionalProperties": false
+                  }
+                },
+                "required": [
+                  "type",
+                  "jwk"
+                ],
+                "additionalProperties": false
+              },
+              {
+                "type": "object",
+                "properties": {
+                  "type": {
+                    "type": "string",
+                    "const": "external-reference"
+                  },
+                  "provider": {
+                    "type": "string"
+                  },
+                  "externalKeyId": {
+                    "type": "string"
+                  },
+                  "publicJwk": {
+                    "type": "object",
+                    "properties": {
+                      "kty": {
+                        "type": "string"
+                      },
+                      "x": {
+                        "type": "string"
+                      },
+                      "y": {
+                        "type": "string"
+                      },
+                      "crv": {
+                        "type": "string"
+                      },
+                      "alg": {
+                        "type": "string"
+                      },
+                      "kid": {
+                        "type": "string"
+                      }
+                    },
+                    "required": [
+                      "kty",
+                      "x",
+                      "y",
+                      "crv"
+                    ],
+                    "additionalProperties": false
+                  },
+                  "activeExternalKeyId": {
+                    "type": "string"
+                  },
+                  "activePublicJwk": {
+                    "type": "object",
+                    "properties": {
+                      "kty": {
+                        "type": "string"
+                      },
+                      "x": {
+                        "type": "string"
+                      },
+                      "y": {
+                        "type": "string"
+                      },
+                      "crv": {
+                        "type": "string"
+                      },
+                      "alg": {
+                        "type": "string"
+                      },
+                      "kid": {
+                        "type": "string"
+                      }
+                    },
+                    "required": [
+                      "kty",
+                      "x",
+                      "y",
+                      "crv"
+                    ],
+                    "additionalProperties": false
+                  }
+                },
+                "required": [
+                  "type",
+                  "provider",
+                  "externalKeyId",
+                  "publicJwk"
+                ],
+                "additionalProperties": false
+              },
+              {
+                "type": "object",
+                "properties": {
+                  "type": {
+                    "type": "string",
+                    "const": "required"
+                  },
+                  "publicJwk": {
+                    "type": "object",
+                    "properties": {
+                      "kty": {
+                        "type": "string"
+                      },
+                      "x": {
+                        "type": "string"
+                      },
+                      "y": {
+                        "type": "string"
+                      },
+                      "crv": {
+                        "type": "string"
+                      },
+                      "alg": {
+                        "type": "string"
+                      },
+                      "kid": {
+                        "type": "string"
+                      }
+                    },
+                    "required": [
+                      "kty",
+                      "x",
+                      "y",
+                      "crv"
+                    ],
+                    "additionalProperties": false
+                  }
+                },
+                "required": [
+                  "type"
+                ],
+                "additionalProperties": false
+              },
+              {
+                "type": "object",
+                "properties": {
+                  "type": {
+                    "type": "string",
+                    "const": "regenerate"
+                  },
+                  "keyChainType": {
+                    "type": "string",
+                    "enum": [
+                      "standalone",
+                      "internalChain"
+                    ]
+                  }
+                },
+                "required": [
+                  "type"
+                ],
+                "additionalProperties": false
+              }
+            ]
+          },
+          "crt": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "activeCertificate": {
+            "description": "Active certificate for an internal key chain.",
+            "type": "string"
+          },
+          "kmsProvider": {
+            "type": "string"
+          },
+          "rotationPolicy": {
+            "type": "object",
+            "properties": {
+              "enabled": {
+                "type": "boolean"
+              },
+              "intervalDays": {
+                "anyOf": [
+                  {
+                    "type": "number",
+                    "minimum": 1,
+                    "maximum": 3650
+                  },
+                  {
+                    "type": "null"
+                  }
+                ]
+              },
+              "certValidityDays": {
+                "anyOf": [
+                  {
+                    "type": "number",
+                    "minimum": 1,
+                    "maximum": 3650
+                  },
+                  {
+                    "type": "null"
+                  }
+                ]
+              }
+            },
+            "required": [
+              "enabled"
+            ],
+            "additionalProperties": false
+          }
+        },
+        "required": [
+          "usageType",
+          "keySource"
+        ],
+        "additionalProperties": false
+      }
+    },
+    "required": [
+      "$schema",
+      "metadata",
+      "spec"
+    ],
+    "additionalProperties": false
+  },
+  {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://eudiplo.dev/schemas/v3/PresentationConfigFile.schema.json",
+    "title": "PresentationConfigFile",
+    "type": "object",
+    "properties": {
+      "$schema": {
+        "type": "string",
+        "const": "https://eudiplo.dev/schemas/v3/PresentationConfigFile.schema.json"
+      },
+      "metadata": {
+        "type": "object",
+        "properties": {
+          "generation": {
+            "type": "integer",
+            "minimum": 1,
+            "description": "Monotonically increasing configuration generation."
+          },
+          "ownership": {
+            "type": "string",
+            "enum": [
+              "unmanaged",
+              "file-managed"
+            ],
+            "description": "Requested ownership recorded when the document is applied."
+          }
+        },
+        "additionalProperties": false
+      },
+      "spec": {
+        "allOf": [
+          {
+            "$ref": "#/$defs/PresentationConfigCreateDto"
+          },
+          {
+            "type": "object",
+            "required": [
+              "id"
+            ],
+            "properties": {
+              "id": {
+                "type": "string",
+                "minLength": 1
+              }
+            }
+          }
+        ]
+      }
+    },
+    "required": [
+      "$schema",
+      "spec"
+    ],
+    "additionalProperties": false,
+    "$defs": {
+      "PresentationConfigCreateDto": {
+        "type": "object",
+        "properties": {
+          "id": {
+            "type": "string",
+            "minLength": 1,
+            "description": "Presentation configuration identifier."
+          },
+          "description": {
+            "description": "Optional presentation configuration description.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "lifeTime": {
+            "description": "Presentation request lifetime in seconds.",
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 9007199254740991
+          },
+          "skewSeconds": {
+            "description": "Clock skew tolerance in seconds.",
+            "type": "integer",
+            "minimum": 0,
+            "maximum": 9007199254740991
+          },
+          "statusCheckMode": {
+            "description": "Revocation/status check mode.",
+            "type": "string",
+            "enum": [
+              "strict",
+              "best_effort",
+              "disabled"
+            ]
+          },
+          "dcql_query": {
+            "type": "object",
+            "properties": {
+              "credentials": {
+                "minItems": 1,
+                "type": "array",
+                "items": {
+                  "oneOf": [
+                    {
+                      "type": "object",
+                      "properties": {
+                        "id": {
+                          "type": "string",
+                          "minLength": 1,
+                          "pattern": "^[A-Za-z0-9_-]+$",
+                          "description": "Credential query identifier."
+                        },
+                        "multiple": {
+                          "description": "Allow multiple matching credentials.",
+                          "type": "boolean"
+                        },
+                        "claim_sets": {
+                          "description": "Optional claim set constraints.",
+                          "type": "array",
+                          "items": {
+                            "type": "array",
+                            "items": {
+                              "type": "string"
+                            }
+                          }
+                        },
+                        "trusted_authorities": {
+                          "description": "Optional trusted authority constraints.",
+                          "type": "array",
+                          "items": {
+                            "oneOf": [
+                              {
+                                "type": "object",
+                                "properties": {
+                                  "type": {
+                                    "type": "string",
+                                    "const": "etsi_tl",
+                                    "description": "Trusted authority type discriminator for ETSI trust lists."
