@ixo/credentials-kit 0.0.0-stage → 0.1.0

package/dist/chunk-2SF56NEJ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/internal/jwe.ts","../src/oid4vp.ts"],"names":["request"],"mappings":";;;;;;;;;AAgCO,IAAM,OAAA,GAAU,SAAA;AAEhB,IAAM,QAAA,GAAW,CAAC,SAAA,EAAW,SAAS,CAAA;AAGtC,IAAM,OAAA,GAAkB,SAAA;AAExB,SAAS,SAAS,CAAA,EAAyB;AAChD,EAAA,OAAO,CAAA,KAAM,aAAa,CAAA,KAAM,SAAA;AAClC;AAEA,SAAS,UAAU,GAAA,EAAwB;AACzC,EAAA,OAAO,GAAA,KAAQ,YAAY,GAAA,GAAM,GAAA;AACnC;AAEO,IAAM,iBAAiB,GAAA,GAAM,IAAA;AAE7B,IAAM,QAAA,GAAN,cAAuB,KAAA,CAAM;AAAA,EAClC,YACW,IAAA,EACT;AACA,IAAA,KAAA,CAAM,CAAA,IAAA,EAAO,IAAI,CAAA,CAAE,CAAA;AAFV,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAGT,IAAA,IAAA,CAAK,IAAA,GAAO,UAAA;AAAA,EACd;AAAA,EAJW,IAAA;AAKb,CAAA;AAEA,SAAS,SAAS,CAAA,EAAuB;AACvC,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,CAAC,CAAA;AAC5B,EAAA,IAAI,SAAS,GAAA,CAAI,MAAM,EAAE,SAAA,CAAU,CAAA,EAAG,GAAG,KAAK,CAAA;AAC9C,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,eAAe,KAAA,EAA+B;AACrD,EAAA,OAAO,WAAA,CAAY,QAAA,CAAS,KAAA,CAAM,MAAM,GAAG,KAAK,CAAA;AAClD;AAMA,eAAsB,SAAA,CACpB,CAAA,EACA,OAAA,EACA,WAAA,EACA,GAAA,GAAkB,IAAI,UAAA,CAAW,CAAC,CAAA,EAClC,GAAA,GAAkB,IAAI,UAAA,CAAW,CAAC,CAAA,EACA;AAClC,EAAA,MAAM,SAAA,GAAY,WAAA;AAAA,IAChB,cAAA,CAAe,IAAA,CAAK,WAAW,CAAC,CAAA;AAAA,IAChC,eAAe,GAAG,CAAA;AAAA,IAClB,eAAe,GAAG,CAAA;AAAA,IAClB,SAAS,OAAO;AAAA,GAClB;AACA,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,IAAA,CAAK,OAAA,GAAU,GAAG,CAAA;AACtC,EAAA,MAAM,QAAsB,EAAC;AAC7B,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,IAAK,MAAA,EAAQ,CAAA,EAAA,EAAK;AAChC,IAAA,MAAM,QAAQ,WAAA,CAAY,QAAA,CAAS,CAAC,CAAA,EAAG,GAAG,SAAS,CAAA;AACnD,IAAA,KAAA,CAAM,IAAA,CAAK,IAAI,UAAA,CAAW,MAAM,MAAA,CAAO,OAAO,MAAA,CAAO,SAAA,EAAW,KAAK,CAAC,CAAC,CAAA;AAAA,EACzE;AACA,EAAA,OAAO,YAAY,GAAG,KAAK,EAAE,KAAA,CAAM,CAAA,EAAG,UAAU,CAAC,CAAA;AACnD;AAEO,SAAS,gBAAgB,CAAA,EAAgC;AAC9D,EAAA,OACE,SAAS,CAAC,CAAA,IACV,EAAE,GAAA,KAAQ,IAAA,IACV,EAAE,GAAA,KAAQ,OAAA,IACV,OAAO,CAAA,CAAE,MAAM,QAAA,IACf,OAAO,EAAE,CAAA,KAAM,QAAA,IACf,EAAE,GAAA,IAAO,CAAA,CAAA;AAEb;AAEA,SAAS,WAAW,GAAA,EAAgC;AAClD,EAAA,OAAO,EAAE,GAAA,EAAK,IAAA,EAAM,GAAA,EAAK,OAAA,EAAS,GAAG,GAAA,CAAI,CAAA,EAAG,CAAA,EAAG,GAAA,CAAI,CAAA,EAAE;AACvD;AAEA,eAAe,aAAa,GAAA,EAAwC;AAClE,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,OAAO,MAAA,CAAO,SAAA;AAAA,MACzB,KAAA;AAAA,MACA,WAAW,GAAG,CAAA;AAAA,MACd,EAAE,IAAA,EAAM,MAAA,EAAQ,UAAA,EAAY,OAAA,EAAQ;AAAA,MACpC,IAAA;AAAA,MACA;AAAC,KACH;AAAA,EACF,CAAA,CAAA,MAAQ;AAEN,IAAA,MAAM,IAAI,SAAS,SAAS,CAAA;AAAA,EAC9B;AACF;AAEA,eAAe,cAAc,GAAA,EAAyC;AACpE,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,OAAO,MAAA,CAAO,SAAA;AAAA,MACzB,KAAA;AAAA,MACA,EAAE,GAAG,UAAA,CAAW,GAAG,CAAA,EAAG,CAAA,EAAG,IAAI,CAAA,EAAE;AAAA,MAC/B,EAAE,IAAA,EAAM,MAAA,EAAQ,UAAA,EAAY,OAAA,EAAQ;AAAA,MACpC,KAAA;AAAA,MACA,CAAC,YAAY;AAAA,KACf;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,SAAS,SAAS,CAAA;AAAA,EAC9B;AACF;AAEA,eAAe,YAAA,CACb,MACA,GAAA,EACqB;AACrB,EAAA,OAAO,IAAI,UAAA;AAAA,IACT,MAAM,MAAA,CAAO,MAAA,CAAO,UAAA,CAAW,EAAE,IAAA,EAAM,MAAA,EAAQ,MAAA,EAAQ,GAAA,EAAI,EAAG,IAAA,EAAM,GAAG;AAAA,GACzE;AACF;AAGA,eAAsB,oBACpB,GAAA,EACmE;AACnE,EAAA,MAAM,IAAA,GAAO,MAAM,MAAA,CAAO,MAAA,CAAO,WAAA;AAAA,IAC/B,EAAE,IAAA,EAAM,MAAA,EAAQ,UAAA,EAAY,OAAA,EAAQ;AAAA,IACpC,IAAA;AAAA,IACA,CAAC,YAAY;AAAA,GACf;AACA,EAAA,MAAM,OAAO,MAAM,MAAA,CAAO,OAAO,SAAA,CAAU,KAAA,EAAO,KAAK,UAAU,CAAA;AACjE,EAAA,IAAI,CAAC,IAAA,CAAK,CAAA,IAAK,CAAC,IAAA,CAAK,CAAA,IAAK,CAAC,IAAA,CAAK,CAAA,EAAG,MAAM,IAAI,QAAA,CAAS,SAAS,CAAA;AAC/D,EAAA,MAAM,SAAA,GAA2B;AAAA,IAC/B,GAAA,EAAK,IAAA;AAAA,IACL,GAAA,EAAK,OAAA;AAAA,IACL,GAAG,IAAA,CAAK,CAAA;AAAA,IACR,GAAG,IAAA,CAAK,CAAA;AAAA,IACR,GAAA;AAAA,IACA,GAAA,EAAK,KAAA;AAAA,IACL,GAAA,EAAK;AAAA,GACP;AACA,EAAA,OAAO,EAAE,WAAW,UAAA,EAAY,EAAE,GAAG,SAAA,EAAW,CAAA,EAAG,IAAA,CAAK,CAAA,EAAE,EAAE;AAC9D;AAGA,eAAsB,UAAA,CACpB,OAAA,EACA,SAAA,EACA,GAAA,GAAc,OAAA,EACG;AACjB,EAAA,IAAI,CAAC,QAAA,CAAS,GAAG,GAAG,MAAM,IAAI,SAAS,aAAa,CAAA;AACpD,EAAA,MAAM,YAAA,GAAe,MAAM,YAAA,CAAa,SAAS,CAAA;AACjD,EAAA,MAAM,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,WAAA;AAAA,IAC9B,EAAE,IAAA,EAAM,MAAA,EAAQ,UAAA,EAAY,OAAA,EAAQ;AAAA,IACpC,IAAA;AAAA,IACA,CAAC,YAAY;AAAA,GACf;AACA,EAAA,MAAM,MAAM,MAAM,MAAA,CAAO,OAAO,SAAA,CAAU,KAAA,EAAO,IAAI,SAAS,CAAA;AAC9D,EAAA,MAAM,MAAA,GAAqB;AAAA,IACzB,GAAA,EAAK,OAAA;AAAA,IACL,GAAA;AAAA,IACA,GAAI,UAAU,GAAA,KAAQ,MAAA,GAAY,EAAE,GAAA,EAAK,SAAA,CAAU,GAAA,EAAI,GAAI,EAAC;AAAA,IAC5D,GAAA,EAAK,EAAE,GAAA,EAAK,IAAA,EAAM,GAAA,EAAK,OAAA,EAAS,CAAA,EAAG,GAAA,CAAI,CAAA,EAAG,CAAA,EAAG,GAAA,CAAI,CAAA;AAAE,GACrD;AACA,EAAA,MAAM,CAAA,GAAI,MAAM,YAAA,CAAa,GAAA,CAAI,YAAY,YAAY,CAAA;AACzD,EAAA,MAAM,MAAM,MAAM,SAAA,CAAU,GAAG,SAAA,CAAU,GAAG,GAAG,GAAG,CAAA;AAClD,EAAA,MAAM,kBAAkB,eAAA,CAAgB,IAAA,CAAK,KAAK,SAAA,CAAU,MAAM,CAAC,CAAC,CAAA;AACpE,EAAA,MAAM,KAAK,MAAA,CAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,EAAE,CAAC,CAAA;AACpD,EAAA,MAAM,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,UAAU,KAAA,EAAO,GAAA,EAAK,WAAW,KAAA,EAAO;AAAA,IACtE;AAAA,GACD,CAAA;AACD,EAAA,MAAM,SAAS,IAAI,UAAA;AAAA,IACjB,MAAM,OAAO,MAAA,CAAO,OAAA;AAAA,MAClB;AAAA,QACE,IAAA,EAAM,SAAA;AAAA,QACN,EAAA;AAAA,QACA,cAAA,EAAgB,KAAK,eAAe,CAAA;AAAA,QACpC,SAAA,EAAW;AAAA,OACb;AAAA,MACA,GAAA;AAAA,MACA,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,OAAO,CAAC;AAAA;AAC9B,GACF;AACA,EAAA,MAAM,aAAa,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,MAAA,CAAO,SAAS,EAAE,CAAA;AACrD,EAAA,MAAM,GAAA,GAAM,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,SAAS,EAAE,CAAA;AAC3C,EAAA,OAAO;AAAA,IACL,eAAA;AAAA,IACA,EAAA;AAAA,IACA,gBAAgB,EAAE,CAAA;AAAA,IAClB,gBAAgB,UAAU,CAAA;AAAA,IAC1B,gBAAgB,GAAG;AAAA,GACrB,CAAE,KAAK,GAAG,CAAA;AACZ;AAGO,SAAS,gBAAgB,OAAA,EAA6B;AAC3D,EAAA,MAAM,QAAQ,OAAA,CAAQ,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,IAAK,EAAA;AACvC,EAAA,IAAI;AACF,IAAA,MAAM,SAAkB,IAAA,CAAK,KAAA,CAAM,SAAS,eAAA,CAAgB,KAAK,CAAC,CAAC,CAAA;AACnE,IAAA,IAAI,CAAC,QAAA,CAAS,MAAM,GAAG,MAAM,IAAI,SAAS,WAAW,CAAA;AACrD,IAAA,OAAO,MAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,SAAS,WAAW,CAAA;AAAA,EAChC;AACF;AAMA,eAAsB,UAAA,CACpB,OAAA,EACA,SAAA,EACA,MAAA,GAA4B,QAAA,EACP;AACrB,EAAA,IAAI,OAAO,OAAA,KAAY,QAAA,IAAY,OAAA,CAAQ,SAAS,cAAA,EAAgB;AAClE,IAAA,MAAM,IAAI,SAAS,WAAW,CAAA;AAAA,EAChC;AACA,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,CAAM,GAAG,CAAA;AAC/B,EAAA,IAAI,MAAM,MAAA,KAAW,CAAA,EAAG,MAAM,IAAI,SAAS,WAAW,CAAA;AACtD,EAAA,MAAM,CAAC,CAAA,EAAG,YAAA,EAAc,KAAA,EAAO,KAAA,EAAO,MAAM,CAAA,GAAI,KAAA;AAOhD,EAAA,IAAI,YAAA,KAAiB,EAAA,EAAI,MAAM,IAAI,SAAS,aAAa,CAAA;AACzD,EAAA,MAAM,MAAA,GAAS,gBAAgB,OAAO,CAAA;AACtC,EAAA,MAAM,MAAM,MAAA,CAAO,GAAA;AACnB,EAAA,IAAI,MAAA,CAAO,GAAA,KAAQ,OAAA,IAAW,CAAC,QAAA,CAAS,GAAG,CAAA,IAAK,CAAC,MAAA,CAAO,QAAA,CAAS,GAAG,CAAA,EAAG;AACrE,IAAA,MAAM,IAAI,SAAS,aAAa,CAAA;AAAA,EAClC;AACA,EAAA,IAAI,MAAA,CAAO,GAAA,KAAQ,MAAA,IAAa,MAAA,CAAO,SAAS,MAAA,EAAW;AACzD,IAAA,MAAM,IAAI,SAAS,aAAa,CAAA;AAAA,EAClC;AACA,EAAA,IACE,SAAA,CAAU,QAAQ,MAAA,IAClB,MAAA,CAAO,QAAQ,MAAA,IACf,MAAA,CAAO,GAAA,KAAQ,SAAA,CAAU,GAAA,EACzB;AACA,IAAA,MAAM,IAAI,SAAS,SAAS,CAAA;AAAA,EAC9B;AACA,EAAA,IAAI,CAAC,gBAAgB,MAAA,CAAO,GAAG,GAAG,MAAM,IAAI,SAAS,WAAW,CAAA;AAChE,EAAA,IAAI,EAAA;AACJ,EAAA,IAAI,UAAA;AACJ,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,EAAA,GAAK,gBAAgB,KAAK,CAAA;AAC1B,IAAA,UAAA,GAAa,gBAAgB,KAAK,CAAA;AAClC,IAAA,GAAA,GAAM,gBAAgB,MAAM,CAAA;AAC5B,IAAA,GAAA,GACE,OAAO,MAAA,CAAO,GAAA,KAAQ,QAAA,GAClB,eAAA,CAAgB,OAAO,GAAG,CAAA,GAC1B,IAAI,UAAA,CAAW,CAAC,CAAA;AACtB,IAAA,GAAA,GACE,OAAO,MAAA,CAAO,GAAA,KAAQ,QAAA,GAClB,eAAA,CAAgB,OAAO,GAAG,CAAA,GAC1B,IAAI,UAAA,CAAW,CAAC,CAAA;AAAA,EACxB,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,SAAS,WAAW,CAAA;AAAA,EAChC;AACA,EAAA,IAAI,EAAA,CAAG,WAAW,EAAA,IAAM,GAAA,CAAI,WAAW,EAAA,EAAI,MAAM,IAAI,QAAA,CAAS,WAAW,CAAA;AACzE,EAAA,MAAM,GAAA,GAAM,MAAM,YAAA,CAAa,MAAA,CAAO,GAAG,CAAA;AACzC,EAAA,MAAM,IAAA,GAAO,MAAM,aAAA,CAAc,SAAS,CAAA;AAC1C,EAAA,MAAM,CAAA,GAAI,MAAM,YAAA,CAAa,IAAA,EAAM,GAAG,CAAA;AACtC,EAAA,MAAM,GAAA,GAAM,MAAM,SAAA,CAAU,CAAA,EAAG,UAAU,GAAG,CAAA,EAAG,GAAA,EAAK,GAAA,EAAK,GAAG,CAAA;AAC5D,EAAA,MAAM,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,UAAU,KAAA,EAAO,GAAA,EAAK,WAAW,KAAA,EAAO;AAAA,IACtE;AAAA,GACD,CAAA;AACD,EAAA,IAAI,KAAA;AACJ,EAAA,IAAI;AACF,IAAA,KAAA,GAAQ,IAAI,UAAA;AAAA,MACV,MAAM,OAAO,MAAA,CAAO,OAAA;AAAA,QAClB,EAAE,MAAM,SAAA,EAAW,EAAA,EAAI,gBAAgB,IAAA,CAAK,CAAC,CAAA,EAAG,SAAA,EAAW,GAAA,EAAI;AAAA,QAC/D,GAAA;AAAA,QACA,WAAA,CAAY,YAAY,GAAG;AAAA;AAC7B,KACF;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,SAAS,gBAAgB,CAAA;AAAA,EACrC;AACA,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI;AACF,IAAA,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,QAAA,CAAS,KAAK,CAAC,CAAA;AAAA,EACtC,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,SAAS,WAAW,CAAA;AAAA,EAChC;AACA,EAAA,IAAI,CAAC,QAAA,CAAS,OAAO,GAAG,MAAM,IAAI,SAAS,WAAW,CAAA;AACtD,EAAA,OAAO,OAAA;AACT;;;ACnOO,IAAM,oBAAA,GAAuB;AAE7B,IAAM,uBAAA,GAA0B;AAEhC,IAAM,wBAAA,GAA8C;AAEpD,IAAM,+BAAA,GAA0C;AAEhD,IAAM,sBAAA,GAAyB;AAC/B,IAAM,oBAAA,GAAuB;AAE7B,IAAM,4BAA4B,EAAA,GAAK;AAEvC,IAAM,2BAA2B,GAAA,GAAM;AAEvC,IAAM,+BAA+B,EAAA,GAAK;AAuBjD,IAAM,eAAA,GAAmD;AAAA,EACvD,iBAAA,EAAmB,8CAAA;AAAA,EACnB,UAAA,EAAY,sDAAA;AAAA,EACZ,qBAAA,EACE,gEAAA;AAAA,EACF,gBAAA,EAAkB,wCAAA;AAAA,EAClB,WAAA,EAAa,6DAAA;AAAA,EACb,aAAA,EAAe,wCAAA;AAAA,EACf,OAAA,EAAS,0BAAA;AAAA,EACT,mBAAA,EACE,2DAAA;AAAA,EACF,yBAAA,EACE,0DAAA;AAAA,EACF,qBAAA,EACE,kEAAA;AAAA,EACF,iBAAA,EACE,8DAAA;AAAA,EACF,sBAAA,EACE,uDAAA;AAAA,EACF,kBAAA,EAAoB,+CAAA;AAAA,EACpB,iBAAA,EAAmB,mDAAA;AAAA,EACnB,YAAA,EAAc,oCAAA;AAAA,EACd,cAAA,EAAgB;AAClB,CAAA;AAgBO,IAAM,WAAA,GAAN,cAA0B,mBAAA,CAAoB;AAAA;AAAA,EAG1C,WAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,WAAA;AAAA,EACT,WAAA,CACE,IAAA,EACA,WAAA,EACA,KAAA,GAAsE,EAAC,EACvE;AACA,IAAA,KAAA,CAAM,IAAA,EAAM,eAAA,CAAgB,IAAI,CAAC,CAAA;AACjC,IAAA,IAAI,WAAA,KAAgB,MAAA,EAAW,IAAA,CAAK,WAAA,GAAc,WAAA;AAClD,IAAA,IAAI,KAAA,CAAM,OAAA,KAAY,MAAA,EAAW,IAAA,CAAK,UAAU,KAAA,CAAM,OAAA;AACtD,IAAA,IAAI,KAAA,CAAM,WAAA,KAAgB,MAAA,EAAW,IAAA,CAAK,cAAc,KAAA,CAAM,WAAA;AAAA,EAChE;AACF;AAEA,SAAS,YAAY,OAAA,EAAwB;AAC3C,EAAA,MAAM,IAAI,WAAA,CAAY,qBAAA,EAAuB,MAAA,EAAW,EAAE,SAAS,CAAA;AACrE;AAEA,SAAS,SAAA,GAAmB;AAC1B,EAAA,MAAM,IAAI,YAAY,mBAAmB,CAAA;AAC3C;AA2BA,IAAM,QAAA,GAAW,kBAAA;AAEjB,IAAM,mCAAmB,IAAI,GAAA,CAAI,CAAC,KAAA,EAAO,SAAA,EAAW,KAAK,CAAC,CAAA;AAE1D,IAAM,eAAA,uBAAsB,GAAA,CAAI;AAAA,EAC9B,KAAA;AAAA,EACA,KAAA;AAAA,EACA,KAAA;AAAA,EACA,eAAA;AAAA,EACA,UAAA;AAAA,EACA,KAAA;AAAA,EACA;AACF,CAAC,CAAA;AAED,SAAS,cAAc,CAAA,EAAqB;AAC1C,EAAA,OACE,OAAO,CAAA,KAAM,QAAA,IACb,CAAA,KAAM,IAAA,IACL,OAAO,CAAA,KAAM,QAAA,IAAY,MAAA,CAAO,aAAA,CAAc,CAAC,CAAA,IAAK,CAAA,IAAK,CAAA;AAE9D;AAEA,SAAS,cAAc,CAAA,EAA4B;AACjD,EAAA,IAAI,CAAC,QAAA,CAAS,CAAC,CAAA,EAAG,SAAA,EAAU;AAE5B,EAAA,IAAI,CAAA,CAAE,EAAA,KAAO,MAAA,KAAc,OAAO,CAAA,CAAE,EAAA,KAAO,QAAA,IAAY,CAAC,QAAA,CAAS,IAAA,CAAK,CAAA,CAAE,EAAE,CAAA,CAAA;AACxE,IAAA,SAAA,EAAU;AACZ,EAAA,MAAM,OAAO,CAAA,CAAE,IAAA;AACf,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,IAAK,IAAA,CAAK,MAAA,KAAW,CAAA,IAAK,CAAC,IAAA,CAAK,KAAA,CAAM,aAAa,CAAA;AACxE,IAAA,SAAA,EAAU;AACZ,EAAA,IAAI,KAAK,MAAA,KAAW,CAAA,IAAK,OAAO,IAAA,CAAK,CAAC,CAAA,KAAM,QAAA;AAC1C,IAAA,WAAA,CAAY,aAAa,CAAA;AAC3B,EAAA,MAAM,IAAA,GAAO,KAAK,CAAC,CAAA;AACnB,EAAA,IAAI,KAAK,MAAA,KAAW,CAAA,IAAK,iBAAiB,GAAA,CAAI,IAAI,GAAG,SAAA,EAAU;AAC/D,EAAA,IAAI,eAAA,CAAgB,GAAA,CAAI,IAAI,CAAA,cAAe,kBAAkB,CAAA;AAC7D,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,CAAA,CAAE,WAAW,MAAA,EAAW;AAC1B,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,CAAA,CAAE,MAAM,KAAK,CAAA,CAAE,MAAA,CAAO,MAAA,KAAW,CAAA,EAAG,SAAA,EAAU;AACjE,IAAA,KAAA,MAAW,CAAA,IAAK,EAAE,MAAA,EAAQ;AACxB,MAAA,MAAM,EAAA,GACJ,OAAO,CAAA,KAAM,QAAA,IACb,OAAO,CAAA,KAAM,SAAA,IACZ,OAAO,CAAA,KAAM,QAAA,IAAY,MAAA,CAAO,SAAA,CAAU,CAAC,CAAA;AAC9C,MAAA,IAAI,CAAC,IAAI,SAAA,EAAU;AAAA,IACrB;AACA,IAAA,MAAA,GAAS,CAAA,CAAE,MAAA;AAAA,EACb;AAEA,EAAA,IAAI,IAAA,KAAS,SAAS,MAAA,IAAU,CAAC,OAAO,KAAA,CAAM,CAAA,CAAA,KAAK,OAAO,CAAA,KAAM,QAAQ,CAAA;AACtE,IAAA,SAAA,EAAU;AACZ,EAAA,OAAO;AAAA,IACL,GAAI,OAAO,CAAA,CAAE,EAAA,KAAO,QAAA,GAAW,EAAE,EAAA,EAAI,CAAA,CAAE,EAAA,EAAG,GAAI,EAAC;AAAA,IAC/C,IAAA,EAAM,CAAC,IAAI,CAAA;AAAA,IACX,GAAI,MAAA,GAAS,EAAE,MAAA,KAAW;AAAC,GAC7B;AACF;AAEA,SAAS,wBAAwB,CAAA,EAAiC;AAChE,EAAA,IAAI,CAAC,QAAA,CAAS,CAAC,CAAA,EAAG,SAAA,EAAU;AAC5B,EAAA,IAAI,OAAO,CAAA,CAAE,EAAA,KAAO,QAAA,IAAY,CAAC,SAAS,IAAA,CAAK,CAAA,CAAE,EAAE,CAAA,EAAG,SAAA,EAAU;AAChE,EAAA,IAAI,OAAO,CAAA,CAAE,MAAA,KAAW,QAAA,EAAU,SAAA,EAAU;AAC5C,EAAA,IAAI,EAAE,QAAA,KAAa,MAAA,IAAa,OAAO,CAAA,CAAE,QAAA,KAAa,WAAW,SAAA,EAAU;AAC3E,EAAA,IACE,CAAA,CAAE,oCAAA,KAAyC,MAAA,IAC3C,OAAO,EAAE,oCAAA,KAAyC,SAAA;AAElD,IAAA,SAAA,EAAU;AACZ,EAAA,MAAM,OAAO,CAAA,CAAE,IAAA;AACf,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,WAAA,EAAa,WAAA,CAAY,QAAQ,CAAA;AAClD,EAAA,IACE,CAAC,QAAA,CAAS,IAAI,CAAA,IACd,CAAC,MAAM,OAAA,CAAQ,IAAA,CAAK,UAAU,CAAA,IAC9B,IAAA,CAAK,UAAA,CAAW,WAAW,CAAA,IAC3B,CAAC,IAAA,CAAK,UAAA,CAAW,KAAA,CAAM,CAAA,CAAA,KAAK,OAAO,CAAA,KAAM,QAAA,IAAY,CAAA,CAAE,MAAA,GAAS,CAAC,CAAA,EACjE;AACA,IAAA,SAAA,EAAU;AAAA,EACZ;AACA,EAAA,IAAI,CAAA,CAAE,UAAA,KAAe,MAAA,EAAW,WAAA,CAAY,YAAY,CAAA;AACxD,EAAA,IAAI,CAAA,CAAE,mBAAA,KAAwB,MAAA,EAAW,WAAA,CAAY,qBAAqB,CAAA;AAC1E,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,CAAA,CAAE,WAAW,MAAA,EAAW;AAC1B,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,CAAA,CAAE,MAAM,KAAK,CAAA,CAAE,MAAA,CAAO,MAAA,KAAW,CAAA,EAAG,SAAA,EAAU;AACjE,IAAA,IAAI,CAAA,CAAE,MAAA,CAAO,MAAA,GAAS,oBAAA,cAAkC,iBAAiB,CAAA;AACzE,IAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAC7B,IAAA,MAAA,GAAS,EAAC;AACV,IAAA,KAAA,MAAW,GAAA,IAAO,EAAE,MAAA,EAAQ;AAC1B,MAAA,MAAM,KAAA,GAAQ,cAAc,GAAG,CAAA;AAE/B,MAAA,IAAI,KAAK,GAAA,CAAI,KAAA,CAAM,IAAA,CAAK,CAAC,CAAC,CAAA,EAAG;AAC7B,MAAA,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,IAAA,CAAK,CAAC,CAAC,CAAA;AACtB,MAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,IACnB;AAAA,EACF;AACA,EAAA,OAAO;AAAA,IACL,IAAI,CAAA,CAAE,EAAA;AAAA,IACN,MAAA,EAAQ,WAAA;AAAA,IACR,MAAM,EAAE,UAAA,EAAY,CAAC,GAAI,IAAA,CAAK,UAAuB,CAAA,EAAE;AAAA,IACvD,GAAI,MAAA,GAAS,EAAE,MAAA,KAAW,EAAC;AAAA,IAC3B,GAAI,OAAO,CAAA,CAAE,oCAAA,KAAyC,SAAA,GAClD;AAAA,MACE,sCACE,CAAA,CAAE;AAAA,QAEN,EAAC;AAAA,IACL,GAAI,OAAO,CAAA,CAAE,QAAA,KAAa,SAAA,GAAY,EAAE,QAAA,EAAU,CAAA,CAAE,QAAA,EAAS,GAAI;AAAC,GACpE;AACF;AASO,SAAS,aAAa,IAAA,EAA0B;AACrD,EAAA,IAAI,CAAC,QAAA,CAAS,IAAI,CAAA,EAAG,SAAA,EAAU;AAC/B,EAAA,MAAM,QAAQ,IAAA,CAAK,WAAA;AACnB,EAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,KAAK,KAAK,KAAA,CAAM,MAAA,KAAW,GAAG,SAAA,EAAU;AAC3D,EAAA,IAAI,KAAA,CAAM,MAAA,GAAS,sBAAA,EAAwB,WAAA,CAAY,kBAAkB,CAAA;AACzE,EAAA,MAAM,WAAA,GAAc,KAAA,CAAM,GAAA,CAAI,uBAAuB,CAAA;AACrD,EAAA,MAAM,GAAA,GAAM,WAAA,CAAY,GAAA,CAAI,CAAA,CAAA,KAAK,EAAE,EAAE,CAAA;AACrC,EAAA,IAAI,IAAI,GAAA,CAAI,GAAG,EAAE,IAAA,KAAS,GAAA,CAAI,QAAQ,SAAA,EAAU;AAChD,EAAA,IAAI,IAAA,CAAK,eAAA,KAAoB,MAAA,EAAW,WAAA,CAAY,iBAAiB,CAAA;AACrE,EAAA,OAAO,EAAE,WAAA,EAAY;AACvB;AAEA,SAAS,aAAa,KAAA,EAAkD;AACtE,EAAA,MAAM,GAAA,GAAM,MAAM,MAAA,EAAQ,IAAA,CAAK,OAAK,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,KAAM,KAAK,CAAA;AACvD,EAAA,OAAO,GAAA,EAAK,MAAA;AACd;AAEA,SAAS,gBAAgB,KAAA,EAA8C;AACrE,EAAA,OAAA,CAAQ,KAAA,CAAM,MAAA,IAAU,EAAC,EAAG,MAAA,CAAO,OAAK,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,KAAM,KAAK,CAAA;AAC7D;AAGO,SAAS,cAAc,IAAA,EAAmC;AAC/D,EAAA,OAAO,YAAA,CAAa,IAAI,CAAA,CAAE,WAAA,CAAY,IAAI,CAAA,CAAA,KAAK;AAC7C,IAAA,MAAM,OAAA,GAAU,aAAa,CAAC,CAAA;AAC9B,IAAA,OAAO;AAAA,MACL,IAAI,CAAA,CAAE,EAAA;AAAA,MACN,SAAA,EAAW,CAAC,GAAG,CAAA,CAAE,KAAK,UAAU,CAAA;AAAA,MAChC,MAAA,EAAQ,gBAAgB,CAAC,CAAA,CAAE,IAAI,CAAA,CAAA,KAAK,CAAA,CAAE,IAAA,CAAK,CAAC,CAAC,CAAA;AAAA,MAC7C,GAAI,UAAU,EAAE,OAAA,EAAS,CAAC,GAAG,OAAO,CAAA,EAAE,GAAI;AAAC,KAC7C;AAAA,EACF,CAAC,CAAA;AACH;AAcA,SAAS,YAAA,CACP,OACA,MAAA,EACS;AACT,EAAA,OAAO,WAAW,MAAA,IAAa,MAAA,CAAO,IAAA,CAAK,CAAA,CAAA,KAAK,MAAM,KAAK,CAAA;AAC7D;AASO,SAAS,eAAA,CACd,OACA,MAAA,EACa;AACb,EAAA,IAAI,CAAA;AACJ,EAAA,IAAI;AACF,IAAA,CAAA,GAAI,wBAAwB,KAAK,CAAA;AAAA,EACnC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,mBAAA,EAAoB;AAAA,EAClD;AACA,EAAA,MAAM,GAAA,GAAM,OAAO,MAAA,CAAO,GAAA;AAC1B,EAAA,IAAI,GAAA,KAAQ,eAAe,GAAA,KAAQ,WAAA;AACjC,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,cAAA,EAAe;AAC7C,EAAA,MAAM,EAAE,SAAQ,GAAI,MAAA;AACpB,EAAA,IACE,OAAO,OAAA,CAAQ,GAAA,KAAQ,QAAA,IACvB,CAAC,CAAA,CAAE,IAAA,CAAK,UAAA,CAAW,QAAA,CAAS,OAAA,CAAQ,GAAG,CAAA,EACvC;AACA,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,YAAA,EAAa;AAAA,EAC3C;AACA,EAAA,MAAM,OAAA,GAAU,aAAa,CAAC,CAAA;AAC9B,EAAA,IACE,OAAA,KACC,OAAO,OAAA,CAAQ,GAAA,KAAQ,QAAA,IAAY,CAAC,OAAA,CAAQ,QAAA,CAAS,OAAA,CAAQ,GAAG,CAAA,CAAA,EACjE;AACA,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,kBAAA,EAAmB;AAAA,EACjD;AACA,EAAA,MAAM,MAAM,OAAA,CAAQ,GAAA;AACpB,EAAA,IAAI,CAAC,QAAA,CAAS,GAAG,KAAK,CAAC,QAAA,CAAS,IAAI,GAAG,CAAA;AACrC,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,mBAAA,EAAoB;AAClD,EAAA,MAAM,aAAa,IAAI,GAAA;AAAA,IACrB,MAAM,OAAA,CAAQ,OAAA,CAAQ,GAAG,CAAA,GAAK,OAAA,CAAQ,MAAoB;AAAC,GAC7D;AACA,EAAA,MAAM,SAAS,IAAI,GAAA;AAAA,IACjB,OAAO,WAAA,CACJ,MAAA,CAAO,OAAK,CAAA,CAAE,IAAA,KAAS,QAAQ,UAAA,CAAW,GAAA,CAAI,EAAE,MAAM,CAAC,EACvD,GAAA,CAAI,CAAA,CAAA,KAAK,CAAC,CAAA,CAAE,IAAA,EAAgB,CAAC,CAAC;AAAA,GACnC;AACA,EAAA,MAAM,WAAqB,EAAC;AAC5B,EAAA,KAAA,MAAW,KAAA,IAAS,eAAA,CAAgB,CAAC,CAAA,EAAG;AACtC,IAAA,MAAM,IAAA,GAAO,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA;AACzB,IAAA,MAAM,EAAA,GAAK,MAAA,CAAO,GAAA,CAAI,IAAI,CAAA;AAC1B,IAAA,IAAI,EAAA,EAAI;AACN,MAAA,IAAI,CAAC,YAAA,CAAa,EAAA,CAAG,KAAA,EAAO,MAAM,MAAM,CAAA;AACtC,QAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,gBAAA,EAAiB;AAC/C,MAAA,QAAA,CAAS,KAAK,IAAI,CAAA;AAAA,IACpB,CAAA,MAAA,IAAW,MAAA,CAAO,MAAA,CAAO,OAAA,EAAS,IAAI,CAAA,EAAG;AACvC,MAAA,IAAI,CAAC,YAAA,CAAa,OAAA,CAAQ,IAAI,CAAA,EAAG,KAAA,CAAM,MAAM,CAAA,EAAG;AAC9C,QAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,gBAAA,EAAiB;AAAA,MAC/C;AAAA,IACF,CAAA,MAAO;AACL,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,eAAA,EAAgB;AAAA,IAC9C;AAAA,EACF;AACA,EAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,QAAA,EAAS;AAC9B;AAMO,SAAS,uBAAA,GAGb;AACD,EAAA,OAAO,mBAAA,CAAoB,CAAA,IAAA,EAAO,WAAA,CAAY,CAAC,CAAC,CAAA,CAAE,CAAA;AACpD;AA4BA,IAAM,QAAA,GAAW,oBAAA;AAGjB,eAAsB,2BACpB,KAAA,EACiB;AACjB,EAAA,IACE,UAAA,CAAW,KAAA,CAAM,MAAA,CAAO,GAAG,CAAA,KAAM,KAAA,CAAM,SAAA,IACvC,CAAC,KAAA,CAAM,MAAA,CAAO,GAAA,CAAI,QAAA,CAAS,GAAG,CAAA,EAC9B;AACA,IAAA,MAAM,IAAI,YAAY,aAAa,CAAA;AAAA,EACrC;AACA,EAAA,IACE,CAAC,cAAA,CAAe,KAAA,CAAM,WAAA,EAAa;AAAA,IACjC,SAAA,EAAW,MAAM,SAAA,IAAa,KAAA;AAAA,IAC9B,UAAA,EAAY,MAAM,UAAA,IAAc;AAAA,GACjC,CAAA,EACD;AACA,IAAA,MAAM,IAAI,YAAY,uBAAuB,CAAA;AAAA,EAC/C;AACA,EAAA,IAAI,CAAC,QAAA,CAAS,IAAA,CAAK,KAAA,CAAM,KAAK,KAAK,KAAA,CAAM,KAAA,CAAM,MAAA,GAAS,EAAA,EAAI,SAAA,EAAU;AACtE,EAAA,IAAI,OAAO,MAAM,KAAA,KAAU,QAAA,IAAY,CAAC,QAAA,CAAS,IAAA,CAAK,MAAM,KAAK,CAAA;AAC/D,IAAA,SAAA,EAAU;AACZ,EAAA,MAAM,IAAA,GAAO,YAAA,CAAa,KAAA,CAAM,IAAI,CAAA;AACpC,EAAA,MAAM,GAAA,GAAM,SAAA,CAAU,OAAA,CAAQ,KAAA,CAAM,GAAG,CAAC,CAAA;AACxC,EAAA,IAAI,CAAC,OAAO,aAAA,CAAc,KAAA,CAAM,GAAG,CAAA,IAAK,KAAA,CAAM,GAAA,IAAO,GAAA,EAAK,SAAA,EAAU;AACpE,EAAA,MAAM,MAAM,KAAA,CAAM,qBAAA;AAClB,EAAA,IACE,GAAA,KAAQ,WACP,CAAC,eAAA,CAAgB,GAAG,CAAA,IAAK,OAAO,GAAA,CAAI,GAAA,KAAQ,QAAA,CAAA,EAC7C;AACA,IAAA,MAAM,IAAI,YAAY,wBAAwB,CAAA;AAAA,EAChD;AACA,EAAA,MAAM,cAAA,GAA6B;AAAA,IACjC,oBAAA,EAAsB;AAAA,MACpB,WAAA,EAAa;AAAA;AAAA,QAEX,mBAAA,EAAqB,CAAC,SAAA,EAAW,OAAO,CAAA;AAAA,QACxC,mBAAA,EAAqB,CAAC,SAAA,EAAW,OAAO;AAAA;AAC1C,KACF;AAAA,IACA,GAAI,GAAA,GACA;AAAA,MACE,IAAA,EAAM,EAAE,IAAA,EAAM,CAAC,EAAE,GAAG,GAAA,EAAK,GAAA,EAAK,KAAA,EAAO,GAAA,EAAK,SAAA,EAAW,CAAA,EAAE;AAAA,MACvD,uCAAA,EAAyC;AAAA,QACvC,GAAG;AAAA;AACL,QAEF;AAAC,GACP;AACA,EAAA,OAAO,OAAA;AAAA,IACL,EAAE,KAAK,OAAA,EAAS,GAAA,EAAK,oBAAoB,GAAA,EAAK,KAAA,CAAM,OAAO,GAAA,EAAI;AAAA,IAC/D;AAAA,MACE,GAAA,EAAK,oBAAA;AAAA,MACL,SAAA,EAAW,CAAA,EAAG,gBAAgB,CAAA,EAAG,MAAM,SAAS,CAAA,CAAA;AAAA,MAChD,aAAA,EAAe,UAAA;AAAA,MACf,aAAA,EAAe,MAAM,iBAAA,GAAoB,aAAA;AAAA,MACzC,cAAc,KAAA,CAAM,WAAA;AAAA,MACpB,OAAO,KAAA,CAAM,KAAA;AAAA,MACb,OAAO,KAAA,CAAM,KAAA;AAAA,MACb,UAAA,EAAY,IAAA;AAAA,MACZ,eAAA,EAAiB,cAAA;AAAA,MACjB,GAAA;AAAA,MACA,KAAK,KAAA,CAAM;AAAA,KACb;AAAA,IACA,KAAA,CAAM;AAAA,GACR;AACF;AAWA,IAAM,sBAAA,GAAyB,IAAA;AAQxB,SAAS,gBAAgB,KAAA,EAIrB;AACT,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,IAAU,cAAA;AAC/B,EAAA,IAAI,OAAO,KAAA,CAAM,QAAA,KAAa,QAAA,IAAY,KAAA,CAAM,SAAS,MAAA,KAAW,CAAA;AAClE,IAAA,MAAM,IAAI,UAAU,sBAAsB,CAAA;AAC5C,EAAA,IAAI,UAAA;AACJ,EAAA,IAAI;AACF,IAAA,UAAA,GAAa,IAAI,GAAA,CAAI,KAAA,CAAM,UAAU,CAAA;AAAA,EACvC,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,UAAU,oCAAoC,CAAA;AAAA,EAC1D;AACA,EAAA,IAAI,UAAA,CAAW,QAAA,KAAa,QAAA,IAAY,UAAA,CAAW,QAAA,KAAa,OAAA;AAC9D,IAAA,MAAM,IAAI,UAAU,mCAAmC,CAAA;AACzD,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI,gCAAA,CAAiC,IAAA,CAAK,MAAM,CAAA,EAAG;AACjD,IAAA,MAAM,IAAA,GAAO,OAAO,KAAA,CAAM,CAAA,EAAG,OAAO,OAAA,CAAQ,GAAG,CAAC,CAAA,CAAE,WAAA,EAAY;AAC9D,IAAA,IACE,CAAC,cAAc,MAAA,EAAQ,UAAA,EAAY,QAAQ,MAAA,EAAQ,MAAM,CAAA,CAAE,QAAA,CAAS,IAAI,CAAA;AAExE,MAAA,MAAM,IAAI,UAAU,gDAAgD,CAAA;AACtE,IAAA,IAAA,GAAO,MAAA;AAAA,EACT,CAAA,MAAO;AACL,IAAA,IAAI,CAAA;AACJ,IAAA,IAAI;AACF,MAAA,CAAA,GAAI,IAAI,IAAI,MAAM,CAAA;AAAA,IACpB,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,IAAI,UAAU,gDAAgD,CAAA;AAAA,IACtE;AACA,IAAA,IAAI,CAAA,CAAE,QAAA,KAAa,QAAA,IAAY,CAAA,CAAE,UAAU,CAAA,CAAE,IAAA;AAC3C,MAAA,MAAM,IAAI,UAAU,gDAAgD,CAAA;AACtE,IAAA,IAAA,GAAO,CAAA,CAAE,IAAA;AAAA,EACX;AACA,EAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB;AAAA,IACjC,WAAW,KAAA,CAAM,QAAA;AAAA,IACjB,aAAa,KAAA,CAAM;AAAA,GACpB,CAAA;AACD,EAAA,OAAO,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,MAAA,CAAO,UAAU,CAAA,CAAA;AACrC;AAYO,SAAS,eAAA,CACd,IAAA,EACA,IAAA,GAAmB,EAAC,EACR;AACZ,EAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,IAAA,CAAK,MAAA,GAAS,sBAAA;AAC5C,IAAA,SAAA,EAAU;AACZ,EAAA,MAAM,CAAA,GAAI,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC1B,EAAA,IAAI,CAAA,GAAI,GAAG,SAAA,EAAU;AACrB,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,CAAA,GAAI,CAAC,EAAE,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,IAAK,EAAA;AACjD,EAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB,KAAK,CAAA;AACxC,EAAA,IAAI,MAAA,CAAO,GAAA,CAAI,SAAS,CAAA,cAAe,SAAS,CAAA;AAChD,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,MAAA,CAAO,oBAAoB,CAAA;AACjD,EAAA,IAAI,MAAA,CAAO,SAAS,CAAA,IAAM,MAAA,CAAO,WAAW,CAAA,IAAK,MAAA,CAAO,CAAC,CAAA,KAAM,KAAA,EAAQ;AACrE,IAAA,IAAI,MAAA,CAAO,CAAC,CAAA,KAAM,MAAA,cAAoB,oBAAoB,CAAA;AAC1D,IAAA,SAAA,EAAU;AAAA,EACZ;AACA,EAAA,MAAM,SAAA,GAAY,MAAA,CAAO,MAAA,CAAO,WAAW,CAAA;AAC3C,EAAA,MAAM,WAAA,GAAc,MAAA,CAAO,MAAA,CAAO,aAAa,CAAA;AAC/C,EAAA,IAAI,UAAU,MAAA,KAAW,CAAA,IAAK,WAAA,CAAY,MAAA,KAAW,GAAG,SAAA,EAAU;AAClE,EAAA,MAAM,QAAA,GAAW,UAAU,CAAC,CAAA;AAC5B,EAAA,MAAM,UAAA,GAAa,YAAY,CAAC,CAAA;AAChC,EAAA,IAAI,QAAA,CAAS,MAAA,KAAW,CAAA,EAAG,SAAA,EAAU;AACrC,EAAA,IACE,CAAC,eAAe,UAAA,EAAY;AAAA,IAC1B,SAAA,EAAW,KAAK,SAAA,IAAa,KAAA;AAAA,IAC7B,UAAA,EAAY,KAAK,UAAA,IAAc;AAAA,GAChC,CAAA;AAED,IAAA,SAAA,EAAU;AACZ,EAAA,OAAO,EAAE,UAAU,UAAA,EAAW;AAChC;AAwCA,SAAS,WAAA,CACP,MAAA,EACA,OAAA,EACA,gBAAA,EACQ;AACR,EAAA,IAAI,OAAO,GAAA,KAAQ,kBAAA,EAAoB,MAAM,IAAI,YAAY,YAAY,CAAA;AACzE,EAAA,IAAI,CAAC,gBAAgB,MAAA,CAAO,GAAG,GAAG,MAAM,IAAI,YAAY,eAAe,CAAA;AACvE,EAAA,MAAM,WAAW,OAAA,CAAQ,SAAA;AACzB,EAAA,IAAI,OAAO,QAAA,KAAa,QAAA,IAAY,CAAC,QAAA,CAAS,UAAA,CAAW,gBAAgB,CAAA,EAAG;AAC1E,IAAA,MAAM,IAAI,YAAY,uBAAuB,CAAA;AAAA,EAC/C;AACA,EAAA,IAAI,gBAAA,KAAqB,UAAa,QAAA,KAAa,gBAAA;AACjD,IAAA,SAAA,EAAU;AACZ,EAAA,MAAM,SAAA,GAAY,QAAA,CAAS,KAAA,CAAM,gBAAA,CAAiB,MAAM,CAAA;AACxD,EAAA,IAAI,CAAC,sBAAsB,IAAA,CAAK,SAAS,KAAK,SAAA,CAAU,QAAA,CAAS,GAAG,CAAA,EAAG;AACrE,IAAA,MAAM,IAAI,YAAY,uBAAuB,CAAA;AAAA,EAC/C;AACA,EAAA,MAAM,MAAM,OAAO,MAAA,CAAO,GAAA,KAAQ,QAAA,GAAW,OAAO,GAAA,GAAM,EAAA;AAC1D,EAAA,MAAM,WAAA,GAAc,IAAI,UAAA,CAAW,GAAG,IAAI,CAAA,EAAG,SAAS,CAAA,EAAG,GAAG,CAAA,CAAA,GAAK,GAAA;AACjE,EAAA,IAAI,UAAA,CAAW,WAAW,CAAA,KAAM,SAAA,IAAa,CAAC,WAAA,CAAY,QAAA,CAAS,GAAG,CAAA,EAAG;AACvE,IAAA,MAAM,IAAI,YAAY,aAAa,CAAA;AAAA,EACrC;AACA,EAAA,OAAO,EAAE,QAAA,EAAU,SAAA,EAAW,GAAA,EAAK,WAAA,EAAY;AACjD;AAGA,SAAS,UAAA,CAAW,SAAqB,IAAA,EAAiC;AACxE,EAAA,MAAM,EAAE,GAAA,EAAK,GAAA,EAAK,GAAA,EAAI,GAAI,OAAA;AAC1B,EAAA,IAAI,GAAA,KAAQ,WAAc,OAAO,GAAA,KAAQ,YAAY,CAAC,MAAA,CAAO,SAAS,GAAG,CAAA,CAAA;AACvE,IAAA,SAAA,EAAU;AACZ,EAAA,IAAI,GAAA,KAAQ,WAAc,OAAO,GAAA,KAAQ,YAAY,CAAC,MAAA,CAAO,SAAS,GAAG,CAAA,CAAA;AACvE,IAAA,SAAA,EAAU;AACZ,EAAA,IAAI,GAAA,KAAQ,MAAA,IAAa,IAAA,CAAK,aAAA,EAAe,SAAA,EAAU;AAEvD,EAAA,IAAI,GAAA,KAAQ,MAAA,IAAa,GAAA,KAAQ,oBAAA,EAAsB,SAAA,EAAU;AACjE,EAAA,IAAI,IAAA,CAAK,SAAS,IAAA,EAAM;AACxB,EAAA,MAAM,OAAO,IAAA,CAAK,IAAA;AAClB,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,IAAA,GAAO,GAAA,GAAM,YAAA;AAC1C,IAAA,MAAM,IAAI,YAAY,SAAS,CAAA;AACjC,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,GAAM,IAAA,GAAO,cAAc,SAAA,EAAU;AACpE,EAAA,IAAI,OAAO,QAAQ,QAAA,EAAU;AAC3B,IAAA,MAAM,IAAA,GAAO,OAAO,GAAA,KAAQ,QAAA,GAAW,GAAA,GAAM,IAAA;AAC7C,IAAA,IAAI,GAAA,GAAM,IAAA,GAAO,4BAAA,GAA+B,YAAA,EAAc,SAAA,EAAU;AAAA,EAC1E;AACF;AAEA,SAAS,iBACP,IAAA,EAC4C;AAC5C,EAAA,IAAI,CAAC,QAAA,CAAS,IAAI,CAAA,EAAG,OAAO,IAAA;AAC5B,EAAA,MAAM,UAAU,IAAA,CAAK,uCAAA;AACrB,EAAA,MAAM,IAAA,GACJ,OAAA,KAAY,MAAA,GACR,CAAC,+BAA+B,CAAA,GAChC,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,GACnB,OAAA,GACA,EAAC;AACT,EAAA,MAAM,MAAM,wBAAA,CAAyB,IAAA,CAAK,OAAK,IAAA,CAAK,QAAA,CAAS,CAAC,CAAC,CAAA;AAC/D,EAAA,MAAM,OAAO,QAAA,CAAS,IAAA,CAAK,IAAI,CAAA,GAAI,IAAA,CAAK,KAAK,IAAA,GAAO,MAAA;AAEpD,EAAA,MAAM,GAAA,GAAM,MAAM,OAAA,CAAQ,IAAI,IACzB,IAAA,CACE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,CACX,IAAA;AAAA,IACC,CAAC,CAAA,KACC,eAAA,CAAgB,CAAC,CAAA,IACjB,CAAA,CAAE,QAAQ,SAAA,KACT,CAAA,CAAE,QAAQ,MAAA,IAAa,OAAO,EAAE,GAAA,KAAQ,QAAA,CAAA,KACxC,EAAE,GAAA,KAAQ,MAAA,IAAa,EAAE,GAAA,KAAQ,KAAA;AAAA,GACtC,GACF,MAAA;AACJ,EAAA,IAAI,CAAC,OAAO,CAAC,QAAA,CAAS,GAAG,CAAA,IAAK,CAAC,KAAK,OAAO,IAAA;AAC3C,EAAA,OAAO;AAAA,IACL,GAAA,EAAK;AAAA,MACH,GAAA,EAAK,IAAA;AAAA,MACL,GAAA,EAAK,OAAA;AAAA,MACL,GAAG,GAAA,CAAI,CAAA;AAAA,MACP,GAAG,GAAA,CAAI,CAAA;AAAA,MACP,GAAI,OAAO,GAAA,CAAI,GAAA,KAAQ,QAAA,GAAW,EAAE,GAAA,EAAK,GAAA,CAAI,GAAA,EAAI,GAAI,EAAC;AAAA,MACtD,GAAA,EAAK,KAAA;AAAA,MACL,GAAA,EAAK;AAAA,KACP;AAAA,IACA;AAAA,GACF;AACF;AAMA,SAAS,YAAA,CACP,GAAA,EACA,IAAA,EACA,OAAA,EACA,IAAA,EACsB;AACtB,EAAA,MAAM,OAAO,OAAA,CAAQ,aAAA;AACrB,EAAA,IAAI,IAAA,KAAS,aAAA,IAAiB,IAAA,KAAS,iBAAA,EAAmB;AACxD,IAAA,MAAM,IAAI,YAAY,2BAA2B,CAAA;AAAA,EACnD;AACA,EAAA,MAAM,cAAc,OAAA,CAAQ,YAAA;AAC5B,EAAA,IAAI,OAAO,WAAA,KAAgB,QAAA,EAAU,SAAA,EAAU;AAC/C,EAAA,IACE,CAAC,eAAe,WAAA,EAAa;AAAA,IAC3B,SAAA,EAAW,KAAK,SAAA,IAAa,KAAA;AAAA,IAC7B,UAAA,EAAY,KAAK,UAAA,IAAc;AAAA,GAChC,CAAA,EACD;AACA,IAAA,MAAM,IAAI,YAAY,uBAAuB,CAAA;AAAA,EAC/C;AACA,EAAA,MAAM,QAAQ,OAAA,CAAQ,KAAA;AACtB,EAAA,IACE,KAAA,KAAU,WACT,OAAO,KAAA,KAAU,YAAY,CAAC,QAAA,CAAS,KAAK,KAAK,CAAA,CAAA;AAElD,IAAA,SAAA,EAAU;AAEZ,EAAA,MAAM,aACJ,IAAA,KAAS,iBAAA,GACL,gBAAA,CAAiB,OAAA,CAAQ,eAAe,CAAA,GACxC,IAAA;AACN,EAAA,MAAM,MAAA,GAAmC;AAAA,IACvC,UAAU,IAAA,CAAK,QAAA;AAAA,IACf,WAAA;AAAA,IACA,YAAA,EAAc,IAAA;AAAA,IACd,GAAI,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,KAAU,EAAC;AAAA,IACvC,GAAI,UAAA,GACA;AAAA,MACE,uBAAuB,UAAA,CAAW,GAAA;AAAA,MAClC,uBAAuB,UAAA,CAAW;AAAA,QAEpC;AAAC,GACP;AACA,EAAA,MAAM,SAAS,CAAC,IAAA,EAAuB,YACrC,IAAI,WAAA,CAAY,MAAM,MAAA,EAAW;AAAA,IAC/B,GAAI,OAAA,KAAY,MAAA,GAAY,EAAE,OAAA,KAAY,EAAC;AAAA,IAC3C,WAAA,EAAa;AAAA,GACd,CAAA;AAGH,EAAA,IAAI,IAAA,KAAS,qBAAqB,CAAC,UAAA;AACjC,IAAA,MAAM,OAAO,wBAAwB,CAAA;AAEvC,EAAA,IAAI,OAAA,CAAQ,YAAA,KAAiB,MAAA,EAAW,MAAM,OAAO,mBAAmB,CAAA;AACxE,EAAA,IAAI,QAAQ,aAAA,KAAkB,UAAA;AAC5B,IAAA,MAAM,MAAA,CAAO,uBAAuB,eAAe,CAAA;AACrD,EAAA,IAAI,QAAQ,gBAAA,KAAqB,MAAA;AAC/B,IAAA,MAAM,MAAA,CAAO,uBAAuB,kBAAkB,CAAA;AACxD,EAAA,IAAI,QAAQ,KAAA,KAAU,MAAA,EAAW,MAAM,MAAA,CAAO,uBAAuB,OAAO,CAAA;AAC5E,EAAA,MAAM,QAAQ,OAAA,CAAQ,KAAA;AACtB,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,QAAA,CAAS,KAAK,KAAK,CAAA;AACnD,IAAA,MAAM,OAAO,mBAAmB,CAAA;AAClC,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,YAAA,CAAa,QAAQ,UAAU,CAAA;AAAA,EACxC,SAAS,CAAA,EAAG;AACV,IAAA,IAAI,aAAa,WAAA,EAAa,MAAM,OAAO,CAAA,CAAE,IAAA,EAAM,EAAE,OAAO,CAAA;AAC5D,IAAA,MAAM,CAAA;AAAA,EACR;AACA,EAAA,OAAO;AAAA,IACL,GAAA;AAAA,IACA,UAAU,IAAA,CAAK,QAAA;AAAA,IACf,WAAW,IAAA,CAAK,SAAA;AAAA,IAChB,KAAK,IAAA,CAAK,GAAA;AAAA,IACV,WAAA;AAAA,IACA,YAAA,EAAc,IAAA;AAAA,IACd,KAAA;AAAA,IACA,GAAI,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,KAAU,EAAC;AAAA,IACvC,IAAA;AAAA,IACA,GAAI,UAAA,GACA;AAAA,MACE,uBAAuB,UAAA,CAAW,GAAA;AAAA,MAClC,uBAAuB,UAAA,CAAW;AAAA,QAEpC,EAAC;AAAA,IACL,GAAI,OAAO,OAAA,CAAQ,GAAA,KAAQ,QAAA,GAAW,EAAE,GAAA,EAAK,OAAA,CAAQ,GAAA,EAAI,GAAI,EAAC;AAAA,IAC9D,GAAI,OAAO,OAAA,CAAQ,GAAA,KAAQ,QAAA,GAAW,EAAE,GAAA,EAAK,OAAA,CAAQ,GAAA,EAAI,GAAI;AAAC,GAChE;AACF;AA4BA,eAAsB,0BAAA,CACpB,KACA,IAAA,EAC+B;AAC/B,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,CAAI,SAAS,yBAAA,EAA2B;AACrE,IAAA,SAAA,EAAU;AAAA,EACZ;AACA,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,SAAA,CAAU,GAAA,CAAI,IAAA,EAAM,CAAA;AAAA,EAC5B,CAAA,CAAA,MAAQ;AACN,IAAA,SAAA,EAAU;AAAA,EACZ;AACA,EAAA,MAAM,SAAA,GAAiC;AAAA,IACrC,SAAA,EAAW,KAAK,SAAA,IAAa,KAAA;AAAA,IAC7B,UAAA,EAAY,KAAK,UAAA,IAAc,KAAA;AAAA,IAC/B,IAAA,EAAM,SAAA,CAAU,OAAA,CAAQ,IAAA,CAAK,GAAG,CAAC,CAAA;AAAA,IACjC,aAAA,EAAe,KAAK,aAAA,IAAiB;AAAA,GACvC;AACA,EAAA,MAAM,OAAO,WAAA,CAAY,GAAA,CAAI,QAAQ,GAAA,CAAI,OAAA,EAAS,KAAK,gBAAgB,CAAA;AACvE,EAAA,UAAA,CAAW,GAAA,CAAI,SAAS,SAAS,CAAA;AACjC,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,IAAA,CAAK,QAAA,CAAS,IAAA,CAAK,SAAS,CAAA;AAAA,EAC1C,SAAS,CAAA,EAAG;AACV,IAAA,IAAI,CAAA,YAAa,qBAAqB,MAAM,CAAA;AAC5C,IAAA,MAAM,IAAI,YAAY,kBAAkB,CAAA;AAAA,EAC1C;AACA,EAAA,IAAI,CAAC,GAAA,EAAK,MAAM,IAAI,YAAY,kBAAkB,CAAA;AAClD,EAAA,MAAM,GAAA,GACJ,OAAA,CAAQ,GAAA,EAAK,IAAA,CAAK,GAAA,EAAK,gBAAgB,CAAA,IACvC,OAAA,CAAQ,GAAA,EAAK,IAAA,CAAK,GAAA,EAAK,iBAAiB,CAAA;AAC1C,EAAA,IAAI,CAAC,GAAA,EAAK,MAAM,IAAI,YAAY,aAAa,CAAA;AAC7C,EAAA,IAAI,CAAC,aAAA,CAAc,GAAA,CAAI,SAAA,EAAW,IAAA,CAAK,IAAI,YAAY,CAAA,EAAG,GAAA,CAAI,SAAS,CAAA,EAAG;AACxE,IAAA,MAAM,IAAI,YAAY,eAAe,CAAA;AAAA,EACvC;AACA,EAAA,OAAO,aAAa,GAAA,CAAI,IAAA,IAAQ,IAAA,EAAM,GAAA,CAAI,SAAS,SAAS,CAAA;AAC9D;AAMO,SAAS,6BAAA,CACd,GAAA,EACA,IAAA,GAAmB,EAAC,EACE;AACtB,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,SAAA,CAAU,GAAA,CAAI,IAAA,EAAM,CAAA;AAAA,EAC5B,CAAA,CAAA,MAAQ;AACN,IAAA,SAAA,EAAU;AAAA,EACZ;AACA,EAAA,MAAM,SAAA,GAAiC;AAAA,IACrC,SAAA,EAAW,KAAK,SAAA,IAAa,KAAA;AAAA,IAC7B,UAAA,EAAY,KAAK,UAAA,IAAc,KAAA;AAAA,IAC/B,IAAA,EAAM,IAAA;AAAA,IACN,aAAA,EAAe;AAAA,GACjB;AACA,EAAA,MAAM,OAAO,WAAA,CAAY,GAAA,CAAI,MAAA,EAAQ,GAAA,CAAI,SAAS,MAAS,CAAA;AAC3D,EAAA,UAAA,CAAW,GAAA,CAAI,SAAS,SAAS,CAAA;AACjC,EAAA,OAAO,aAAa,GAAA,CAAI,IAAA,IAAQ,IAAA,EAAM,GAAA,CAAI,SAAS,SAAS,CAAA;AAC9D;AAoBA,eAAsB,mBACpB,KAAA,EACiB;AACjB,EAAA,MAAM,MAAA,GAAS,UAAA,CAAW,KAAA,CAAM,KAAA,CAAM,MAAM,CAAA;AAC5C,EAAA,IAAI,OAAO,KAAA,KAAU,MAAA,EAAW,MAAM,IAAI,WAAW,WAAW,CAAA;AAChE,EAAA,MAAM,IAAA,GAAO,iBAAA,CAAkB,MAAA,EAAQ,KAAA,CAAM,QAAQ,CAAA;AACrD,EAAA,MAAM,IAAA,GAAO,cAAA,CAAe,MAAA,CAAO,GAAA,EAAK,IAAI,CAAA;AAC5C,EAAA,MAAM,KAAK,MAAM,OAAA;AAAA,IACf,EAAE,GAAA,EAAK,OAAA,EAAS,GAAA,EAAK,QAAA,EAAS;AAAA,IAC9B;AAAA,MACE,GAAA,EAAK,SAAA,CAAU,OAAA,CAAQ,KAAA,CAAM,GAAG,CAAC,CAAA;AAAA,MACjC,KAAK,KAAA,CAAM,QAAA;AAAA,MACX,OAAO,KAAA,CAAM,KAAA;AAAA,MACb,OAAA,EAAS,OAAO,IAAI;AAAA,KACtB;AAAA,IACA,KAAA,CAAM;AAAA,GACR;AACA,EAAA,OAAO,IAAA,GAAO,EAAA;AAChB;AAYA,SAAS,YAAA,CAAa,SAAkB,IAAA,EAAiC;AACvE,EAAA,IAAI,CAAC,QAAA,CAAS,OAAO,GAAG,MAAM,IAAI,YAAY,oBAAoB,CAAA;AAClE,EAAA,MAAM,GAAA,GAAM,IAAA,GAAO,IAAI,GAAA,CAAI,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,CAAA,CAAA,KAAK,CAAA,CAAE,EAAE,CAAC,CAAA,GAAI,IAAA;AAC9D,EAAA,MAAM,GAAA,mBAAM,MAAA,CAAO,MAAA,CAAO,IAAI,CAAA;AAC9B,EAAA,KAAA,MAAW,CAAC,EAAA,EAAI,IAAI,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAChD,IAAA,IAAI,GAAA,IAAO,CAAC,GAAA,CAAI,GAAA,CAAI,EAAE,CAAA,EAAG,MAAM,IAAI,WAAA,CAAY,oBAAoB,CAAA;AACnE,IAAA,IACE,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,IACnB,IAAA,CAAK,WAAW,CAAA,IAChB,CAAC,IAAA,CAAK,KAAA,CAAM,OAAK,OAAO,CAAA,KAAM,YAAY,CAAA,CAAE,MAAA,GAAS,CAAC,CAAA,EACtD;AACA,MAAA,MAAM,IAAI,YAAY,oBAAoB,CAAA;AAAA,IAC5C;AACA,IAAA,GAAA,CAAI,EAAE,CAAA,GAAI,CAAC,GAAI,IAAiB,CAAA;AAAA,EAClC;AACA,EAAA,IAAI,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,CAAE,MAAA,KAAW,CAAA;AAC9B,IAAA,MAAM,IAAI,YAAY,oBAAoB,CAAA;AAC5C,EAAA,OAAO,GAAA;AACT;AAEA,eAAe,QAAA,CACb,QACA,OAAA,EACiB;AACjB,EAAA,MAAM,MAAA,GAAS,IAAI,eAAA,EAAgB;AACnC,EAAA,MAAM,SAAA,GAAY;AAAA,IAChB,GAAG,OAAA;AAAA,IACH,GAAI,OAAO,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,EAAO,MAAA,CAAO,KAAA,EAAM,GAAI;AAAC,GAC9D;AACA,EAAA,IACE,MAAA,CAAO,YAAA,KAAiB,iBAAA,IACxB,MAAA,CAAO,qBAAA,EACP;AACA,IAAA,MAAA,CAAO,GAAA;AAAA,MACL,UAAA;AAAA,MACA,MAAM,UAAA;AAAA,QACJ,SAAA;AAAA,QACA,MAAA,CAAO,qBAAA;AAAA,QACP,OAAO,qBAAA,IAAyB;AAAA;AAClC,KACF;AAAA,EACF,CAAA,MAAO;AACL,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,CAAA,IAAK,MAAA,CAAO,QAAQ,SAAS,CAAA;AAC3C,MAAA,MAAA,CAAO,GAAA,CAAI,GAAG,OAAO,CAAA,KAAM,WAAW,CAAA,GAAI,IAAA,CAAK,SAAA,CAAU,CAAC,CAAC,CAAA;AAAA,EAC/D;AACA,EAAA,OAAO,OAAO,QAAA,EAAS;AACzB;AAOA,eAAsB,4BAA4B,KAAA,EAGf;AACjC,EAAA,MAAM,EAAE,OAAA,EAAAA,QAAAA,EAAQ,GAAI,KAAA;AACpB,EAAA,MAAM,OAAA,GAAU,YAAA,CAAa,KAAA,CAAM,OAAA,EAASA,SAAQ,IAAI,CAAA;AACxD,EAAA,IACEA,QAAAA,CAAQ,YAAA,KAAiB,iBAAA,IACzB,CAACA,QAAAA,CAAQ,qBAAA;AAET,IAAA,MAAM,IAAI,YAAY,wBAAwB,CAAA;AAChD,EAAA,OAAO;AAAA,IACL,KAAKA,QAAAA,CAAQ,WAAA;AAAA,IACb,MAAM,MAAM,QAAA,CAASA,UAAS,EAAE,QAAA,EAAU,SAAS,CAAA;AAAA,IACnD,WAAA,EAAa;AAAA,GACf;AACF;AAaA,IAAM,yBAAA,uBAAgC,GAAA,CAAY;AAAA,EAChD,iBAAA;AAAA,EACA,eAAA;AAAA,EACA,gBAAA;AAAA,EACA,eAAA;AAAA,EACA,0BAAA;AAAA,EACA,4BAAA;AAAA,EACA,0BAAA;AAAA,EACA;AACF,CAAC,CAAA;AAED,IAAM,iBAAA,GAAoB,wCAAA;AAMnB,SAAS,sBACd,CAAA,EAC+B;AAC/B,EAAA,IAAI,EAAE,CAAA,YAAa,WAAA,CAAA,IAAgB,CAAC,CAAA,CAAE,aAAa,OAAO,IAAA;AAC1D,EAAA,IAAI,CAAA,CAAE,SAAS,qBAAA,EAAuB;AACpC,IAAA,IAAI,CAAA,CAAE,OAAA,KAAY,kBAAA,EAAoB,OAAO,0BAAA;AAC7C,IAAA,IAAI,CAAA,CAAE,OAAA,KAAY,QAAA,EAAU,OAAO,0BAAA;AACnC,IAAA,IAAI,CAAA,CAAE,OAAA,KAAY,OAAA,EAAS,OAAO,eAAA;AAAA,EACpC;AACA,EAAA,OAAO,iBAAA;AACT;AAQA,eAAsB,iCAAiC,KAAA,EAIpB;AACjC,EAAA,IAAI,CAAC,yBAAA,CAA0B,GAAA,CAAI,KAAA,CAAM,KAAK,CAAA;AAC5C,IAAA,MAAM,IAAI,UAAU,sCAAsC,CAAA;AAC5D,EAAA,IACE,MAAM,gBAAA,KAAqB,MAAA,IAC3B,CAAC,iBAAA,CAAkB,IAAA,CAAK,MAAM,gBAAgB,CAAA;AAE9C,IAAA,MAAM,IAAI,SAAA;AAAA,MACR;AAAA,KACF;AACF,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,MAAM,MAAA,CAAO,WAAA;AAAA,IAClB,IAAA,EAAM,MAAM,QAAA,CAAS,KAAA,CAAM,MAAA,EAAQ;AAAA,MACjC,OAAO,KAAA,CAAM,KAAA;AAAA,MACb,GAAI,MAAM,gBAAA,KAAqB,MAAA,GAC3B,EAAE,iBAAA,EAAmB,KAAA,CAAM,gBAAA,EAAiB,GAC5C;AAAC,KACN,CAAA;AAAA,IACD,WAAA,EAAa;AAAA,GACf;AACF;AAmBA,eAAsB,uBACpB,KAAA,EAKC;AACD,EAAA,MAAM,MAAA,GAAS;AAAA,IACb,SAAA,EAAW,MAAM,SAAA,IAAa,KAAA;AAAA,IAC9B,UAAA,EAAY,MAAM,UAAA,IAAc;AAAA,GAClC;AACA,EAAA,IAAI,CAAC,cAAA,CAAe,KAAA,CAAM,MAAA,CAAO,aAAa,MAAM,CAAA;AAClD,IAAA,MAAM,IAAI,YAAY,uBAAuB,CAAA;AAC/C,EAAA,MAAM,GAAA,GAAM,MAAM,gCAAA,CAAiC,KAAK,CAAA;AACxD,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,MAAM,OAAA,CAAY,KAAA,CAAM,KAAA,EAAO,IAAI,GAAA,EAAK;AAAA,MAC/C,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,gBAAgB,GAAA,CAAI,WAAA;AAAA,QACpB,MAAA,EAAQ;AAAA,OACV;AAAA,MACA,MAAM,GAAA,CAAI,IAAA;AAAA,MACV,UAAU,EAAA,GAAK,IAAA;AAAA,MACf,GAAI,MAAM,SAAA,KAAc,KAAA,CAAA,GAAY,EAAE,SAAA,EAAW,KAAA,CAAM,SAAA,EAAU,GAAI;AAAC,KACvE,CAAA;AAAA,EACH,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAE,SAAA,EAAW,KAAA,EAAO,MAAA,EAAQ,IAAA,EAAK;AAAA,EAC1C;AACA,EAAA,IAAI,WAAA;AACJ,EAAA,IAAI,MAAA,CAAO,WAAW,GAAA,EAAK;AACzB,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAgB,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,IAAI,CAAA;AAC5C,MAAA,IACE,QAAA,CAAS,IAAI,CAAA,IACb,OAAO,KAAK,YAAA,KAAiB,QAAA;AAAA,MAE7B,cAAA,CAAe,KAAK,YAAA,CAAa,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,IAAK,EAAA,EAAI,MAAM,CAAA;AAE5D,QAAA,WAAA,GAAc,IAAA,CAAK,YAAA;AAAA,IACvB,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACA,EAAA,OAAO;AAAA,IACL,SAAA,EAAW,OAAO,MAAA,KAAW,GAAA;AAAA,IAC7B,QAAQ,MAAA,CAAO,MAAA;AAAA,IACf,GAAI,WAAA,KAAgB,MAAA,GAAY,EAAE,WAAA,KAAgB;AAAC,GACrD;AACF;AAiBA,eAAsB,0BAAA,CACpB,IAAA,EACA,IAAA,GAA2E,EAAC,EACtC;AACtC,EAAA,IAAI,IAAA,CAAK,OAAA,EAAS,YAAA,KAAiB,iBAAA,IAAqB,CAAC,IAAA,CAAK,aAAA;AAC5D,IAAA,MAAM,IAAI,SAAA;AAAA,MACR;AAAA,KACF;AACF,EAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,IAAA,CAAK,SAAS,wBAAA,EAA0B;AACtE,IAAA,MAAM,IAAI,YAAY,oBAAoB,CAAA;AAAA,EAC5C;AACA,EAAA,MAAM,SAAS,OAAO,IAAA,KAAS,WAAW,IAAI,eAAA,CAAgB,IAAI,CAAA,GAAI,IAAA;AACtE,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,GAAA,CAAI,OAAO,CAAA;AAChC,EAAA,IAAI,UAAU,IAAA,EAAM;AAClB,IAAA,MAAM,IAAI,WAAA,CAAY,cAAA,EAAgB,eAAA,CAAgB,KAAK,CAAC,CAAA;AAAA,EAC9D;AACA,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI,KAAA;AACJ,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,GAAA,CAAI,UAAU,CAAA;AACtC,EAAA,IAAI,KAAK,aAAA,EAAe;AACtB,IAAA,IAAI,QAAA,KAAa,IAAA,IAAQ,MAAA,CAAO,GAAA,CAAI,UAAU,CAAA,EAAG;AAC/C,MAAA,MAAM,IAAI,YAAY,oBAAoB,CAAA;AAAA,IAC5C;AACA,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACF,MAAA,OAAA,GAAU,MAAM,UAAA,CAAW,QAAA,EAAU,IAAA,CAAK,aAAa,CAAA;AAAA,IACzD,SAAS,CAAA,EAAG;AACV,MAAA,IAAI,CAAA,YAAa,QAAA,IAAY,CAAA,CAAE,IAAA,KAAS,WAAA,EAAa;AACnD,QAAA,MAAM,IAAI,YAAY,oBAAoB,CAAA;AAAA,MAC5C;AACA,MAAA,MAAM,IAAI,YAAY,mBAAmB,CAAA;AAAA,IAC3C;AACA,IAAA,IAAI,OAAO,OAAA,CAAQ,KAAA,KAAU,QAAA,EAAU;AACrC,MAAA,MAAM,IAAI,WAAA,CAAY,cAAA,EAAgB,eAAA,CAAgB,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IACtE;AACA,IAAA,OAAA,GACE,OAAO,QAAQ,QAAA,KAAa,QAAA,GACxB,UAAU,OAAA,CAAQ,QAAQ,IAC1B,OAAA,CAAQ,QAAA;AACd,IAAA,KAAA,GAAQ,OAAA,CAAQ,KAAA;AAAA,EAClB,CAAA,MAAO;AACL,IAAA,IAAI,QAAA,KAAa,IAAA,EAAM,MAAM,IAAI,YAAY,mBAAmB,CAAA;AAChE,IAAA,MAAM,GAAA,GAAM,MAAA,CAAO,GAAA,CAAI,UAAU,CAAA;AACjC,IAAA,IAAI,GAAA,KAAQ,IAAA,EAAM,MAAM,IAAI,YAAY,oBAAoB,CAAA;AAC5D,IAAA,OAAA,GAAU,UAAU,GAAG,CAAA;AACvB,IAAA,KAAA,GAAQ,MAAA,CAAO,GAAA,CAAI,OAAO,CAAA,IAAK,MAAA;AAAA,EACjC;AACA,EAAA,IAAI,KAAA,KAAU,MAAA,IAAa,OAAO,KAAA,KAAU,QAAA,EAAU;AACpD,IAAA,MAAM,IAAI,YAAY,oBAAoB,CAAA;AAAA,EAC5C;AACA,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,YAAA,CAAa,OAAA,EAAS,IAAI,CAAA;AAAA,IACnC,GAAI,OAAO,KAAA,KAAU,WAAW,EAAE,KAAA,KAAU;AAAC,GAC/C;AACF;AAOA,SAAS,gBAAgB,KAAA,EAAuB;AAC9C,EAAA,OAAO,wBAAA,CAAyB,IAAA,CAAK,KAAK,CAAA,GAAI,KAAA,GAAQ,SAAA;AACxD;AAEA,SAAS,UAAU,CAAA,EAAoB;AACrC,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,MAAM,CAAC,CAAA;AAAA,EACrB,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,YAAY,oBAAoB,CAAA;AAAA,EAC5C;AACF;AAyEA,eAAsB,4BACpB,KAAA,EACwC;AACxC,EAAA,MAAMA,QAAAA,GACJ,OAAO,KAAA,CAAM,OAAA,KAAY,QAAA;AAAA;AAAA,IAErB,6BAAA,CAA8B,MAAM,OAAA,EAAS;AAAA,MAC3C,SAAA,EAAW,IAAA;AAAA,MACX,UAAA,EAAY;AAAA,KACb;AAAA,MACD,KAAA,CAAM,OAAA;AACZ,EAAA,IAAI,KAAA,CAAM,KAAA,KAAUA,QAAAA,CAAQ,KAAA,EAAO;AACjC,IAAA,MAAM,IAAI,YAAY,gBAAgB,CAAA;AAAA,EACxC;AAEA,EAAA,MAAM,OAAA,mBAAU,MAAA,CAAO,MAAA,CAAO,IAAI,CAAA;AAClC,EAAA,MAAM,OAAA,GAAU,CAAC,IAAA,MAA4C;AAAA,IAC3D,EAAA,EAAI,KAAA;AAAA,IACJ,IAAA;AAAA,IACA,mBAAA,EAAqB,KAAA;AAAA,IACrB,eAAA,EAAiB;AAAA,GACnB,CAAA;AAEA,EAAA,IAAI,oBAAA,GAAuB,IAAA;AAC3B,EAAA,MAAM,QAAA,GAAW,IAAI,GAAA,CAAIA,QAAAA,CAAQ,IAAA,CAAK,YAAY,GAAA,CAAI,CAAA,CAAA,KAAK,CAAA,CAAE,EAAE,CAAC,CAAA;AAChE,EAAA,KAAA,MAAW,EAAA,IAAM,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,OAAO,CAAA,EAAG;AAC3C,IAAA,IAAI,CAAC,SAAS,GAAA,CAAI,EAAE,GAAG,OAAA,CAAQ,EAAE,CAAA,GAAI,OAAA,CAAQ,yBAAyB,CAAA;AAAA,EACxE;AACA,EAAA,KAAA,MAAW,KAAA,IAASA,QAAAA,CAAQ,IAAA,CAAK,WAAA,EAAa;AAC5C,IAAA,MAAM,MAAA,GAAS,KAAA,CAAM,SAAA,CAAU,KAAA,CAAM,EAAE,CAAA;AACvC,IAAA,MAAM,eAAA,GAAkB,OAAO,eAAA,KAAoB,MAAA;AACnD,IAAA,IAAI,CAAC,iBAAiB,oBAAA,GAAuB,KAAA;AAC7C,IAAA,MAAM,IAAA,GAAO,KAAA,CAAM,OAAA,CAAQ,KAAA,CAAM,EAAE,CAAA;AACnC,IAAA,IAAI,MAAM,MAAA,KAAW,CAAA,IAAK,OAAO,IAAA,CAAK,CAAC,MAAM,QAAA,EAAU;AACrD,MAAA,OAAA,CAAQ,KAAA,CAAM,EAAE,CAAA,GAAI,OAAA,CAAQ,sBAAsB,CAAA;AAClD,MAAA;AAAA,IACF;AACA,IAAA,MAAM,YAAA,GAAe,KAAK,CAAC,CAAA;AAC3B,IAAA,MAAM,MAAM,MAAM,kBAAA;AAAA,MAChB,YAAA;AAAA,MACA;AAAA,QACE,GAAG,MAAA;AAAA,QACH,UAAUA,QAAAA,CAAQ,QAAA;AAAA,QAClB,OAAOA,QAAAA,CAAQ,KAAA;AAAA,QACf,iBAAA,EAAmB;AAAA,OACrB;AAAA,MACA,KAAA,CAAM;AAAA,KACR;AACA,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,OAAA,CAAQ,KAAA,CAAM,EAAE,CAAA,GAAI;AAAA,QAClB,EAAA,EAAI,KAAA;AAAA,QACJ,MAAM,GAAA,CAAI,IAAA;AAAA,QACV,qBAAqB,GAAA,CAAI,mBAAA;AAAA,QACzB,iBAAiB,GAAA,CAAI;AAAA,OACvB;AACA,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,SAAA,GAAY,CAAC,IAAA,MAA4C;AAAA,MAC7D,EAAA,EAAI,KAAA;AAAA,MACJ,IAAA;AAAA,MACA,mBAAA,EAAqB,eAAA;AAAA,MACrB,eAAA,EAAiB;AAAA,KACnB,CAAA;AACA,IAAA,IAAI,CAAC,KAAA,CAAM,IAAA,CAAK,WAAW,QAAA,CAAS,GAAA,CAAI,GAAG,CAAA,EAAG;AAC5C,MAAA,OAAA,CAAQ,KAAA,CAAM,EAAE,CAAA,GAAI,SAAA,CAAU,YAAY,CAAA;AAC1C,MAAA;AAAA,IACF;AACA,IAAA,MAAM,OAAA,GAAU,aAAa,KAAK,CAAA;AAClC,IAAA,IAAI,WAAW,CAAC,OAAA,CAAQ,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA,EAAG;AAC5C,MAAA,OAAA,CAAQ,KAAA,CAAM,EAAE,CAAA,GAAI,SAAA,CAAU,kBAAkB,CAAA;AAChD,MAAA;AAAA,IACF;AACA,IAAA,MAAM,UAAU,aAAA,CAAc,GAAA,EAAK,YAAA,EAAc,eAAA,CAAgB,KAAK,CAAC,CAAA;AACvE,IAAA,IAAI,OAAA,GAA8B,IAAA;AAClC,IAAA,KAAA,MAAW,KAAA,IAAS,eAAA,CAAgB,KAAK,CAAA,EAAG;AAC1C,MAAA,MAAM,IAAA,GAAO,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA;AACzB,MAAA,IAAI,CAAC,MAAA,CAAO,MAAA,CAAO,OAAA,EAAS,IAAI,CAAA,EAAG;AACjC,QAAA,OAAA,GAAU,UAAU,eAAe,CAAA;AACnC,QAAA;AAAA,MACF;AACA,MAAA,IAAI,CAAC,YAAA,CAAa,OAAA,CAAQ,IAAI,CAAA,EAAG,KAAA,CAAM,MAAM,CAAA,EAAG;AAC9C,QAAA,OAAA,GAAU,UAAU,gBAAgB,CAAA;AACpC,QAAA;AAAA,MACF;AAAA,IACF;AACA,IAAA,OAAA,CAAQ,KAAA,CAAM,EAAE,CAAA,GAAI,OAAA,IAAW,GAAA;AAAA,EACjC;AAEA,EAAA,MAAM,YAAA,GAAe,MAAA,CAAO,MAAA,CAAO,OAAO,CAAA,CAAE,MAAA;AAAA,IAC1C,CAAC,MAAiC,CAAA,CAAE;AAAA,GACtC;AACA,EAAA,MAAM,KAAA,GAAQ,aAAa,CAAC,CAAA;AAC5B,EAAA,IACE,SACA,YAAA,CAAa,IAAA;AAAA,IACX,CAAA,CAAA,KAAK,EAAE,OAAA,KAAY,KAAA,CAAM,WAAW,CAAA,CAAE,SAAA,EAAW,CAAA,KAAM,KAAA,CAAM,SAAA,EAAW;AAAA,GAC1E,EACA;AACA,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAC7C,MAAA,IAAI,EAAE,EAAA,EAAI,OAAA,CAAQ,EAAE,CAAA,GAAI,QAAQ,eAAe,CAAA;AAAA,IACjD;AAAA,EACF;AACA,EAAA,MAAM,GAAA,GAAM,MAAA,CAAO,MAAA,CAAO,OAAO,CAAA;AACjC,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,GAAA,CAAI,KAAA,CAAM,CAAA,CAAA,KAAK,EAAE,EAAE,CAAA;AAAA,IACvB,OAAA;AAAA,IACA,mBAAA,EACE,wBAAwB,GAAA,CAAI,KAAA,CAAM,OAAK,CAAA,CAAE,EAAA,IAAM,EAAE,mBAAmB,CAAA;AAAA,IACtE,iBAAiB,GAAA,CAAI,KAAA,CAAM,OAAK,CAAA,CAAE,EAAA,IAAM,EAAE,eAAe;AAAA,GAC3D;AACF;AAGA,IAAM,wBAAA,GAA2B,CAAC,KAAA,EAAO,KAAK,CAAA;AAQ9C,SAAS,aAAA,CACP,GAAA,EACA,YAAA,EACA,MAAA,EACY;AACZ,EAAA,MAAM,SAAS,wBAAA,CAAyB,MAAA;AAAA,IAAO,CAAA,IAAA,KAC7C,OAAO,IAAA,CAAK,CAAA,CAAA,KAAK,EAAE,IAAA,CAAK,CAAC,MAAM,IAAI;AAAA,GACrC;AACA,EAAA,IAAI,MAAA,CAAO,MAAA,KAAW,CAAA,EAAG,OAAO,GAAA,CAAI,MAAA;AACpC,EAAA,MAAM,UAAsB,EAAE,GAAG,IAAI,MAAA,EAAQ,GAAA,EAAK,IAAI,OAAA,EAAQ;AAC9D,EAAA,IAAI,MAAA,CAAO,QAAA,CAAS,KAAK,CAAA,EAAG;AAC1B,IAAA,MAAM,MAAA,GAAS,UAAA,CAAW,YAAA,CAAa,IAAA,EAAM,CAAA;AAC7C,IAAA,MAAM,MAAM,kBAAA,CAAmB,MAAA,CAAO,OAAA,EAAS,MAAA,CAAO,WAAW,CAAA,CAAE,MAAA;AACnE,IAAA,IAAI,OAAO,GAAA,CAAI,GAAA,KAAQ,QAAA,EAAU,OAAA,CAAQ,MAAM,GAAA,CAAI,GAAA;AAAA,EACrD;AACA,EAAA,OAAO,OAAA;AACT","file":"chunk-2SF56NEJ.js","sourcesContent":["/**\n * Compact JWE with `alg: ECDH-ES` (direct key agreement, Concat KDF — RFC 7518 §4.6) and\n * `enc` `A128GCM` (the OpenID4VP default) or `A256GCM` on P-256, over WebCrypto. Used for OpenID4VP `direct_post.jwt` responses\n * (OpenID4VP 1.0 §8.3: an unsigned, encrypted JWT whose payload carries the response\n * parameters).\n *\n *   BASE64URL(protected header) . \"\" (no encrypted key) . BASE64URL(iv) . BASE64URL(ciphertext)\n *   . BASE64URL(tag), AAD = ASCII(BASE64URL(protected header)).\n */\nimport {\n  base64urlDecode,\n  base64urlEncode,\n  concatBytes,\n  fromUtf8,\n  utf8,\n} from './bytes';\nimport { isRecord, type JsonObject } from './util';\n\nexport interface P256PublicJwk {\n  kty: 'EC';\n  crv: 'P-256';\n  x: string;\n  y: string;\n  kid?: string;\n  use?: 'enc';\n  alg?: 'ECDH-ES';\n}\n\nexport interface P256PrivateJwk extends P256PublicJwk {\n  d: string;\n}\n\nexport const JWE_ALG = 'ECDH-ES';\n/** The content encryption algorithms supported, strongest first. */\nexport const JWE_ENCS = ['A256GCM', 'A128GCM'] as const;\nexport type JweEnc = (typeof JWE_ENCS)[number];\n/** Kept for compatibility: the default `enc` this kit produces when it may choose. */\nexport const JWE_ENC: JweEnc = 'A256GCM';\n\nexport function isJweEnc(v: unknown): v is JweEnc {\n  return v === 'A256GCM' || v === 'A128GCM';\n}\n\nfunction keyBitsOf(enc: JweEnc): 128 | 256 {\n  return enc === 'A128GCM' ? 128 : 256;\n}\n/** Largest compact JWE accepted (256 KiB). */\nexport const MAX_JWE_LENGTH = 256 * 1024;\n\nexport class JweError extends Error {\n  constructor(\n    readonly kind: 'malformed' | 'unsupported' | 'decrypt_failed' | 'bad_key'\n  ) {\n    super(`JWE ${kind}`);\n    this.name = 'JweError';\n  }\n}\n\nfunction uint32be(n: number): Uint8Array {\n  const out = new Uint8Array(4);\n  new DataView(out.buffer).setUint32(0, n, false);\n  return out;\n}\n\nfunction lengthPrefixed(bytes: Uint8Array): Uint8Array {\n  return concatBytes(uint32be(bytes.length), bytes);\n}\n\n/**\n * Concat KDF (NIST SP 800-56A §5.8.1, as profiled by RFC 7518 §4.6.2) with SHA-256, for direct\n * key agreement: AlgorithmID = the `enc` value, SuppPubInfo = key length in bits.\n */\nexport async function concatKdf(\n  z: Uint8Array,\n  keyBits: number,\n  algorithmId: string,\n  apu: Uint8Array = new Uint8Array(0),\n  apv: Uint8Array = new Uint8Array(0)\n): Promise<Uint8Array<ArrayBuffer>> {\n  const otherInfo = concatBytes(\n    lengthPrefixed(utf8(algorithmId)),\n    lengthPrefixed(apu),\n    lengthPrefixed(apv),\n    uint32be(keyBits)\n  );\n  const rounds = Math.ceil(keyBits / 256);\n  const parts: Uint8Array[] = [];\n  for (let i = 1; i <= rounds; i++) {\n    const input = concatBytes(uint32be(i), z, otherInfo);\n    parts.push(new Uint8Array(await crypto.subtle.digest('SHA-256', input)));\n  }\n  return concatBytes(...parts).slice(0, keyBits / 8);\n}\n\nexport function isP256PublicJwk(v: unknown): v is P256PublicJwk {\n  return (\n    isRecord(v) &&\n    v.kty === 'EC' &&\n    v.crv === 'P-256' &&\n    typeof v.x === 'string' &&\n    typeof v.y === 'string' &&\n    !('d' in v)\n  );\n}\n\nfunction publicPart(jwk: P256PublicJwk): JsonWebKey {\n  return { kty: 'EC', crv: 'P-256', x: jwk.x, y: jwk.y };\n}\n\nasync function importPublic(jwk: P256PublicJwk): Promise<CryptoKey> {\n  try {\n    return await crypto.subtle.importKey(\n      'jwk',\n      publicPart(jwk),\n      { name: 'ECDH', namedCurve: 'P-256' },\n      true,\n      []\n    );\n  } catch {\n    // Off-curve or malformed point (invalid-curve attacks are refused here).