+                                  },
+                                  "values": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "object",
+                                      "properties": {
+                                        "trustListId": {
+                                          "description": "Optional trust list id reference.",
+                                          "type": "string"
+                                        },
+                                        "url": {
+                                          "description": "Optional trust list URL reference.",
+                                          "anyOf": [
+                                            {
+                                              "type": "string",
+                                              "format": "uri"
+                                            },
+                                            {
+                                              "type": "string",
+                                              "pattern": "^<TENANT_URL>(?:\\/.*)?$"
+                                            }
+                                          ]
+                                        },
+                                        "verifierKey": {
+                                          "description": "Optional verifier key material.",
+                                          "type": "object",
+                                          "propertyNames": {
+                                            "type": "string"
+                                          },
+                                          "additionalProperties": {}
+                                        },
+                                        "verifierX509Der": {
+                                          "description": "Optional verifier certificate in DER/base64 form.",
+                                          "type": "string"
+                                        }
+                                      },
+                                      "additionalProperties": false
+                                    },
+                                    "description": "Trust list references for ETSI TL verification."
+                                  }
+                                },
+                                "required": [
+                                  "type",
+                                  "values"
+                                ],
+                                "additionalProperties": false
+                              },
+                              {
+                                "type": "object",
+                                "properties": {
+                                  "type": {
+                                    "type": "string",
+                                    "const": "openid_federation",
+                                    "description": "Trusted authority type discriminator for OpenID Federation."
+                                  },
+                                  "values": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "string"
+                                    },
+                                    "description": "OpenID Federation authority identifiers."
+                                  }
+                                },
+                                "required": [
+                                  "type",
+                                  "values"
+                                ],
+                                "additionalProperties": false
+                              }
+                            ]
+                          }
+                        },
+                        "format": {
+                          "type": "string",
+                          "const": "dc+sd-jwt",
+                          "description": "Credential format discriminator."
+                        },
+                        "meta": {
+                          "type": "object",
+                          "properties": {
+                            "vct_values": {
+                              "minItems": 1,
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "description": "Accepted VCT values."
+                            }
+                          },
+                          "required": [
+                            "vct_values"
+                          ],
+                          "additionalProperties": false
+                        },
+                        "claims": {
+                          "description": "Optional claim-level constraints.",
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "id": {
+                                "description": "Optional claim query id.",
+                                "type": "string"
+                              },
+                              "path": {
+                                "type": "array",
+                                "items": {
+                                  "type": [
+                                    "string",
+                                    "number"
+                                  ]
+                                },
+                                "description": "Path to the claim value in presented credentials."
+                              },
+                              "values": {
+                                "description": "Optional allowed values for the claim. A disclosed value must equal one of them in type and value.",
+                                "minItems": 1,
+                                "type": "array",
+                                "items": {
+                                  "anyOf": [
+                                    {
+                                      "type": "string"
+                                    },
+                                    {
+                                      "type": "integer",
+                                      "minimum": -9007199254740991,
+                                      "maximum": 9007199254740991
+                                    },
+                                    {
+                                      "type": "boolean"
+                                    }
+                                  ]
+                                }
+                              }
+                            },
+                            "required": [
+                              "path"
+                            ],
+                            "additionalProperties": false
+                          }
+                        }
+                      },
+                      "required": [
+                        "id",
+                        "format",
+                        "meta"
+                      ],
+                      "additionalProperties": false
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "id": {
+                          "type": "string",
+                          "minLength": 1,
+                          "pattern": "^[A-Za-z0-9_-]+$",
+                          "description": "Credential query identifier."
+                        },
+                        "multiple": {
+                          "description": "Allow multiple matching credentials.",
+                          "type": "boolean"
+                        },
+                        "claim_sets": {
+                          "description": "Optional claim set constraints.",
+                          "type": "array",
+                          "items": {
+                            "type": "array",
+                            "items": {
+                              "type": "string"
+                            }
+                          }
+                        },
+                        "trusted_authorities": {
+                          "description": "Optional trusted authority constraints.",
+                          "type": "array",
+                          "items": {
+                            "oneOf": [
+                              {
                                 "type": "object",
                                 "properties": {
                                   "type": {
@@ -25269,402 +26349,1141 @@ var CONFIG_SCHEMAS = [
                         },
                         "format": {
                           "type": "string",
-                          "const": "dc+sd-jwt",
-                          "description": "Credential format discriminator."
-                        },
-                        "meta": {
-                          "type": "object",
-                          "properties": {
-                            "vct_values": {
-                              "minItems": 1,
-                              "type": "array",
-                              "items": {
-                                "type": "string"
-                              },
-                              "description": "Accepted VCT values."
-                            }
-                          },
-                          "required": [
-                            "vct_values"
-                          ],
-                          "additionalProperties": false
+                          "const": "mso_mdoc",
+                          "description": "Credential format discriminator."
+                        },
+                        "meta": {
+                          "type": "object",
+                          "properties": {
+                            "doctype_value": {
+                              "type": "string",
+                              "minLength": 1,
+                              "description": "Expected mDoc doctype value."
+                            }
+                          },
+                          "required": [
+                            "doctype_value"
+                          ],
+                          "additionalProperties": false
+                        },
+                        "claims": {
+                          "description": "Optional mDoc claim-level constraints.",
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "id": {
+                                "description": "Optional claim query id.",
+                                "type": "string"
+                              },
+                              "path": {
+                                "type": "array",
+                                "items": {
+                                  "type": [
+                                    "string",
+                                    "number"
+                                  ]
+                                },
+                                "description": "Path to the claim value in presented credentials."
+                              },
+                              "values": {
+                                "description": "Optional allowed values for the claim. A disclosed value must equal one of them in type and value.",
+                                "minItems": 1,
+                                "type": "array",
+                                "items": {
+                                  "anyOf": [
+                                    {
+                                      "type": "string"
+                                    },
+                                    {
+                                      "type": "integer",
+                                      "minimum": -9007199254740991,
+                                      "maximum": 9007199254740991
+                                    },
+                                    {
+                                      "type": "boolean"
+                                    }
+                                  ]
+                                }
+                              },
+                              "intent_to_retain": {
+                                "description": "Whether relying party intends to retain the claim.",
+                                "type": "boolean"
+                              }
+                            },
+                            "required": [
+                              "path"
+                            ],
+                            "additionalProperties": false
+                          }
+                        }
+                      },
+                      "required": [
+                        "id",
+                        "format",
+                        "meta"
+                      ],
+                      "additionalProperties": false
+                    }
+                  ]
+                },
+                "description": "Credential queries requested by the verifier."
+              },
+              "credential_sets": {
+                "description": "Optional higher-level credential set requirements.",
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "options": {
+                      "minItems": 1,
+                      "type": "array",
+                      "items": {
+                        "minItems": 1,
+                        "type": "array",
+                        "items": {
+                          "type": "string"
+                        }
+                      },
+                      "description": "Alternative credential query id combinations."
+                    },
+                    "required": {
+                      "description": "Whether this credential set is mandatory.",
+                      "type": "boolean"
+                    }
+                  },
+                  "required": [
+                    "options"
+                  ],
+                  "additionalProperties": false
+                }
+              }
+            },
+            "required": [
+              "credentials"
+            ],
+            "additionalProperties": false,
+            "description": "DCQL query defining requested credentials and claims."
+          },
+          "transaction_data": {
+            "description": "Optional transaction data descriptors.",
+            "anyOf": [
+              {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "type": {
+                      "type": "string",
+                      "description": "Transaction data type identifier."
+                    },
+                    "credential_ids": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "description": "Credential query ids this transaction data applies to."
+                    },
+                    "payload": {
+                      "description": "Transaction details. Required for TS12 SCA transaction data."
+                    }
+                  },
+                  "required": [
+                    "type",
+                    "credential_ids"
+                  ],
+                  "additionalProperties": {}
+                }
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "registration_cert": {
+            "description": "Optional registration certificate request settings.",
+            "anyOf": [
+              {
+                "type": "object",
+                "properties": {
+                  "id": {
+                    "type": "string"
+                  },
+                  "body": {
+                    "type": "object",
+                    "properties": {
+                      "privacy_policy": {
+                        "type": "string"
+                      },
+                      "support_uri": {
+                        "type": "string"
+                      },
+                      "intermediary": {
+                        "type": "string"
+                      },
+                      "purpose": {
+                        "type": "array",
+                        "items": {
+                          "type": "object",
+                          "properties": {
+                            "lang": {
+                              "type": "string"
+                            },
+                            "content": {
+                              "type": "string"
+                            }
+                          },
+                          "required": [
+                            "lang",
+                            "content"
+                          ],
+                          "additionalProperties": false
+                        }
+                      },
+                      "credentials": {
+                        "type": "array",
+                        "items": {
+                          "type": "object",
+                          "propertyNames": {
+                            "type": "string"
+                          },
+                          "additionalProperties": {}
+                        }
+                      },
+                      "provides_attestations": {
+                        "type": "array",
+                        "items": {
+                          "type": "string",
+                          "minLength": 1
+                        }
+                      }
+                    },
+                    "additionalProperties": false
+                  },
+                  "jwt": {
+                    "type": "string"
+                  }
+                },
+                "additionalProperties": false
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "registrationCertImportJwt": {
+            "description": "Optional imported registration certificate JWT.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "registrationCertImportId": {
+            "description": "Optional registrar-side registration certificate id.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "registrationCertBodyPrivacyPolicy": {
+            "description": "Optional registration certificate privacy policy URI.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "registrationCertBodySupportUri": {
+            "description": "Optional registration certificate support URI.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "registrationCertBodyIntermediary": {
+            "description": "Optional registration certificate intermediary.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "registrationCertBodyPurpose": {
+            "description": "Optional registration certificate purpose entries.",
+            "anyOf": [
+              {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "lang": {
+                      "type": "string"
+                    },
+                    "content": {
+                      "type": "string"
+                    }
+                  },
+                  "additionalProperties": false
+                }
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "webhookEndpointId": {
+            "description": "Optional webhook endpoint id for presentation callbacks.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "attached": {
+            "description": "Optional attachments included with presentation requests.",
+            "anyOf": [
+              {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "format": {
+                      "type": "string",
+                      "description": "Attachment format identifier."
+                    },
+                    "data": {
+                      "description": "Attachment payload."
+                    },
+                    "credential_ids": {
+                      "description": "Optional credential query ids bound to this attachment.",
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      }
+                    }
+                  },
+                  "required": [
+                    "format",
+                    "data"
+                  ],
+                  "additionalProperties": false
+                }
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "redirectUri": {
+            "description": "Optional redirect URI after presentation completion.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "accessKeyChainId": {
+            "description": "Optional key chain id for access token/auth operations.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "readerAuth": {
+            "description": "Whether reader authentication is required for mDoc requests.",
+            "type": [
+              "boolean",
+              "null"
+            ]
+          }
+        },
+        "required": [
+          "id",
+          "dcql_query"
+        ],
+        "additionalProperties": false,
+        "title": "PresentationConfigCreateDto"
+      }
+    }
+  },
+  {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://eudiplo.dev/schemas/v3/TenantConfigFile.schema.json",
+    "title": "TenantConfigFile",
+    "type": "object",
+    "properties": {
+      "$schema": {
+        "type": "string",
+        "const": "https://eudiplo.dev/schemas/v3/TenantConfigFile.schema.json"
+      },
+      "metadata": {
+        "type": "object",
+        "properties": {
+          "generation": {
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 9007199254740991
+          },
+          "ownership": {
+            "type": "string",
+            "enum": [
+              "unmanaged",
+              "file-managed"
+            ]
+          }
+        },
+        "additionalProperties": false
+      },
+      "spec": {
+        "type": "object",
+        "properties": {
+          "name": {
+            "default": "EUDIPLO",
+            "description": "Display name of the tenant.",
+            "type": "string",
+            "minLength": 1
+          },
+          "description": {
+            "description": "Optional tenant description.",
+            "type": "string",
+            "minLength": 1
+          },
+          "sessionConfig": {
+            "description": "Optional tenant-specific session storage configuration.",
+            "type": "object",
+            "properties": {
+              "ttlSeconds": {
+                "description": "Session time-to-live in seconds.",
+                "type": "integer",
+                "minimum": 60,
+                "maximum": 9007199254740991
+              },
+              "cleanupMode": {
+                "description": "Whether to fully delete or anonymize expired sessions.",
+                "type": "string",
+                "enum": [
+                  "full",
+                  "anonymize"
+                ]
+              }
+            },
+            "additionalProperties": false
+          },
+          "statusListConfig": {
+            "description": "Optional tenant-specific status list defaults.",
+            "type": "object",
+            "properties": {
+              "capacity": {
+                "description": "Default status list capacity.",
+                "type": "integer",
+                "minimum": 100,
+                "maximum": 9007199254740991
+              },
+              "bits": {
+                "description": "Bits-per-status setting (1, 2, 4, or 8).",
+                "anyOf": [
+                  {
+                    "type": "number",
+                    "const": 1
+                  },
+                  {
+                    "type": "number",
+                    "const": 2
+                  },
+                  {
+                    "type": "number",
+                    "const": 4
+                  },
+                  {
+                    "type": "number",
+                    "const": 8
+                  }
+                ]
+              },
+              "ttl": {
+                "description": "JWT TTL for status list tokens in seconds.",
+                "type": "integer",
+                "minimum": 60,
+                "maximum": 9007199254740991
+              },
+              "immediateUpdate": {
+                "description": "Regenerate status list JWTs immediately after status updates.",
+                "type": "boolean"
+              },
+              "enableAggregation": {
+                "description": "Include aggregation_uri in generated status list JWTs.",
+                "type": "boolean"
+              }
+            },
+            "additionalProperties": false
+          },
+          "defaultKeyChains": {
+            "type": "object",
+            "properties": {
+              "access": {
+                "description": "ID of the access key chain used where no configuration names one: presentation requests of configurations without accessKeyChainId and the signed issuer metadata. Without it, EUDIPLO picks one of the tenant's access key chains by rule.",
+                "type": "string",
+                "minLength": 1
+              }
+            },
+            "additionalProperties": false,
+            "description": "The tenant's key chain per usage type, used where no configuration names one. A usage type without an entry uses a key chain picked by rule."
+          }
+        },
+        "required": [
+          "name"
+        ],
+        "additionalProperties": false,
+        "description": "Payload used when importing tenant metadata from config files."
+      }
+    },
+    "required": [
+      "$schema",
+      "metadata",
+      "spec"
+    ],
+    "additionalProperties": false
+  },
+  {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://eudiplo.dev/schemas/v4/IssuanceConfigFile.schema.json",
+    "title": "IssuanceConfigFile",
+    "type": "object",
+    "properties": {
+      "$schema": {
+        "type": "string",
+        "const": "https://eudiplo.dev/schemas/v4/IssuanceConfigFile.schema.json"
+      },
+      "metadata": {
+        "type": "object",
+        "properties": {
+          "generation": {
+            "type": "integer",
+            "minimum": 1,
+            "description": "Monotonically increasing configuration generation."
+          },
+          "ownership": {
+            "type": "string",
+            "enum": [
+              "unmanaged",
+              "file-managed"
+            ],
+            "description": "Requested ownership recorded when the document is applied."