\n    throw new JweError('bad_key');\n  }\n}\n\nasync function importPrivate(jwk: P256PrivateJwk): Promise<CryptoKey> {\n  try {\n    return await crypto.subtle.importKey(\n      'jwk',\n      { ...publicPart(jwk), d: jwk.d },\n      { name: 'ECDH', namedCurve: 'P-256' },\n      false,\n      ['deriveBits']\n    );\n  } catch {\n    throw new JweError('bad_key');\n  }\n}\n\nasync function sharedSecret(\n  priv: CryptoKey,\n  pub: CryptoKey\n): Promise<Uint8Array> {\n  return new Uint8Array(\n    await crypto.subtle.deriveBits({ name: 'ECDH', public: pub }, priv, 256)\n  );\n}\n\n/** A fresh P-256 key pair for ECDH-ES, as JWKs carrying `kid`, `use: enc`, `alg: ECDH-ES`. */\nexport async function generateP256KeyPair(\n  kid: string\n): Promise<{ publicJwk: P256PublicJwk; privateJwk: P256PrivateJwk }> {\n  const pair = await crypto.subtle.generateKey(\n    { name: 'ECDH', namedCurve: 'P-256' },\n    true,\n    ['deriveBits']\n  );\n  const priv = await crypto.subtle.exportKey('jwk', pair.privateKey);\n  if (!priv.x || !priv.y || !priv.d) throw new JweError('bad_key');\n  const publicJwk: P256PublicJwk = {\n    kty: 'EC',\n    crv: 'P-256',\n    x: priv.x,\n    y: priv.y,\n    kid,\n    use: 'enc',\n    alg: 'ECDH-ES',\n  };\n  return { publicJwk, privateJwk: { ...publicJwk, d: priv.d } };\n}\n\n/** Encrypt `payload` (JSON) to `recipient` with ECDH-ES and `enc` (default A256GCM). */\nexport async function encryptJwe(\n  payload: JsonObject,\n  recipient: P256PublicJwk,\n  enc: JweEnc = JWE_ENC\n): Promise<string> {\n  if (!isJweEnc(enc)) throw new JweError('unsupported');\n  const recipientKey = await importPublic(recipient);\n  const eph = await crypto.subtle.generateKey(\n    { name: 'ECDH', namedCurve: 'P-256' },\n    true,\n    ['deriveBits']\n  );\n  const epk = await crypto.subtle.exportKey('jwk', eph.publicKey);\n  const header: JsonObject = {\n    alg: JWE_ALG,\n    enc,\n    ...(recipient.kid !== undefined ? { kid: recipient.kid } : {}),\n    epk: { kty: 'EC', crv: 'P-256', x: epk.x, y: epk.y },\n  };\n  const z = await sharedSecret(eph.privateKey, recipientKey);\n  const cek = await concatKdf(z, keyBitsOf(enc), enc);\n  const protectedHeader = base64urlEncode(utf8(JSON.stringify(header)));\n  const iv = crypto.getRandomValues(new Uint8Array(12));\n  const key = await crypto.subtle.importKey('raw', cek, 'AES-GCM', false, [\n    'encrypt',\n  ]);\n  const sealed = new Uint8Array(\n    await crypto.subtle.encrypt(\n      {\n        name: 'AES-GCM',\n        iv,\n        additionalData: utf8(protectedHeader),\n        tagLength: 128,\n      },\n      key,\n      utf8(JSON.stringify(payload))\n    )\n  );\n  const ciphertext = sealed.slice(0, sealed.length - 16);\n  const tag = sealed.slice(sealed.length - 16);\n  return [\n    protectedHeader,\n    '',\n    base64urlEncode(iv),\n    base64urlEncode(ciphertext),\n    base64urlEncode(tag),\n  ].join('.');\n}\n\n/** The protected header of a compact JWE, without decrypting. */\nexport function decodeJweHeader(compact: string): JsonObject {\n  const first = compact.split('.')[0] ?? '';\n  try {\n    const header: unknown = JSON.parse(fromUtf8(base64urlDecode(first)));\n    if (!isRecord(header)) throw new JweError('malformed');\n    return header;\n  } catch {\n    throw new JweError('malformed');\n  }\n}\n\n/**\n * Decrypt an ECDH-ES compact JWE (`enc` A128GCM or A256GCM, limited to `accept` when given) with\n * the recipient's private JWK.\n */\nexport async function decryptJwe(\n  compact: string,\n  recipient: P256PrivateJwk,\n  accept: readonly JweEnc[] = JWE_ENCS\n): Promise<JsonObject> {\n  if (typeof compact !== 'string' || compact.length > MAX_JWE_LENGTH) {\n    throw new JweError('malformed');\n  }\n  const parts = compact.split('.');\n  if (parts.length !== 5) throw new JweError('malformed');\n  const [h, encryptedKey, ivB64, ctB64, tagB64] = parts as [\n    string,\n    string,\n    string,\n    string,\n    string,\n  ];\n  if (encryptedKey !== '') throw new JweError('unsupported');\n  const header = decodeJweHeader(compact);\n  const enc = header.enc;\n  if (header.alg !== JWE_ALG || !isJweEnc(enc) || !accept.includes(enc)) {\n    throw new JweError('unsupported');\n  }\n  if (header.zip !== undefined || header.crit !== undefined) {\n    throw new JweError('unsupported');\n  }\n  if (\n    recipient.kid !== undefined &&\n    header.kid !== undefined &&\n    header.kid !== recipient.kid\n  ) {\n    throw new JweError('bad_key');\n  }\n  if (!isP256PublicJwk(header.epk)) throw new JweError('malformed');\n  let iv: Uint8Array<ArrayBuffer>;\n  let ciphertext: Uint8Array<ArrayBuffer>;\n  let tag: Uint8Array<ArrayBuffer>;\n  let apu: Uint8Array;\n  let apv: Uint8Array;\n  try {\n    iv = base64urlDecode(ivB64);\n    ciphertext = base64urlDecode(ctB64);\n    tag = base64urlDecode(tagB64);\n    apu =\n      typeof header.apu === 'string'\n        ? base64urlDecode(header.apu)\n        : new Uint8Array(0);\n    apv =\n      typeof header.apv === 'string'\n        ? base64urlDecode(header.apv)\n        : new Uint8Array(0);\n  } catch {\n    throw new JweError('malformed');\n  }\n  if (iv.length !== 12 || tag.length !== 16) throw new JweError('malformed');\n  const epk = await importPublic(header.epk);\n  const priv = await importPrivate(recipient);\n  const z = await sharedSecret(priv, epk);\n  const cek = await concatKdf(z, keyBitsOf(enc), enc, apu, apv);\n  const key = await crypto.subtle.importKey('raw', cek, 'AES-GCM', false, [\n    'decrypt',\n  ]);\n  let plain: Uint8Array;\n  try {\n    plain = new Uint8Array(\n      await crypto.subtle.decrypt(\n        { name: 'AES-GCM', iv, additionalData: utf8(h), tagLength: 128 },\n        key,\n        concatBytes(ciphertext, tag)\n      )\n    );\n  } catch {\n    throw new JweError('decrypt_failed');\n  }\n  let payload: unknown;\n  try {\n    payload = JSON.parse(fromUtf8(plain));\n  } catch {\n    throw new JweError('malformed');\n  }\n  if (!isRecord(payload)) throw new JweError('malformed');\n  return payload;\n}\n","/**\n * `@ixo/credentials-kit/oid4vp` — OpenID for Verifiable Presentations 1.0, as profiled by\n * SPEC §3 and §13.3:\n *\n * - signed request object (`typ: oauth-authz-req+jwt`, `alg` `EdDSA`; `Ed25519` accepted) with\n *   `client_id = decentralized_identifier:<did>`, signed by a key of that DID named by `kid`\n *   (OpenID4VP §5.9.3). The kit's verifier emits `aud: https://self-issued.me/v2` (§5.8, static\n *   discovery), `iat` and `exp`; the kit's wallet accepts request objects without `aud`, `iat` or\n *   `exp` (the spec's own examples have none) and enforces each one that is present;\n * - `response_type: vp_token`, `response_mode: direct_post` or `direct_post.jwt` (§8.2, §8.3.1);\n * - a DCQL subset: credential queries of format `dc+sd-jwt` with `meta.vct_values`, optional\n *   one-segment claim paths with optional `values`, and `path: ['iss']` + `values` as the\n *   accepted-issuer filter. Unknown members are ignored (§6), duplicate claim queries are\n *   dropped, `multiple: true` is answered with one presentation. `credential_sets`,\n *   `claim_sets`, `trusted_authorities`, multi-segment paths and other formats are refused with\n *   `unsupported_request` (and `error.feature`), which the wallet reports to the verifier with\n *   `sendAuthorizationError` (§8.5);\n * - `vp_token`: `{ <query id>: [<SD-JWT+KB>] }`;\n * - encrypted responses: an unsigned JWE (`ECDH-ES`, P-256, `enc` `A128GCM` — the spec default —\n *   or `A256GCM`, chosen from the verifier's `encrypted_response_enc_values_supported`) to the key\n *   in `client_metadata.jwks` whose payload is the response parameters (§8.3); the form body is\n *   `response=<jwe>`;\n * - wallet invocation: `buildWalletLink` / `parseWalletLink`\n *   (`openid4vp://?client_id=…&request_uri=…`, §5.10.1, §9).\n */\nimport {\n  ResolverUnavailable,\n  didFromKid,\n  findKey,\n  type DidResolver,\n} from './did';\nimport { randomToken, utf8 } from './internal/bytes';\nimport { CredentialsKitError } from './internal/errors';\nimport {\n  isFetchableUrl,\n  request as httpRequest,\n  type FetchLike,\n  type HostPolicy,\n} from './internal/http';\nimport {\n  JWE_ENCS,\n  JweError,\n  decryptJwe,\n  encryptJwe,\n  generateP256KeyPair,\n  isJweEnc,\n  isP256PublicJwk,\n  type JweEnc,\n  type P256PrivateJwk,\n  type P256PublicJwk,\n} from './internal/jwe';\nimport {\n  CLOCK_SKEW_S,\n  clockMs,\n  isRecord,\n  toSeconds,\n  type JsonObject,\n} from './internal/util';\nimport {\n  decodeJws,\n  isEd25519JwsAlg,\n  signJws,\n  verifyEd25519,\n  type Signer,\n} from './jose';\nimport {\n  CLIENT_ID_PREFIX,\n  REQUEST_OBJECT_TYP,\n  type DcqlQuerySummary,\n} from './profile';\nimport {\n  SdJwtError,\n  parseSdJwt,\n  processDisclosures,\n  sdHash,\n  selectDisclosures,\n  serializeSdJwt,\n  type ParsedSdJwt,\n} from './sdjwt';\nimport {\n  verifyPresentation,\n  type VerifiedPresentation,\n  type VerifyDeps,\n  type VerifyFailureCode,\n  type VerifyPolicy,\n} from './verify';\n\nexport type { FetchLike } from './internal/http';\nexport type { JweEnc, P256PrivateJwk, P256PublicJwk } from './internal/jwe';\n\n/** Static-discovery audience of a request object (OpenID4VP §5.8). */\nexport const SELF_ISSUED_AUDIENCE = 'https://self-issued.me/v2';\n/** The `enc` the kit prefers when the verifier offers it. */\nexport const RESPONSE_ENCRYPTION_ENC = 'A256GCM';\n/** `enc` values the kit can produce and decrypt, in the wallet's order of preference. */\nexport const RESPONSE_ENCRYPTION_ENCS: readonly JweEnc[] = JWE_ENCS;\n/** The `enc` a wallet must use when the verifier lists none (OpenID4VP §8.3). */\nexport const DEFAULT_RESPONSE_ENCRYPTION_ENC: JweEnc = 'A128GCM';\n/** Most credential queries / claims per query the kit accepts. */\nexport const MAX_CREDENTIAL_QUERIES = 16;\nexport const MAX_CLAIMS_PER_QUERY = 64;\n/** Largest request object accepted (64 KiB). */\nexport const MAX_REQUEST_OBJECT_LENGTH = 64 * 1024;\n/** Largest response body accepted (256 KiB). */\nexport const MAX_RESPONSE_BODY_LENGTH = 256 * 1024;\n/** Longest lifetime of a request object the wallet accepts (from `iat`, or from now). */\nexport const MAX_REQUEST_LIFETIME_SECONDS = 24 * 3600;\n\nexport type ResponseMode = 'direct_post' | 'direct_post.jwt';\n\nexport type Oid4vpErrorCode =\n  | 'malformed_request'\n  | 'wrong_type'\n  | 'unsupported_client_id'\n  | 'unknown_verifier'\n  | 'unknown_key'\n  | 'bad_signature'\n  | 'expired'\n  | 'unsupported_request'\n  | 'unsupported_response_mode'\n  | 'insecure_response_uri'\n  /** No longer thrown (DCQL problems are `malformed_request` / `unsupported_request`). */\n  | 'unsupported_query'\n  | 'unsupported_encryption'\n  | 'malformed_response'\n  | 'decryption_failed'\n  | 'wallet_error'\n  | 'state_mismatch';\n\nconst OID4VP_MESSAGES: Record<Oid4vpErrorCode, string> = {\n  malformed_request: 'The presentation request is not well formed.',\n  wrong_type: 'The request object is not typed oauth-authz-req+jwt.',\n  unsupported_client_id:\n    'The request does not use a decentralized_identifier client_id.',\n  unknown_verifier: \"The verifier's DID could not be found.\",\n  unknown_key: \"The request is not signed with a key of the verifier's DID.\",\n  bad_signature: 'The request signature does not verify.',\n  expired: 'The request has expired.',\n  unsupported_request:\n    'The request uses a feature this profile does not support.',\n  unsupported_response_mode:\n    'The response mode is not direct_post or direct_post.jwt.',\n  insecure_response_uri:\n    'The response URI is not an https address on the public internet.',\n  unsupported_query:\n    'The DCQL query uses a feature this profile does not support.',\n  unsupported_encryption:\n    'The response encryption parameters are not supported.',\n  malformed_response: 'The presentation response is not well formed.',\n  decryption_failed: 'The presentation response could not be decrypted.',\n  wallet_error: 'The wallet answered with an error.',\n  state_mismatch: 'The response state does not match the request.',\n};\n\n/**\n * Where a wallet may send an error response for a request whose signature it verified (the\n * fields of `AuthorizationRequest` that `sendAuthorizationError` needs).\n */\nexport interface AuthorizationErrorTarget {\n  clientId: string;\n  responseUri: string;\n  responseMode: ResponseMode;\n  state?: string;\n  /** Present when the error can be encrypted (`direct_post.jwt` with a usable key). */\n  responseEncryptionJwk?: P256PublicJwk;\n  responseEncryptionEnc?: JweEnc;\n}\n\nexport class Oid4vpError extends CredentialsKitError {\n  declare readonly code: Oid4vpErrorCode;\n  /** For `wallet_error`: the OAuth error code the wallet sent (e.g. `access_denied`). */\n  readonly walletError?: string;\n  /**\n   * For `unsupported_request`: the feature refused (`credential_sets`, `claim_sets`,\n   * `trusted_authorities`, `nested_path`, `format`, `registered_claim`, `transaction_data`,\n   * `scope`, `response_type`, `request_uri_method`, `request`, `too_many_queries`,\n   * `too_many_claims`).\n   */\n  readonly feature?: string;\n  /**\n   * Set only when the request object's signature verified and its response URI is usable: the\n   * wallet may tell the verifier with `sendAuthorizationError({ target: error.errorTarget, … })`\n   * (OpenID4VP §8.5). Never set for a request that did not verify.\n   */\n  readonly errorTarget?: AuthorizationErrorTarget;\n  constructor(\n    code: Oid4vpErrorCode,\n    walletError?: string,\n    extra: { feature?: string; errorTarget?: AuthorizationErrorTarget } = {}\n  ) {\n    super(code, OID4VP_MESSAGES[code]);\n    if (walletError !== undefined) this.walletError = walletError;\n    if (extra.feature !== undefined) this.feature = extra.feature;\n    if (extra.errorTarget !== undefined) this.errorTarget = extra.errorTarget;\n  }\n}\n\nfunction unsupported(feature: string): never {\n  throw new Oid4vpError('unsupported_request', undefined, { feature });\n}\n\nfunction malformed(): never {\n  throw new Oid4vpError('malformed_request');\n}\n\n// ---------------------------------------------------------------------------------------------\n// DCQL subset.\n\nexport interface DcqlClaimQuery {\n  id?: string;\n  /** One claim name (one-segment path). */\n  path: [string];\n  values?: (string | number | boolean)[];\n}\n\nexport interface DcqlCredentialQuery {\n  id: string;\n  format: 'dc+sd-jwt';\n  meta: { vct_values: string[] };\n  claims?: DcqlClaimQuery[];\n  /** Absent means true (DCQL §6.1). The kit's wallet always presents with key binding. */\n  require_cryptographic_holder_binding?: boolean;\n  /** `true` is accepted and answered with one presentation. */\n  multiple?: boolean;\n}\n\nexport interface DcqlQuery {\n  credentials: DcqlCredentialQuery[];\n}\n\nconst QUERY_ID = /^[A-Za-z0-9_-]+$/;\n/** Structural names that are never a claim. */\nconst STRUCTURAL_NAMES = new Set(['_sd', '_sd_alg', '...']);\n/** Registered claims that are not asked for by path (always plaintext, never a disclosure). */\nconst NOT_REQUESTABLE = new Set([\n  'nbf',\n  'exp',\n  'vct',\n  'vct#integrity',\n  'aka_vcts',\n  'cnf',\n  'status',\n]);\n\nfunction isPathElement(x: unknown): boolean {\n  return (\n    typeof x === 'string' ||\n    x === null ||\n    (typeof x === 'number' && Number.isSafeInteger(x) && x >= 0)\n  );\n}\n\nfunction validateClaim(v: unknown): DcqlClaimQuery {\n  if (!isRecord(v)) malformed();\n  // Unknown members (e.g. `intent_to_retain`) are ignored (DCQL §6).\n  if (v.id !== undefined && (typeof v.id !== 'string' || !QUERY_ID.test(v.id)))\n    malformed();\n  const path = v.path;\n  if (!Array.isArray(path) || path.length === 0 || !path.every(isPathElement))\n    malformed();\n  if (path.length !== 1 || typeof path[0] !== 'string')\n    unsupported('nested_path');\n  const name = path[0];\n  if (name.length === 0 || STRUCTURAL_NAMES.has(name)) malformed();\n  if (NOT_REQUESTABLE.has(name)) unsupported('registered_claim');\n  let values: (string | number | boolean)[] | undefined;\n  if (v.values !== undefined) {\n    if (!Array.isArray(v.values) || v.values.length === 0) malformed();\n    for (const x of v.values) {\n      const ok =\n        typeof x === 'string' ||\n        typeof x === 'boolean' ||\n        (typeof x === 'number' && Number.isInteger(x));\n      if (!ok) malformed();\n    }\n    values = v.values as (string | number | boolean)[];\n  }\n  // `iss` is only the accepted-issuer filter, so its values must be DIDs (strings).\n  if (name === 'iss' && values && !values.every(x => typeof x === 'string'))\n    malformed();\n  return {\n    ...(typeof v.id === 'string' ? { id: v.id } : {}),\n    path: [name],\n    ...(values ? { values } : {}),\n  };\n}\n\nfunction validateCredentialQuery(v: unknown): DcqlCredentialQuery {\n  if (!isRecord(v)) malformed();\n  if (typeof v.id !== 'string' || !QUERY_ID.test(v.id)) malformed();\n  if (typeof v.format !== 'string') malformed();\n  if (v.multiple !== undefined && typeof v.multiple !== 'boolean') malformed();\n  if (\n    v.require_cryptographic_holder_binding !== undefined &&\n    typeof v.require_cryptographic_holder_binding !== 'boolean'\n  )\n    malformed();\n  const meta = v.meta;\n  if (v.format !== 'dc+sd-jwt') unsupported('format');\n  if (\n    !isRecord(meta) ||\n    !Array.isArray(meta.vct_values) ||\n    meta.vct_values.length === 0 ||\n    !meta.vct_values.every(x => typeof x === 'string' && x.length > 0)\n  ) {\n    malformed();\n  }\n  if (v.claim_sets !== undefined) unsupported('claim_sets');\n  if (v.trusted_authorities !== undefined) unsupported('trusted_authorities');\n  let claims: DcqlClaimQuery[] | undefined;\n  if (v.claims !== undefined) {\n    if (!Array.isArray(v.claims) || v.claims.length === 0) malformed();\n    if (v.claims.length > MAX_CLAIMS_PER_QUERY) unsupported('too_many_claims');\n    const seen = new Set<string>();\n    claims = [];\n    for (const raw of v.claims) {\n      const claim = validateClaim(raw);\n      // Duplicate claim queries: the first one counts (DCQL §6.1 \"SHOULD ignore\").\n      if (seen.has(claim.path[0])) continue;\n      seen.add(claim.path[0]);\n      claims.push(claim);\n    }\n  }\n  return {\n    id: v.id,\n    format: 'dc+sd-jwt',\n    meta: { vct_values: [...(meta.vct_values as string[])] },\n    ...(claims ? { claims } : {}),\n    ...(typeof v.require_cryptographic_holder_binding === 'boolean'\n      ? {\n          require_cryptographic_holder_binding:\n            v.require_cryptographic_holder_binding,\n        }\n      : {}),\n    ...(typeof v.multiple === 'boolean' ? { multiple: v.multiple } : {}),\n  };\n}\n\n/**\n * Validate a DCQL query against the profile's subset and return it in normal form (unknown\n * members dropped, per DCQL §6 \"MUST ignore any unknown properties\"; duplicate claim queries\n * dropped). Throws `Oid4vpError('malformed_request')` for an invalid query and\n * `Oid4vpError('unsupported_request')` (with `feature`) for a valid one the profile does not\n * answer.\n */\nexport function validateDcql(dcql: unknown): DcqlQuery {\n  if (!isRecord(dcql)) malformed();\n  const creds = dcql.credentials;\n  if (!Array.isArray(creds) || creds.length === 0) malformed();\n  if (creds.length > MAX_CREDENTIAL_QUERIES) unsupported('too_many_queries');\n  const credentials = creds.map(validateCredentialQuery);\n  const ids = credentials.map(c => c.id);\n  if (new Set(ids).size !== ids.length) malformed();\n  if (dcql.credential_sets !== undefined) unsupported('credential_sets');\n  return { credentials };\n}\n\nfunction issuerFilter(query: DcqlCredentialQuery): string[] | undefined {\n  const iss = query.claims?.find(c => c.path[0] === 'iss');\n  return iss?.values as string[] | undefined;\n}\n\nfunction requestedClaims(query: DcqlCredentialQuery): DcqlClaimQuery[] {\n  return (query.claims ?? []).filter(c => c.path[0] !== 'iss');\n}\n\n/** What each credential query asks for, for consent screens and catalogs. Validates first. */\nexport function summarizeDcql(dcql: unknown): DcqlQuerySummary[] {\n  return validateDcql(dcql).credentials.map(q => {\n    const issuers = issuerFilter(q);\n    return {\n      id: q.id,\n      vctValues: [...q.meta.vct_values],\n      claims: requestedClaims(q).map(c => c.path[0]),\n      ...(issuers ? { issuers: [...issuers] } : {}),\n    };\n  });\n}\n\nexport type MatchFailure =\n  | 'unsupported_query'\n  | 'wrong_format'\n  | 'wrong_type'\n  | 'untrusted_issuer'\n  | 'missing_claim'\n  | 'value_mismatch'\n  | 'no_holder_binding';\n\nexport type MatchResult =\n  { ok: true; disclose: string[] } | { ok: false; reason: MatchFailure };\n\nfunction valueMatches(\n  value: unknown,\n  values: readonly (string | number | boolean)[] | undefined\n): boolean {\n  return values === undefined || values.some(v => v === value);\n}\n\n/**\n * Whether a held credential (parsed, without KB) answers one credential query, and which\n * selectively disclosable top-level claims to disclose for it (in query order). Plaintext claims\n * are matched but never listed. Value restrictions are applied (DCQL §6.4.1). A requested claim\n * whose value is an object with nested disclosures is disclosed at the top level only (nested\n * disclosures are not released: one-segment paths only).\n */\nexport function matchCredential(\n  query: unknown,\n  parsed: ParsedSdJwt\n): MatchResult {\n  let q: DcqlCredentialQuery;\n  try {\n    q = validateCredentialQuery(query);\n  } catch {\n    return { ok: false, reason: 'unsupported_query' };\n  }\n  const typ = parsed.header.typ;\n  if (typ !== 'dc+sd-jwt' && typ !== 'vc+sd-jwt')\n    return { ok: false, reason: 'wrong_format' };\n  const { payload } = parsed;\n  if (\n    typeof payload.vct !== 'string' ||\n    !q.meta.vct_values.includes(payload.vct)\n  ) {\n    return { ok: false, reason: 'wrong_type' };\n  }\n  const issuers = issuerFilter(q);\n  if (\n    issuers &&\n    (typeof payload.iss !== 'string' || !issuers.includes(payload.iss))\n  ) {\n    return { ok: false, reason: 'untrusted_issuer' };\n  }\n  const cnf = payload.cnf;\n  if (!isRecord(cnf) || !isRecord(cnf.jwk))\n    return { ok: false, reason: 'no_holder_binding' };\n  const topDigests = new Set(\n    Array.isArray(payload._sd) ? (payload._sd as unknown[]) : []\n  );\n  const byName = new Map(\n    parsed.disclosures\n      .filter(d => d.name !== null && topDigests.has(d.digest))\n      .map(d => [d.name as string, d])\n  );\n  const disclose: string[] = [];\n  for (const claim of requestedClaims(q)) {\n    const name = claim.path[0];\n    const sd = byName.get(name);\n    if (sd) {\n      if (!valueMatches(sd.value, claim.values))\n        return { ok: false, reason: 'value_mismatch' };\n      disclose.push(name);\n    } else if (Object.hasOwn(payload, name)) {\n      if (!valueMatches(payload[name], claim.values)) {\n        return { ok: false, reason: 'value_mismatch' };\n      }\n    } else {\n      return { ok: false, reason: 'missing_claim' };\n    }\n  }\n  return { ok: true, disclose };\n}\n\n// ---------------------------------------------------------------------------------------------\n// Verifier: request.\n\n/** A fresh P-256 key pair for `direct_post.jwt` (keep `privateJwk` with the request). */\nexport function generateResponseKeyPair(): Promise<{\n  publicJwk: P256PublicJwk;\n  privateJwk: P256PrivateJwk;\n}> {\n  return generateP256KeyPair(`enc-${randomToken(9)}`);\n}\n\nexport interface CreateAuthorizationRequestInput {\n  /** Signs with a key of `clientDid`; `signer.kid` must be a DID URL of `clientDid`. */\n  signer: Signer;\n  clientDid: string;\n  /** Where the wallet POSTs the response (https on a public host; see `allowHttp`/`allowLocal`). */\n  responseUri: string;\n  /** Fresh, random, at least 16 URL-safe characters (OpenID4VP §5.2). */\n  nonce: string;\n  /** URL-safe characters only (OpenID4VP §5.2). */\n  state: string;\n  dcql: DcqlQuery;\n  /**\n   * When given, `response_mode` is `direct_post.jwt` and the response is encrypted to it; the\n   * request lists `A256GCM` and `A128GCM`, both of which `parseAuthorizationResponse` decrypts.