+          }
+        },
+        "additionalProperties": false
+      },
+      "spec": {
+        "$ref": "#/$defs/IssuanceConfig"
+      }
+    },
+    "required": [
+      "$schema",
+      "spec"
+    ],
+    "additionalProperties": false,
+    "$defs": {
+      "IssuanceConfig": {
+        "type": "object",
+        "properties": {
+          "batchSize": {
+            "description": "Optional issuance batch size.",
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 9007199254740991
+          },
+          "dPopRequired": {
+            "description": "Require DPoP proofs for issuance endpoints.",
+            "type": "boolean"
+          },
+          "walletAttestationRequired": {
+            "description": "Default wallet attestation requirement for managed authorization servers.",
+            "type": "boolean"
+          },
+          "walletProviderTrustLists": {
+            "description": "Shared wallet provider trust lists for key attestations and default authorization server wallet authentication.",
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": {
+                "trustListId": {
+                  "type": "string",
+                  "minLength": 1
+                },
+                "url": {
+                  "description": "URL of the wallet provider trust list.",
+                  "type": "string",
+                  "format": "uri"
+                },
+                "verifierKey": {
+                  "description": "Optional verifier key material used for trust list verification.",
+                  "type": "object",
+                  "propertyNames": {
+                    "type": "string"
+                  },
+                  "additionalProperties": {}
+                },
+                "verifierKeyPem": {
+                  "description": "Optional verifier public key in SPKI PEM form (-----BEGIN PUBLIC KEY-----).",
+                  "type": "string",
+                  "pattern": "^\\s*-----BEGIN PUBLIC KEY-----[A-Za-z0-9+/=\\s]+-----END PUBLIC KEY-----\\s*$"
+                },
+                "verifierX509Der": {
+                  "description": "Optional verifier certificate in DER/base64 form.",
+                  "type": "string"
+                }
+              },
+              "additionalProperties": false
+            }
+          },
+          "walletAttestationStatusCheckMode": {
+            "description": "Default status check mode for wallet attestations at managed authorization servers: strict, best_effort (default) or disabled.",
+            "anyOf": [
+              {
+                "type": "string",
+                "enum": [
+                  "strict",
+                  "best_effort",
+                  "disabled"
+                ]
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "signingKeyId": {
+            "description": "Default signing key chain id for credential issuance.",
+            "type": "string",
+            "minLength": 1
+          },
+          "authorizationServers": {
+            "minItems": 1,
+            "type": "array",
+            "items": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "type": {
+                      "type": "string",
+                      "const": "external",
+                      "description": "Use an externally managed authorization server."
+                    },
+                    "id": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Authorization server identifier."
+                    },
+                    "issuer": {
+                      "type": "string",
+                      "format": "uri",
+                      "description": "Issuer URL for the external authorization server."
+                    },
+                    "sessionBinding": {
+                      "description": "Explicit mapping from an external access-token claim to an existing issuance session.",
+                      "type": "object",
+                      "properties": {
+                        "method": {
+                          "type": "string",
+                          "const": "access_token_claim",
+                          "description": "Read the correlation value from a configured access-token claim."
                         },
-                        "claims": {
-                          "description": "Optional claim-level constraints.",
-                          "type": "array",
-                          "items": {
-                            "type": "object",
-                            "properties": {
-                              "id": {
-                                "description": "Optional claim query id.",
-                                "type": "string"
-                              },
-                              "path": {
-                                "type": "array",
-                                "items": {
-                                  "type": [
-                                    "string",
-                                    "number"
-                                  ]
-                                },
-                                "description": "Path to the claim value in presented credentials."
-                              },
-                              "values": {
-                                "description": "Optional allowed values for the claim. A disclosed value must equal one of them in type and value.",
-                                "minItems": 1,
-                                "type": "array",
-                                "items": {
-                                  "anyOf": [
-                                    {
-                                      "type": "string"
-                                    },
-                                    {
-                                      "type": "integer",
-                                      "minimum": -9007199254740991,
-                                      "maximum": 9007199254740991
-                                    },
-                                    {
-                                      "type": "boolean"
-                                    }
-                                  ]
-                                }
-                              }
-                            },
-                            "required": [
-                              "path"
-                            ],
-                            "additionalProperties": false
-                          }
+                        "claim": {
+                          "type": "string",
+                          "minLength": 1,
+                          "description": "Claim name that contains the issuance-session correlation value."
                         }
                       },
                       "required": [
-                        "id",
-                        "format",
-                        "meta"
+                        "method",
+                        "claim"
                       ],
                       "additionalProperties": false
                     },
-                    {
+                    "label": {
+                      "description": "Optional display label for UI selection.",
+                      "type": "string"
+                    },
+                    "enabled": {
+                      "description": "Whether this authorization server entry is enabled.",
+                      "type": "boolean"
+                    }
+                  },
+                  "required": [
+                    "type",
+                    "id",
+                    "issuer"
+                  ],
+                  "additionalProperties": false
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "type": {
+                      "type": "string",
+                      "const": "oid4vp",
+                      "description": "Use OID4VP-based authorization server chaining."
+                    },
+                    "id": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Authorization server identifier."
+                    },
+                    "presentationConfigId": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Presentation configuration id used during authorization."
+                    },
+                    "immediateWalletRedirect": {
+                      "description": "Redirect wallets immediately after authorization response creation.",
+                      "type": "boolean"
+                    },
+                    "token": {
+                      "description": "Optional token issuance settings.",
                       "type": "object",
                       "properties": {
-                        "id": {
+                        "lifetimeSeconds": {
+                          "description": "Access token lifetime in seconds.",
+                          "type": "number",
+                          "minimum": 60
+                        },
+                        "signingKeyId": {
+                          "description": "Optional key chain id used to sign issued tokens.",
                           "type": "string",
-                          "minLength": 1,
-                          "pattern": "^[A-Za-z0-9_-]+$",
-                          "description": "Credential query identifier."
+                          "minLength": 1
                         },
-                        "multiple": {
-                          "description": "Allow multiple matching credentials.",
+                        "refreshTokenEnabled": {
+                          "description": "Enable issuing refresh tokens.",
                           "type": "boolean"
                         },
-                        "claim_sets": {
-                          "description": "Optional claim set constraints.",
-                          "type": "array",
-                          "items": {
-                            "type": "array",
-                            "items": {
+                        "refreshTokenExpiresInSeconds": {
+                          "description": "Refresh token lifetime in seconds.",
+                          "type": "number",
+                          "minimum": 60
+                        }
+                      },
+                      "additionalProperties": false
+                    },
+                    "requireDPoP": {
+                      "description": "Require DPoP proofs for token/credential requests.",
+                      "type": "boolean"
+                    },
+                    "walletAttestationRequired": {
+                      "description": "Require wallet attestation for this authorization server.",
+                      "type": "boolean"
+                    },
+                    "walletProviderTrustLists": {
+                      "description": "Optional wallet provider trust list references for this authorization server.",
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "trustListId": {
+                            "type": "string",
+                            "minLength": 1
+                          },
+                          "url": {
+                            "description": "URL of the wallet provider trust list.",
+                            "type": "string",
+                            "format": "uri"
+                          },
+                          "verifierKey": {
+                            "description": "Optional verifier key material used for trust list verification.",
+                            "type": "object",
+                            "propertyNames": {
                               "type": "string"
-                            }
+                            },
+                            "additionalProperties": {}
+                          },
+                          "verifierKeyPem": {
+                            "description": "Optional verifier public key in SPKI PEM form (-----BEGIN PUBLIC KEY-----).",
+                            "type": "string",
+                            "pattern": "^\\s*-----BEGIN PUBLIC KEY-----[A-Za-z0-9+/=\\s]+-----END PUBLIC KEY-----\\s*$"
+                          },
+                          "verifierX509Der": {
+                            "description": "Optional verifier certificate in DER/base64 form.",
+                            "type": "string"
                           }
                         },
-                        "trusted_authorities": {
-                          "description": "Optional trusted authority constraints.",
-                          "type": "array",
-                          "items": {
-                            "oneOf": [
-                              {
-                                "type": "object",
-                                "properties": {
-                                  "type": {
-                                    "type": "string",
-                                    "const": "etsi_tl",
-                                    "description": "Trusted authority type discriminator for ETSI trust lists."
-                                  },
-                                  "values": {
-                                    "type": "array",
-                                    "items": {
-                                      "type": "object",
-                                      "properties": {
-                                        "trustListId": {
-                                          "description": "Optional trust list id reference.",
-                                          "type": "string"
-                                        },
-                                        "url": {
-                                          "description": "Optional trust list URL reference.",
-                                          "anyOf": [
-                                            {
-                                              "type": "string",
-                                              "format": "uri"
-                                            },
-                                            {
-                                              "type": "string",
-                                              "pattern": "^<TENANT_URL>(?:\\/.*)?$"
-                                            }
-                                          ]
-                                        },
-                                        "verifierKey": {
-                                          "description": "Optional verifier key material.",
-                                          "type": "object",
-                                          "propertyNames": {
-                                            "type": "string"
-                                          },
-                                          "additionalProperties": {}
-                                        },
-                                        "verifierX509Der": {
-                                          "description": "Optional verifier certificate in DER/base64 form.",
-                                          "type": "string"
-                                        }
-                                      },
-                                      "additionalProperties": false
-                                    },
-                                    "description": "Trust list references for ETSI TL verification."
-                                  }
-                                },
-                                "required": [
-                                  "type",
-                                  "values"
-                                ],
-                                "additionalProperties": false
-                              },
-                              {
-                                "type": "object",
-                                "properties": {
-                                  "type": {
-                                    "type": "string",
-                                    "const": "openid_federation",
-                                    "description": "Trusted authority type discriminator for OpenID Federation."
-                                  },
-                                  "values": {
-                                    "type": "array",
-                                    "items": {
-                                      "type": "string"
-                                    },
-                                    "description": "OpenID Federation authority identifiers."
-                                  }
-                                },
-                                "required": [
-                                  "type",
-                                  "values"
-                                ],
-                                "additionalProperties": false
-                              }
-                            ]
-                          }
+                        "additionalProperties": false
+                      }
+                    },
+                    "walletAttestationStatusCheckMode": {
+                      "description": "Status check mode for wallet attestations at this authorization server. Omit to inherit the issuance default.",
+                      "type": "string",
+                      "enum": [
+                        "strict",
+                        "best_effort",
+                        "disabled"
+                      ]
+                    },
+                    "label": {
+                      "description": "Optional display label for UI selection.",
+                      "type": "string"
+                    },
+                    "enabled": {
+                      "description": "Whether this authorization server entry is enabled.",
+                      "type": "boolean"
+                    }
+                  },
+                  "required": [
+                    "type",
+                    "id",
+                    "presentationConfigId"
+                  ],
+                  "additionalProperties": false
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "type": {
+                      "type": "string",
+                      "const": "chained",
+                      "description": "Use upstream OIDC as authorization source."
+                    },
+                    "id": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Authorization server identifier."
+                    },
+                    "upstream": {
+                      "type": "object",
+                      "properties": {
+                        "issuer": {
+                          "type": "string",
+                          "format": "uri",
+                          "description": "Upstream OIDC issuer URL."
                         },
-                        "format": {
+                        "clientId": {
                           "type": "string",
-                          "const": "mso_mdoc",
-                          "description": "Credential format discriminator."
+                          "minLength": 1,
+                          "description": "Client id for upstream OIDC authentication."
                         },
-                        "meta": {
-                          "type": "object",
-                          "properties": {
-                            "doctype_value": {
-                              "type": "string",
-                              "minLength": 1,
-                              "description": "Expected mDoc doctype value."
-                            }
-                          },
-                          "required": [
-                            "doctype_value"
-                          ],
-                          "additionalProperties": false
+                        "clientSecret": {
+                          "description": "Optional client secret for upstream OIDC authentication.",
+                          "type": "string",
+                          "minLength": 1
                         },
-                        "claims": {
-                          "description": "Optional mDoc claim-level constraints.",
+                        "scopes": {
+                          "description": "Optional scopes requested from the upstream issuer.",
                           "type": "array",
                           "items": {
-                            "type": "object",
-                            "properties": {
-                              "id": {
-                                "description": "Optional claim query id.",
-                                "type": "string"
-                              },
-                              "path": {
-                                "type": "array",
-                                "items": {
-                                  "type": [
-                                    "string",
-                                    "number"
-                                  ]
-                                },
-                                "description": "Path to the claim value in presented credentials."
-                              },
-                              "values": {
-                                "description": "Optional allowed values for the claim. A disclosed value must equal one of them in type and value.",
-                                "minItems": 1,
-                                "type": "array",
-                                "items": {
-                                  "anyOf": [
-                                    {
-                                      "type": "string"
-                                    },
-                                    {
-                                      "type": "integer",
-                                      "minimum": -9007199254740991,
-                                      "maximum": 9007199254740991
-                                    },
-                                    {
-                                      "type": "boolean"
-                                    }
-                                  ]
-                                }
-                              },
-                              "intent_to_retain": {
-                                "description": "Whether relying party intends to retain the claim.",
-                                "type": "boolean"
-                              }
-                            },
-                            "required": [
-                              "path"
-                            ],
-                            "additionalProperties": false
+                            "type": "string",
+                            "minLength": 1
                           }
                         }
                       },
                       "required": [
-                        "id",
-                        "format",
-                        "meta"
+                        "issuer",
+                        "clientId"
                       ],
+                      "additionalProperties": false,
+                      "description": "Upstream OIDC connection settings."
+                    },
+                    "token": {
+                      "description": "Optional token issuance settings.",
+                      "type": "object",
+                      "properties": {
+                        "lifetimeSeconds": {
+                          "description": "Access token lifetime in seconds.",
+                          "type": "number",
+                          "minimum": 60
+                        },
+                        "signingKeyId": {
+                          "description": "Optional key chain id used to sign issued tokens.",
+                          "type": "string",
+                          "minLength": 1
+                        },
+                        "refreshTokenEnabled": {
+                          "description": "Enable issuing refresh tokens.",
+                          "type": "boolean"
+                        },
+                        "refreshTokenExpiresInSeconds": {
+                          "description": "Refresh token lifetime in seconds.",
+                          "type": "number",
+                          "minimum": 60
+                        }
+                      },
                       "additionalProperties": false
+                    },
+                    "requireDPoP": {
+                      "description": "Require DPoP proofs for token/credential requests.",
+                      "type": "boolean"
+                    },
+                    "walletAttestationRequired": {
+                      "description": "Require wallet attestation for this authorization server.",
+                      "type": "boolean"
+                    },
+                    "walletProviderTrustLists": {
+                      "description": "Optional wallet provider trust list references for this authorization server.",
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "trustListId": {
+                            "type": "string",
+                            "minLength": 1
+                          },
+                          "url": {
+                            "description": "URL of the wallet provider trust list.",
+                            "type": "string",
+                            "format": "uri"
+                          },
+                          "verifierKey": {
+                            "description": "Optional verifier key material used for trust list verification.",
+                            "type": "object",
+                            "propertyNames": {
+                              "type": "string"
+                            },
+                            "additionalProperties": {}
+                          },
+                          "verifierKeyPem": {
+                            "description": "Optional verifier public key in SPKI PEM form (-----BEGIN PUBLIC KEY-----).",
+                            "type": "string",
+                            "pattern": "^\\s*-----BEGIN PUBLIC KEY-----[A-Za-z0-9+/=\\s]+-----END PUBLIC KEY-----\\s*$"
+                          },
+                          "verifierX509Der": {
+                            "description": "Optional verifier certificate in DER/base64 form.",
+                            "type": "string"
+                          }
+                        },
+                        "additionalProperties": false
+                      }
+                    },
+                    "walletAttestationStatusCheckMode": {
+                      "description": "Status check mode for wallet attestations at this authorization server. Omit to inherit the issuance default.",
+                      "type": "string",
+                      "enum": [
+                        "strict",
+                        "best_effort",
+                        "disabled"
+                      ]
+                    },
+                    "label": {
+                      "description": "Optional display label for UI selection.",
+                      "type": "string"
+                    },
+                    "enabled": {
+                      "description": "Whether this authorization server entry is enabled.",
+                      "type": "boolean"
                     }
-                  ]
+                  },
+                  "required": [
+                    "type",
+                    "id",
+                    "upstream"
+                  ],
+                  "additionalProperties": false
                 },
-                "description": "Credential queries requested by the verifier."