\n   */\n  responseEncryptionJwk?: P256PublicJwk;\n  /** Expiry, unix seconds. */\n  exp: number;\n  /** ms since the epoch (for `iat`); default `Date.now()`. */\n  now?: number;\n  /** Allow an http `responseUri` on a loopback host (local development only; needs `allowLocal`). */\n  allowHttp?: boolean;\n  /** Allow a `responseUri` on a loopback / private / local-name host (local development only). */\n  allowLocal?: boolean;\n}\n\nconst URL_SAFE = /^[A-Za-z0-9._~-]+$/;\n\n/** A signed OpenID4VP request object (compact JWS). */\nexport async function createAuthorizationRequest(\n  input: CreateAuthorizationRequestInput\n): Promise<string> {\n  if (\n    didFromKid(input.signer.kid) !== input.clientDid ||\n    !input.signer.kid.includes('#')\n  ) {\n    throw new Oid4vpError('unknown_key');\n  }\n  if (\n    !isFetchableUrl(input.responseUri, {\n      allowHttp: input.allowHttp ?? false,\n      allowLocal: input.allowLocal ?? false,\n    })\n  ) {\n    throw new Oid4vpError('insecure_response_uri');\n  }\n  if (!URL_SAFE.test(input.nonce) || input.nonce.length < 16) malformed();\n  if (typeof input.state !== 'string' || !URL_SAFE.test(input.state))\n    malformed();\n  const dcql = validateDcql(input.dcql);\n  const iat = toSeconds(clockMs(input.now));\n  if (!Number.isSafeInteger(input.exp) || input.exp <= iat) malformed();\n  const enc = input.responseEncryptionJwk;\n  if (\n    enc !== undefined &&\n    (!isP256PublicJwk(enc) || typeof enc.kid !== 'string')\n  ) {\n    throw new Oid4vpError('unsupported_encryption');\n  }\n  const clientMetadata: JsonObject = {\n    vp_formats_supported: {\n      'dc+sd-jwt': {\n        // Fully-specified name first (RFC 9864), then the JWS name most wallets still match.\n        'sd-jwt_alg_values': ['Ed25519', 'EdDSA'],\n        'kb-jwt_alg_values': ['Ed25519', 'EdDSA'],\n      },\n    },\n    ...(enc\n      ? {\n          jwks: { keys: [{ ...enc, use: 'enc', alg: 'ECDH-ES' }] },\n          encrypted_response_enc_values_supported: [\n            ...RESPONSE_ENCRYPTION_ENCS,\n          ],\n        }\n      : {}),\n  };\n  return signJws(\n    { alg: 'EdDSA', typ: REQUEST_OBJECT_TYP, kid: input.signer.kid },\n    {\n      aud: SELF_ISSUED_AUDIENCE,\n      client_id: `${CLIENT_ID_PREFIX}${input.clientDid}`,\n      response_type: 'vp_token',\n      response_mode: enc ? 'direct_post.jwt' : 'direct_post',\n      response_uri: input.responseUri,\n      nonce: input.nonce,\n      state: input.state,\n      dcql_query: dcql,\n      client_metadata: clientMetadata,\n      iat,\n      exp: input.exp,\n    },\n    input.signer\n  );\n}\n\n// ---------------------------------------------------------------------------------------------\n// Wallet invocation (OpenID4VP §5.10.1, §9).\n\nexport interface WalletLink {\n  /** The full client_id, to compare with the request object's (`expectedClientId`). */\n  clientId: string;\n  requestUri: string;\n}\n\nconst MAX_WALLET_LINK_LENGTH = 4096;\n\n/**\n * The standard Authorization Request a non-Hub wallet opens: `openid4vp://?client_id=<…>&\n * request_uri=<…>` (both URL-encoded, no `request_uri_method`: GET). `scheme` is a custom scheme\n * (`openid4vp://`, `haip://`, …) or an https base URL (a wallet's universal link) without query\n * or fragment.\n */\nexport function buildWalletLink(input: {\n  clientId: string;\n  requestUri: string;\n  scheme?: string;\n}): string {\n  const scheme = input.scheme ?? 'openid4vp://';\n  if (typeof input.clientId !== 'string' || input.clientId.length === 0)\n    throw new TypeError('clientId is required');\n  let requestUri: URL;\n  try {\n    requestUri = new URL(input.requestUri);\n  } catch {\n    throw new TypeError('requestUri must be an absolute URL');\n  }\n  if (requestUri.protocol !== 'https:' && requestUri.protocol !== 'http:')\n    throw new TypeError('requestUri must be an http(s) URL');\n  let base: string;\n  if (/^[a-z][a-z0-9+.-]*:(?:\\/\\/)?$/i.test(scheme)) {\n    const name = scheme.slice(0, scheme.indexOf(':')).toLowerCase();\n    if (\n      ['javascript', 'data', 'vbscript', 'file', 'blob', 'http'].includes(name)\n    )\n      throw new TypeError('scheme must be a custom scheme or an https URL');\n    base = scheme;\n  } else {\n    let u: URL;\n    try {\n      u = new URL(scheme);\n    } catch {\n      throw new TypeError('scheme must be a custom scheme or an https URL');\n    }\n    if (u.protocol !== 'https:' || u.search || u.hash)\n      throw new TypeError('scheme must be a custom scheme or an https URL');\n    base = u.href;\n  }\n  const params = new URLSearchParams({\n    client_id: input.clientId,\n    request_uri: input.requestUri,\n  });\n  return `${base}?${params.toString()}`;\n}\n\n/**\n * Read a wallet link (`openid4vp://?client_id=…&request_uri=…`, or the same query on an https\n * URL). Throws `Oid4vpError('malformed_request')` when `client_id` or `request_uri` is missing or\n * repeated, or when `request_uri` fails the kit's URL rules (`isFetchableUrl`: https on a public\n * host, no credentials or fragment; `opts.allowHttp` / `opts.allowLocal` for local development\n * only), and `unsupported_request` for a request by value (`request`) or\n * `request_uri_method=post`. Fetch the request object with no redirects and a timeout, then pass\n * `clientId` as `expectedClientId` to `verifyAuthorizationRequest` (§5.10.1: they MUST be\n * identical).\n */\nexport function parseWalletLink(\n  link: string,\n  opts: HostPolicy = {}\n): WalletLink {\n  if (typeof link !== 'string' || link.length > MAX_WALLET_LINK_LENGTH)\n    malformed();\n  const q = link.indexOf('?');\n  if (q < 0) malformed();\n  const query = link.slice(q + 1).split('#')[0] ?? '';\n  const params = new URLSearchParams(query);\n  if (params.has('request')) unsupported('request');\n  const method = params.getAll('request_uri_method');\n  if (method.length > 1 || (method.length === 1 && method[0] !== 'get')) {\n    if (method[0] === 'post') unsupported('request_uri_method');\n    malformed();\n  }\n  const clientIds = params.getAll('client_id');\n  const requestUris = params.getAll('request_uri');\n  if (clientIds.length !== 1 || requestUris.length !== 1) malformed();\n  const clientId = clientIds[0]!;\n  const requestUri = requestUris[0]!;\n  if (clientId.length === 0) malformed();\n  if (\n    !isFetchableUrl(requestUri, {\n      allowHttp: opts.allowHttp ?? false,\n      allowLocal: opts.allowLocal ?? false,\n    })\n  )\n    malformed();\n  return { clientId, requestUri };\n}\n\n// ---------------------------------------------------------------------------------------------\n// Wallet: verify the request.\n\nexport interface AuthorizationRequest {\n  /** The request object as received. */\n  jwt: string;\n  /** The full client_id (`decentralized_identifier:<did>`): the KB-JWT `aud`. */\n  clientId: string;\n  clientDid: string;\n  /** The verification method that signed the request. */\n  kid: string;\n  responseUri: string;\n  responseMode: ResponseMode;\n  nonce: string;\n  state?: string;\n  dcql: DcqlQuery;\n  /** The key the response must be encrypted to (`direct_post.jwt`). */\n  responseEncryptionJwk?: P256PublicJwk;\n  /** The `enc` the wallet uses for `direct_post.jwt` (chosen from the verifier's list). */\n  responseEncryptionEnc?: JweEnc;\n  /** unix seconds; absent when the request object has no `exp`. */\n  exp?: number;\n  iat?: number;\n}\n\ninterface ParseRequestOptions extends HostPolicy {\n  /** `iat` / `exp` / lifetime checks against this clock (seconds); none when null. */\n  nowS: number | null;\n  requireExpiry: boolean;\n}\n\ninterface Header {\n  clientId: string;\n  clientDid: string;\n  kid: string;\n}\n\n/** typ, alg, client_id and kid: everything needed before the signature can be checked. */\nfunction checkHeader(\n  header: JsonObject,\n  payload: JsonObject,\n  expectedClientId: string | undefined\n): Header {\n  if (header.typ !== REQUEST_OBJECT_TYP) throw new Oid4vpError('wrong_type');\n  if (!isEd25519JwsAlg(header.alg)) throw new Oid4vpError('bad_signature');\n  const clientId = payload.client_id;\n  if (typeof clientId !== 'string' || !clientId.startsWith(CLIENT_ID_PREFIX)) {\n    throw new Oid4vpError('unsupported_client_id');\n  }\n  if (expectedClientId !== undefined && clientId !== expectedClientId)\n    malformed();\n  const clientDid = clientId.slice(CLIENT_ID_PREFIX.length);\n  if (!/^did:[a-z0-9]+:\\S+$/.test(clientDid) || clientDid.includes('#')) {\n    throw new Oid4vpError('unsupported_client_id');\n  }\n  const kid = typeof header.kid === 'string' ? header.kid : '';\n  const absoluteKid = kid.startsWith('#') ? `${clientDid}${kid}` : kid;\n  if (didFromKid(absoluteKid) !== clientDid || !absoluteKid.includes('#')) {\n    throw new Oid4vpError('unknown_key');\n  }\n  return { clientId, clientDid, kid: absoluteKid };\n}\n\n/** `exp` / `iat` / `aud` (no network). */\nfunction checkTimes(payload: JsonObject, opts: ParseRequestOptions): void {\n  const { exp, iat, aud } = payload;\n  if (exp !== undefined && (typeof exp !== 'number' || !Number.isFinite(exp)))\n    malformed();\n  if (iat !== undefined && (typeof iat !== 'number' || !Number.isFinite(iat)))\n    malformed();\n  if (exp === undefined && opts.requireExpiry) malformed();\n  // We only do static discovery: an `aud` that is there must be the static one (§5.8).\n  if (aud !== undefined && aud !== SELF_ISSUED_AUDIENCE) malformed();\n  if (opts.nowS === null) return;\n  const nowS = opts.nowS;\n  if (typeof exp === 'number' && nowS > exp + CLOCK_SKEW_S)\n    throw new Oid4vpError('expired');\n  if (typeof iat === 'number' && iat > nowS + CLOCK_SKEW_S) malformed();\n  if (typeof exp === 'number') {\n    const from = typeof iat === 'number' ? iat : nowS;\n    if (exp - from > MAX_REQUEST_LIFETIME_SECONDS + CLOCK_SKEW_S) malformed();\n  }\n}\n\nfunction chooseEncryption(\n  meta: unknown\n): { jwk: P256PublicJwk; enc: JweEnc } | null {\n  if (!isRecord(meta)) return null;\n  const encsRaw = meta.encrypted_response_enc_values_supported;\n  const encs: unknown[] =\n    encsRaw === undefined\n      ? [DEFAULT_RESPONSE_ENCRYPTION_ENC]\n      : Array.isArray(encsRaw)\n        ? encsRaw\n        : [];\n  const enc = RESPONSE_ENCRYPTION_ENCS.find(e => encs.includes(e));\n  const keys = isRecord(meta.jwks) ? meta.jwks.keys : undefined;\n  // §8.3: `alg` MUST be present; the JWE alg equals it; `kid` is copied when present.\n  const key = Array.isArray(keys)\n    ? (keys as unknown[])\n        .slice(0, 16)\n        .find(\n          (k): k is P256PublicJwk =>\n            isP256PublicJwk(k) &&\n            k.alg === 'ECDH-ES' &&\n            (k.kid === undefined || typeof k.kid === 'string') &&\n            (k.use === undefined || k.use === 'enc')\n        )\n    : undefined;\n  if (!enc || !isJweEnc(enc) || !key) return null;\n  return {\n    jwk: {\n      kty: 'EC',\n      crv: 'P-256',\n      x: key.x,\n      y: key.y,\n      ...(typeof key.kid === 'string' ? { kid: key.kid } : {}),\n      use: 'enc',\n      alg: 'ECDH-ES',\n    },\n    enc,\n  };\n}\n\n/**\n * The request parameters, after the header (and, for a wallet, the signature) checked out.