-              },
-              "credential_sets": {
-                "description": "Optional higher-level credential set requirements.",
-                "type": "array",
-                "items": {
+                {
                   "type": "object",
                   "properties": {
-                    "options": {
-                      "minItems": 1,
-                      "type": "array",
-                      "items": {
-                        "minItems": 1,
-                        "type": "array",
-                        "items": {
-                          "type": "string"
+                    "type": {
+                      "type": "string",
+                      "const": "built-in",
+                      "description": "Use EUDIPLO built-in authorization server."
+                    },
+                    "id": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Authorization server identifier."
+                    },
+                    "token": {
+                      "description": "Optional token issuance settings.",
+                      "type": "object",
+                      "properties": {
+                        "lifetimeSeconds": {
+                          "description": "Access token lifetime in seconds.",
+                          "type": "number",
+                          "minimum": 60
+                        },
+                        "signingKeyId": {
+                          "description": "Optional key chain id used to sign issued tokens.",
+                          "type": "string",
+                          "minLength": 1
+                        },
+                        "refreshTokenEnabled": {
+                          "description": "Enable issuing refresh tokens.",
+                          "type": "boolean"
+                        },
+                        "refreshTokenExpiresInSeconds": {
+                          "description": "Refresh token lifetime in seconds.",
+                          "type": "number",
+                          "minimum": 60
                         }
                       },
-                      "description": "Alternative credential query id combinations."
+                      "additionalProperties": false
+                    },
+                    "requireDPoP": {
+                      "description": "Require DPoP proofs for token/credential requests.",
+                      "type": "boolean"
+                    },
+                    "walletAttestationRequired": {
+                      "description": "Require wallet attestation for this authorization server.",
+                      "type": "boolean"
+                    },
+                    "walletProviderTrustLists": {
+                      "description": "Optional wallet provider trust list references for this authorization server.",
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "trustListId": {
+                            "type": "string",
+                            "minLength": 1
+                          },
+                          "url": {
+                            "description": "URL of the wallet provider trust list.",
+                            "type": "string",
+                            "format": "uri"
+                          },
+                          "verifierKey": {
+                            "description": "Optional verifier key material used for trust list verification.",
+                            "type": "object",
+                            "propertyNames": {
+                              "type": "string"
+                            },
+                            "additionalProperties": {}
+                          },
+                          "verifierKeyPem": {
+                            "description": "Optional verifier public key in SPKI PEM form (-----BEGIN PUBLIC KEY-----).",
+                            "type": "string",
+                            "pattern": "^\\s*-----BEGIN PUBLIC KEY-----[A-Za-z0-9+/=\\s]+-----END PUBLIC KEY-----\\s*$"
+                          },
+                          "verifierX509Der": {
+                            "description": "Optional verifier certificate in DER/base64 form.",
+                            "type": "string"
+                          }
+                        },
+                        "additionalProperties": false
+                      }
+                    },
+                    "walletAttestationStatusCheckMode": {
+                      "description": "Status check mode for wallet attestations at this authorization server. Omit to inherit the issuance default.",
+                      "type": "string",
+                      "enum": [
+                        "strict",
+                        "best_effort",
+                        "disabled"
+                      ]
                     },
-                    "required": {
-                      "description": "Whether this credential set is mandatory.",
+                    "label": {
+                      "description": "Optional display label for UI selection.",
+                      "type": "string"
+                    },
+                    "enabled": {
+                      "description": "Whether this authorization server entry is enabled.",
                       "type": "boolean"
                     }
                   },
                   "required": [
-                    "options"
+                    "type",
+                    "id"
                   ],
                   "additionalProperties": false
                 }
-              }
+              ],
+              "description": "Supported authorization server configurations."
             },
-            "required": [
-              "credentials"
-            ],
-            "additionalProperties": false,
-            "description": "DCQL query defining requested credentials and claims."
+            "description": "Configured authorization server entries."
           },
-          "transaction_data": {
-            "description": "Optional transaction data descriptors.",
+          "federation": {
+            "description": "Optional OpenID Federation settings.",
             "anyOf": [
               {
-                "type": "array",
-                "items": {
-                  "type": "object",
-                  "properties": {
-                    "type": {
-                      "type": "string",
-                      "description": "Transaction data type identifier."
-                    },
-                    "credential_ids": {
-                      "type": "array",
-                      "items": {
-                        "type": "string"
+                "type": "object",
+                "properties": {
+                  "role": {
+                    "description": "Federation role for this issuer.",
+                    "type": "string",
+                    "enum": [
+                      "trust_anchor",
+                      "intermediate",
+                      "leaf"
+                    ]
+                  },
+                  "mode": {
+                    "description": "Federation operation mode.",
+                    "type": "string",
+                    "enum": [
+                      "federation-only",
+                      "hybrid"
+                    ]
+                  },
+                  "entityId": {
+                    "description": "Optional local federation entity id.",
+                    "type": "string"
+                  },
+                  "enforceSigningPolicy": {
+                    "description": "Enforce strict signing policy checks.",
+                    "type": "boolean"
+                  },
+                  "cacheTtlSeconds": {
+                    "description": "Cache time-to-live for federation metadata in seconds.",
+                    "type": "integer",
+                    "minimum": 1,
+                    "maximum": 9007199254740991
+                  },
+                  "trustAnchors": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "entityId": {
+                          "type": "string",
+                          "minLength": 1,
+                          "description": "Federation trust anchor entity id."
+                        },
+                        "entityConfigurationUri": {
+                          "type": "string",
+                          "format": "uri",
+                          "description": "Entity configuration URI for the trust anchor."
+                        }
                       },
-                      "description": "Credential query ids this transaction data applies to."
+                      "required": [
+                        "entityId",
+                        "entityConfigurationUri"
+                      ],
+                      "additionalProperties": false
                     },
-                    "payload": {
-                      "description": "Transaction details. Required for TS12 SCA transaction data."
-                    }
-                  },
-                  "required": [
-                    "type",
-                    "credential_ids"
-                  ],
-                  "additionalProperties": {}
-                }
+                    "description": "Federation trust anchors."
+                  }
+                },
+                "required": [
+                  "trustAnchors"
+                ],
+                "additionalProperties": false
               },
               {
                 "type": "null"
               }
             ]
           },
-          "registration_cert": {
-            "description": "Optional registration certificate request settings.",
+          "registrationCertificate": {
+            "description": "Optional registration certificate settings.",
             "anyOf": [
               {
                 "type": "object",
                 "properties": {
-                  "id": {
-                    "type": "string"
+                  "enabled": {
+                    "description": "Enable issuer registration certificate support.",
+                    "type": "boolean"
                   },
-                  "body": {
-                    "type": "object",
-                    "properties": {
-                      "privacy_policy": {
-                        "type": "string"
-                      },
-                      "support_uri": {
-                        "type": "string"
-                      },
-                      "intermediary": {
-                        "type": "string"
-                      },
-                      "purpose": {
-                        "type": "array",
-                        "items": {
-                          "type": "object",
-                          "properties": {
-                            "lang": {
-                              "type": "string"
-                            },
-                            "content": {
-                              "type": "string"
-                            }
-                          },
-                          "required": [
-                            "lang",
-                            "content"
-                          ],
-                          "additionalProperties": false
-                        }
-                      },
-                      "credentials": {
-                        "type": "array",
-                        "items": {
-                          "type": "object",
-                          "propertyNames": {
-                            "type": "string"
-                          },
-                          "additionalProperties": {}
-                        }
-                      },
-                      "provides_attestations": {
-                        "type": "array",
-                        "items": {
-                          "type": "string",
-                          "minLength": 1
-                        }
-                      }
-                    },
-                    "additionalProperties": false
+                  "mode": {
+                    "description": "How registration certificate data is provided.",
+                    "type": "string",
+                    "enum": [
+                      "import",
+                      "generate"
+                    ]
                   },
                   "jwt": {
+                    "description": "Optional registration certificate JWT when using import mode.",
+                    "type": "string"
+                  },
+                  "privacyPolicy": {
+                    "description": "Optional privacy policy URI.",
+                    "type": "string"
+                  },
+                  "supportUri": {
+                    "description": "Optional support URI.",
                     "type": "string"
                   }
                 },
@@ -25675,146 +27494,225 @@ var CONFIG_SCHEMAS = [
               }
             ]
           },
-          "registrationCertImportJwt": {
-            "description": "Optional imported registration certificate JWT.",
-            "type": [
-              "string",
-              "null"
-            ]
-          },
-          "registrationCertImportId": {
-            "description": "Optional registrar-side registration certificate id.",
-            "type": [
-              "string",
-              "null"
-            ]
+          "display": {
+            "description": "Localized issuer metadata shown to wallets.",
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "description": "Issuer display name.",
+                  "type": "string"
+                },
+                "locale": {
+                  "description": "Locale tag for this display entry.",
+                  "type": "string"
+                },
+                "logo": {
+                  "description": "Optional issuer logo metadata.",
+                  "type": "object",
+                  "properties": {
+                    "uri": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Logo URI."
+                    },
+                    "alt_text": {
+                      "description": "Optional localized alternative text.",
+                      "type": "string"
+                    }
+                  },
+                  "required": [
+                    "uri"
+                  ],
+                  "additionalProperties": {}
+                }
+              },
+              "additionalProperties": {}
+            }
           },
-          "registrationCertBodyPrivacyPolicy": {
-            "description": "Optional registration certificate privacy policy URI.",
-            "type": [
-              "string",
-              "null"
-            ]
+          "notificationEndpointEnabled": {
+            "description": "Whether the OID4VCI notification endpoint is exposed for this issuance configuration.",
+            "type": "boolean"
           },
-          "registrationCertBodySupportUri": {
-            "description": "Optional registration certificate support URI.",
-            "type": [
-              "string",
-              "null"
-            ]
+          "credentialResponseEncryption": {
+            "description": "Enable encrypted credential responses.",
+            "type": "boolean"
           },
-          "registrationCertBodyIntermediary": {
-            "description": "Optional registration certificate intermediary.",
-            "type": [
-              "string",
-              "null"
-            ]
+          "credentialRequestEncryption": {
+            "description": "Require encrypted credential requests.",
+            "type": "boolean"
           },
-          "registrationCertBodyPurpose": {
-            "description": "Optional registration certificate purpose entries.",
+          "txCodeMaxAttempts": {
+            "description": "Maximum verification attempts for transaction codes. Null resets to defaults.",
             "anyOf": [
               {
-                "type": "array",
-                "items": {
-                  "type": "object",
-                  "properties": {
-                    "lang": {
-                      "type": "string"
-                    },
-                    "content": {
-                      "type": "string"
-                    }
-                  },
-                  "additionalProperties": false
-                }
+                "type": "integer",
+                "minimum": 1,
+                "maximum": 9007199254740991
               },
               {
                 "type": "null"
               }
             ]
           },
-          "webhookEndpointId": {
-            "description": "Optional webhook endpoint id for presentation callbacks.",
-            "type": [
-              "string",
-              "null"
-            ]
-          },
-          "attached": {
-            "description": "Optional attachments included with presentation requests.",
+          "offerLifetimeSeconds": {
+            "description": "Default lifetime of credential offers in seconds. Can be overridden per offer request. Null or unset: offers do not expire.",
             "anyOf": [
               {
-                "type": "array",
-                "items": {
-                  "type": "object",
-                  "properties": {
-                    "format": {
-                      "type": "string",
-                      "description": "Attachment format identifier."
-                    },
-                    "data": {
-                      "description": "Attachment payload."
-                    },
-                    "credential_ids": {
-                      "description": "Optional credential query ids bound to this attachment.",
-                      "type": "array",
-                      "items": {
-                        "type": "string"
-                      }
-                    }
-                  },
-                  "required": [
-                    "format",
-                    "data"
-                  ],
-                  "additionalProperties": false
-                }
+                "type": "integer",
+                "minimum": 1,
+                "maximum": 9007199254740991
               },
               {
                 "type": "null"
               }
             ]
+          }
+        },
+        "required": [
+          "authorizationServers"
+        ],
+        "additionalProperties": false,
+        "title": "IssuanceConfig"
+      }
+    }
+  },
+  {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://eudiplo.dev/schemas/v4/TenantConfigFile.schema.json",
+    "title": "TenantConfigFile",
+    "type": "object",
+    "properties": {
+      "$schema": {
+        "type": "string",
+        "const": "https://eudiplo.dev/schemas/v4/TenantConfigFile.schema.json"
+      },
+      "metadata": {
+        "type": "object",
+        "properties": {
+          "generation": {
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 9007199254740991
           },
-          "redirectUri": {
-            "description": "Optional redirect URI after presentation completion.",
-            "type": [
-              "string",
-              "null"
+          "ownership": {
+            "type": "string",
+            "enum": [
+              "unmanaged",
+              "file-managed"
             ]
+          }
+        },
+        "additionalProperties": false
+      },
+      "spec": {
+        "type": "object",
+        "properties": {
+          "name": {
+            "default": "EUDIPLO",
+            "description": "Display name of the tenant.",
+            "type": "string",
+            "minLength": 1
           },
-          "accessKeyChainId": {
-            "description": "Optional key chain id for access token/auth operations.",
-            "type": [
-              "string",
-              "null"
-            ]
+          "description": {
+            "description": "Optional tenant description.",
+            "type": "string",
+            "minLength": 1
           },
-          "readerAuth": {
-            "description": "Whether reader authentication is required for mDoc requests.",
-            "type": [
-              "boolean",
-              "null"
-            ]
+          "sessionConfig": {
+            "description": "Optional tenant-specific session storage configuration.",
+            "type": "object",
+            "properties": {
+              "ttlSeconds": {
+                "description": "Session time-to-live in seconds.",
+                "type": "integer",
+                "minimum": 60,
+                "maximum": 9007199254740991
+              },
+              "cleanupMode": {
+                "description": "Whether to fully delete or anonymize expired sessions.",
+                "type": "string",
+                "enum": [
+                  "full",
+                  "anonymize"
+                ]
+              }
+            },
+            "additionalProperties": false
+          },
+          "statusListConfig": {
+            "description": "Optional tenant-specific status list defaults.",
+            "type": "object",
+            "properties": {
+              "capacity": {
+                "description": "Default status list capacity.",
+                "type": "integer",
+                "minimum": 100,
+                "maximum": 9007199254740991
+              },
+              "bits": {
+                "description": "Bits-per-status setting (1, 2, 4, or 8).",
+                "anyOf": [
+                  {
+                    "type": "number",
+                    "const": 1
+                  },
+                  {
+                    "type": "number",
+                    "const": 2
+                  },
+                  {
+                    "type": "number",
+                    "const": 4
+                  },
+                  {
+                    "type": "number",
+                    "const": 8
+                  }
+                ]
+              },
+              "ttl": {
+                "description": "JWT TTL for status list tokens in seconds.",
+                "type": "integer",
+                "minimum": 60,
+                "maximum": 9007199254740991
+              },
+              "immediateUpdate": {
+                "description": "Regenerate status list JWTs immediately after status updates.",
+                "type": "boolean"
+              },
+              "enableAggregation": {
+                "description": "Include aggregation_uri in generated status list JWTs.",
+                "type": "boolean"
+              }
+            },
+            "additionalProperties": false
           }
         },
         "required": [
-          "id",
-          "dcql_query"
+          "name"
         ],
         "additionalProperties": false,
-        "title": "PresentationConfigCreateDto"
+        "description": "Payload used when importing tenant metadata from config files."
       }
-    }
+    },
+    "required": [
+      "$schema",
+      "metadata",
+      "spec"
+    ],
+    "additionalProperties": false
   },
   {
     "$schema": "https://json-schema.org/draft/2020-12/schema",
-    "$id": "https://eudiplo.dev/schemas/v4/IssuanceConfigFile.schema.json",
+    "$id": "https://eudiplo.dev/schemas/v5/IssuanceConfigFile.schema.json",
     "title": "IssuanceConfigFile",
     "type": "object",
     "properties": {
       "$schema": {
         "type": "string",
-        "const": "https://eudiplo.dev/schemas/v4/IssuanceConfigFile.schema.json"
+        "const": "https://eudiplo.dev/schemas/v5/IssuanceConfigFile.schema.json"
       },
       "metadata": {
         "type": "object",
@@ -26374,8 +28272,9 @@ var CONFIG_SCHEMAS = [
                     ]
                   },
                   "entityId": {
-                    "description": "Optional local federation entity id.",
-                    "type": "string"
+                    "description": "Entity Identifier of the tenant's federation entity, usually {PUBLIC_URL}/issuers/{tenantId}: an https URL with a host and without query or fragment (OpenID Federation 1.0 Section 1.2). http is accepted only when OUTBOUND_URL_ALLOW_HTTP is true.",
+                    "type": "string",
+                    "pattern": "^(https?:\\/\\/[^\\s?#]+)?$"
                   },
                   "enforceSigningPolicy": {
                     "description": "Enforce strict signing policy checks.",
@@ -26410,6 +28309,80 @@ var CONFIG_SCHEMAS = [
                       "additionalProperties": false
                     },
                     "description": "Federation trust anchors."
+                  },
+                  "entityTypes": {
+                    "description": "Roles the entity configuration publishes metadata for. Defaults to openid_credential_issuer.",
+                    "minItems": 1,
+                    "type": "array",
+                    "items": {
+                      "type": "string",
+                      "enum": [
+                        "openid_credential_issuer",
+                        "openid_credential_verifier"
+                      ]
+                    }
+                  },
+                  "authorityHints": {
+                    "description": "authority_hints of the entity configuration: the superiors that issue a subordinate statement about this entity. Defaults to the trust anchor entity ids.",
+                    "type": "array",
+                    "items": {
+                      "type": "string",
+                      "format": "uri"
+                    }
+                  },
+                  "entityKeyChainId": {
+                    "description": "Key chain with usage type 'federation' that signs the entity configuration. Without it, a federation key chain of the tenant is used; set it when the tenant has several.",
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "entityConfigurationLifetimeSeconds": {
+                    "description": "Lifetime (exp - iat) of the entity configuration in seconds. Defaults to 86400.",
+                    "type": "integer",
+                    "minimum": 60,
+                    "maximum": 31536e3
+                  },
+                  "trustMarks": {
+                    "description": "Trust mark JWTs issued to this entity, published in the entity configuration.",
+                    "type": "array",
+                    "items": {
+                      "type": "string",
+                      "minLength": 1
+                    }
+                  },
+                  "entityMetadata": {
+                    "description": "Informational federation_entity metadata of the entity configuration.",
+                    "type": "object",
+                    "properties": {
+                      "organization_name": {
+                        "type": "string",
+                        "minLength": 1
+                      },
+                      "contacts": {
+                        "minItems": 1,
+                        "type": "array",
+                        "items": {
+                          "type": "string",
+                          "minLength": 1
+                        }
+                      },
+                      "logo_uri": {
+                        "type": "string",
+                        "format": "uri"
+                      },
+                      "policy_uri": {
+                        "type": "string",
+                        "format": "uri"
+                      },
+                      "homepage_uri": {
+                        "type": "string",
+                        "format": "uri"
+                      }
+                    },
+                    "additionalProperties": false
+                  },
+                  "includeTrustChain": {
+                    "description": "Add the trust chain of this entity as trust_chain header to federation SD-JWT VCs and OID4VP request objects.",
+                    "type": "boolean"
                   }
                 },
                 "required": [
@@ -26669,12 +28642,7 @@ function inferredKind(path2) {
 function wrapBare(kind, input, path2) {
   if (!input || typeof input !== "object" || Array.isArray(input))
     throw new Error(`${path2}: configuration must be an object`);
-  const singleton = {
-    Tenant: "tenant",
-    KmsConfig: "kms",
-    RegistrarConfig: "registrar",
-    IssuanceConfig: "issuance"
-  };
+  const singleton = CONFIG_SINGLETON_IDS;
   const spec = structuredClone(input);
   if (kind === "KeyChain" && spec.key && !spec.keySource) {
     spec.keySource = { type: "private-jwk", jwk: spec.key };
@@ -29324,7 +31292,7 @@ function createDeploymentCommands(context, setExitCode) {
 // package.json
 var package_default = {
   name: "@eudiplo/cli",
-  version: "9.1.0-main.52a85b9",
+  version: "9.1.0-main.54c58b8",
   description: "Deployment-aware command line tools for EUDIPLO",
   private: false,
   type: "module",
@@ -29339,11 +31307,12 @@ var package_default = {
   scripts: {
     "assets:sync": "node scripts/sync-cli-assets.cjs",
     "assets:check": "node scripts/check-cli-assets.cjs",
+    "build:deps": 'pnpm --silent --filter "@eudiplo/cli^..." build',
     build: "pnpm assets:sync && pnpm assets:check && tsc -p tsconfig.json",
     "build:publish": "pnpm build && esbuild src/index.ts --bundle --platform=node --format=esm --target=node22.12 --alias:jsonc-parser=jsonc-parser/lib/esm/main.js --outfile=dist/index.js",
     "build:sea:bundle": "pnpm assets:sync && pnpm assets:check && esbuild src/index.ts --bundle --platform=node --format=esm --target=node22.12 --alias:jsonc-parser=jsonc-parser/lib/esm/main.js --outfile=dist-sea/index.js",
     "build:sea": "node scripts/build-cli-sea.mjs",
-    dev: "tsx src/index.ts",
+    dev: "pnpm -s build:deps && tsx src/index.ts",
     test: "vitest run --root ../.. --project cli",
     lint: "biome lint .",
     format: "biome format --write .",
@@ -29384,12 +31353,12 @@ var package_default = {
     "jsonc-parser": "^3.3.1"
   },
   devDependencies: {
-    "@biomejs/biome": "2.5.15",
-    "@types/node": "^26.6.4",
+    "@biomejs/biome": "2.6.3",
+    "@types/node": "^26.6.5",
     esbuild: "^0.28.2",
     tsx: "^4.23.15",
     typescript: "^7.0.2",
-    vitest: "5.0.3"
+    vitest: "5.0.5"
   }
 };