\n * Errors thrown once `response_uri`, `response_mode` and `state` are known carry `errorTarget`.\n */\nfunction parsePayload(\n  jwt: string,\n  head: Header,\n  payload: JsonObject,\n  opts: ParseRequestOptions\n): AuthorizationRequest {\n  const mode = payload.response_mode;\n  if (mode !== 'direct_post' && mode !== 'direct_post.jwt') {\n    throw new Oid4vpError('unsupported_response_mode');\n  }\n  const responseUri = payload.response_uri;\n  if (typeof responseUri !== 'string') malformed();\n  if (\n    !isFetchableUrl(responseUri, {\n      allowHttp: opts.allowHttp ?? false,\n      allowLocal: opts.allowLocal ?? false,\n    })\n  ) {\n    throw new Oid4vpError('insecure_response_uri');\n  }\n  const state = payload.state;\n  if (\n    state !== undefined &&\n    (typeof state !== 'string' || !URL_SAFE.test(state))\n  )\n    malformed();\n\n  const encryption =\n    mode === 'direct_post.jwt'\n      ? chooseEncryption(payload.client_metadata)\n      : null;\n  const target: AuthorizationErrorTarget = {\n    clientId: head.clientId,\n    responseUri,\n    responseMode: mode,\n    ...(state !== undefined ? { state } : {}),\n    ...(encryption\n      ? {\n          responseEncryptionJwk: encryption.jwk,\n          responseEncryptionEnc: encryption.enc,\n        }\n      : {}),\n  };\n  const refuse = (code: Oid4vpErrorCode, feature?: string): Oid4vpError =>\n    new Oid4vpError(code, undefined, {\n      ...(feature !== undefined ? { feature } : {}),\n      errorTarget: target,\n    });\n\n  // §8.3.1: a wallet that cannot encrypt MAY send an unencrypted error response.\n  if (mode === 'direct_post.jwt' && !encryption)\n    throw refuse('unsupported_encryption');\n  // §8.2: redirect_uri with direct_post → invalid_request error response.\n  if (payload.redirect_uri !== undefined) throw refuse('malformed_request');\n  if (payload.response_type !== 'vp_token')\n    throw refuse('unsupported_request', 'response_type');\n  if (payload.transaction_data !== undefined)\n    throw refuse('unsupported_request', 'transaction_data');\n  if (payload.scope !== undefined) throw refuse('unsupported_request', 'scope');\n  const nonce = payload.nonce;\n  if (typeof nonce !== 'string' || !URL_SAFE.test(nonce))\n    throw refuse('malformed_request');\n  let dcql: DcqlQuery;\n  try {\n    dcql = validateDcql(payload.dcql_query);\n  } catch (e) {\n    if (e instanceof Oid4vpError) throw refuse(e.code, e.feature);\n    throw e;\n  }\n  return {\n    jwt,\n    clientId: head.clientId,\n    clientDid: head.clientDid,\n    kid: head.kid,\n    responseUri,\n    responseMode: mode,\n    nonce,\n    ...(state !== undefined ? { state } : {}),\n    dcql,\n    ...(encryption\n      ? {\n          responseEncryptionJwk: encryption.jwk,\n          responseEncryptionEnc: encryption.enc,\n        }\n      : {}),\n    ...(typeof payload.exp === 'number' ? { exp: payload.exp } : {}),\n    ...(typeof payload.iat === 'number' ? { iat: payload.iat } : {}),\n  };\n}\n\nexport interface VerifyAuthorizationRequestOptions {\n  resolver: DidResolver;\n  /** ms since the epoch; default `Date.now()`. */\n  now?: number;\n  /** Accept an http `response_uri` on a loopback host (local development only; needs `allowLocal`). */\n  allowHttp?: boolean;\n  /** Accept a `response_uri` on a loopback / private / local-name host (local development only). */\n  allowLocal?: boolean;\n  /**\n   * The `client_id` of the Authorization Request that pointed here (`parseWalletLink`): the\n   * request object's must be identical (§5.10.1), else `malformed_request`.\n   */\n  expectedClientId?: string;\n  /** Refuse a request object without `exp` (the Credentials worker's deposit rule). Default false. */\n  requireExpiry?: boolean;\n}\n\n/**\n * Verify a request object as a wallet (or the Credentials worker) must before acting on it:\n * typ, client_id (and `expectedClientId`), `aud`/`iat`/`exp` when present (lifetime at most\n * 24 h), the signature by a key of the client_id DID named by `kid` (listed under\n * `authentication` or `assertionMethod`, controlled by that DID), then the supported response\n * mode, a public https response URI, nonce and state, encryption parameters and DCQL. Throws\n * `Oid4vpError` (with `errorTarget` when the verifier can be told, see `sendAuthorizationError`);\n * `ResolverUnavailable` propagates.\n */\nexport async function verifyAuthorizationRequest(\n  jwt: string,\n  opts: VerifyAuthorizationRequestOptions\n): Promise<AuthorizationRequest> {\n  if (typeof jwt !== 'string' || jwt.length > MAX_REQUEST_OBJECT_LENGTH) {\n    malformed();\n  }\n  let jws;\n  try {\n    jws = decodeJws(jwt.trim());\n  } catch {\n    malformed();\n  }\n  const parseOpts: ParseRequestOptions = {\n    allowHttp: opts.allowHttp ?? false,\n    allowLocal: opts.allowLocal ?? false,\n    nowS: toSeconds(clockMs(opts.now)),\n    requireExpiry: opts.requireExpiry ?? false,\n  };\n  const head = checkHeader(jws.header, jws.payload, opts.expectedClientId);\n  checkTimes(jws.payload, parseOpts);\n  let doc;\n  try {\n    doc = await opts.resolver(head.clientDid);\n  } catch (e) {\n    if (e instanceof ResolverUnavailable) throw e;\n    throw new Oid4vpError('unknown_verifier');\n  }\n  if (!doc) throw new Oid4vpError('unknown_verifier');\n  const key =\n    findKey(doc, head.kid, 'authentication') ??\n    findKey(doc, head.kid, 'assertionMethod');\n  if (!key) throw new Oid4vpError('unknown_key');\n  if (!verifyEd25519(jws.signature, utf8(jws.signingInput), key.publicKey)) {\n    throw new Oid4vpError('bad_signature');\n  }\n  return parsePayload(jwt.trim(), head, jws.payload, parseOpts);\n}\n\n/**\n * The request a verifier created, read back from its own JWT WITHOUT checking the signature or\n * the clock (use only for a request object you produced and stored yourself).\n */\nexport function decodeOwnAuthorizationRequest(\n  jwt: string,\n  opts: HostPolicy = {}\n): AuthorizationRequest {\n  let jws;\n  try {\n    jws = decodeJws(jwt.trim());\n  } catch {\n    malformed();\n  }\n  const parseOpts: ParseRequestOptions = {\n    allowHttp: opts.allowHttp ?? false,\n    allowLocal: opts.allowLocal ?? false,\n    nowS: null,\n    requireExpiry: false,\n  };\n  const head = checkHeader(jws.header, jws.payload, undefined);\n  checkTimes(jws.payload, parseOpts);\n  return parsePayload(jwt.trim(), head, jws.payload, parseOpts);\n}\n\n// ---------------------------------------------------------------------------------------------\n// Wallet: presentation and response.\n\nexport interface CreatePresentationInput {\n  /** The held SD-JWT (as issued: `<jwt>~<disclosures>~`). */\n  sdjwt: string;\n  /** Claim names to disclose (from `matchCredential`). */\n  disclose: readonly string[];\n  /** The holder key the credential's `cnf` names. */\n  signer: Pick<Signer, 'sign'>;\n  /** The verifier's full client_id. */\n  audience: string;\n  nonce: string;\n  /** ms since the epoch; default `Date.now()`. */\n  now?: number;\n}\n\n/** An SD-JWT+KB with only the chosen disclosures and a fresh KB-JWT (RFC 9901 §4.3). */\nexport async function createPresentation(\n  input: CreatePresentationInput\n): Promise<string> {\n  const parsed = parseSdJwt(input.sdjwt.trim());\n  if (parsed.kbJwt !== undefined) throw new SdJwtError('malformed');\n  const raws = selectDisclosures(parsed, input.disclose);\n  const base = serializeSdJwt(parsed.jwt, raws);\n  const kb = await signJws(\n    { alg: 'EdDSA', typ: 'kb+jwt' },\n    {\n      iat: toSeconds(clockMs(input.now)),\n      aud: input.audience,\n      nonce: input.nonce,\n      sd_hash: sdHash(base),\n    },\n    input.signer\n  );\n  return base + kb;\n}\n\n/** `{ <query id>: [<presentation>] }` */\nexport type VpToken = Record<string, string[]>;\n\nexport interface AuthorizationResponse {\n  url: string;\n  /** `application/x-www-form-urlencoded` body. */\n  body: string;\n  contentType: 'application/x-www-form-urlencoded';\n}\n\nfunction checkVpToken(vpToken: unknown, dcql: DcqlQuery | null): VpToken {\n  if (!isRecord(vpToken)) throw new Oid4vpError('malformed_response');\n  const ids = dcql ? new Set(dcql.credentials.map(c => c.id)) : null;\n  const out = Object.create(null) as VpToken;\n  for (const [id, list] of Object.entries(vpToken)) {\n    if (ids && !ids.has(id)) throw new Oid4vpError('malformed_response');\n    if (\n      !Array.isArray(list) ||\n      list.length !== 1 ||\n      !list.every(p => typeof p === 'string' && p.length > 0)\n    ) {\n      throw new Oid4vpError('malformed_response');\n    }\n    out[id] = [...(list as string[])];\n  }\n  if (Object.keys(out).length === 0)\n    throw new Oid4vpError('malformed_response');\n  return out;\n}\n\nasync function formBody(\n  target: AuthorizationErrorTarget,\n  members: JsonObject\n): Promise<string> {\n  const params = new URLSearchParams();\n  const withState = {\n    ...members,\n    ...(target.state !== undefined ? { state: target.state } : {}),\n  };\n  if (\n    target.responseMode === 'direct_post.jwt' &&\n    target.responseEncryptionJwk\n  ) {\n    params.set(\n      'response',\n      await encryptJwe(\n        withState,\n        target.responseEncryptionJwk,\n        target.responseEncryptionEnc ?? DEFAULT_RESPONSE_ENCRYPTION_ENC\n      )\n    );\n  } else {\n    for (const [k, v] of Object.entries(withState))\n      params.set(k, typeof v === 'string' ? v : JSON.stringify(v));\n  }\n  return params.toString();\n}\n\n/**\n * The POST the wallet sends to the response URI: form-encoded `vp_token` (JSON) + `state`, or,\n * for `direct_post.jwt`, `response=<JWE>` (the `enc` the request chose) whose payload carries\n * `vp_token` and `state`.\n */\nexport async function createAuthorizationResponse(input: {\n  request: AuthorizationRequest;\n  vpToken: VpToken;\n}): Promise<AuthorizationResponse> {\n  const { request } = input;\n  const vpToken = checkVpToken(input.vpToken, request.dcql);\n  if (\n    request.responseMode === 'direct_post.jwt' &&\n    !request.responseEncryptionJwk\n  )\n    throw new Oid4vpError('unsupported_encryption');\n  return {\n    url: request.responseUri,\n    body: await formBody(request, { vp_token: vpToken }),\n    contentType: 'application/x-www-form-urlencoded',\n  };\n}\n\n/** OpenID4VP §8.5 / RFC 6749 §4.1.2.1 error codes a wallet sends. */\nexport type AuthorizationErrorCode =\n  | 'invalid_request'\n  | 'access_denied'\n  | 'invalid_client'\n  | 'invalid_scope'\n  | 'vp_formats_not_supported'\n  | 'invalid_request_uri_method'\n  | 'invalid_transaction_data'\n  | 'wallet_unavailable';\n\nconst AUTHORIZATION_ERROR_CODES = new Set<string>([\n  'invalid_request',\n  'access_denied',\n  'invalid_client',\n  'invalid_scope',\n  'vp_formats_not_supported',\n  'invalid_request_uri_method',\n  'invalid_transaction_data',\n  'wallet_unavailable',\n]);\n/** RFC 6749 `error_description` characters. */\nconst ERROR_DESCRIPTION = /^[\\x20-\\x21\\x23-\\x5b\\x5d-\\x7e]{1,300}$/;\n\n/**\n * The §8.5 error code for a refusal `verifyAuthorizationRequest` threw WITH an `errorTarget`;\n * null when the verifier is not to be told (no target: the request did not verify).\n */\nexport function authorizationErrorFor(\n  e: unknown\n): AuthorizationErrorCode | null {\n  if (!(e instanceof Oid4vpError) || !e.errorTarget) return null;\n  if (e.code === 'unsupported_request') {\n    if (e.feature === 'transaction_data') return 'invalid_transaction_data';\n    if (e.feature === 'format') return 'vp_formats_not_supported';\n    if (e.feature === 'scope') return 'invalid_scope';\n  }\n  return 'invalid_request';\n}\n\n/**\n * The form body of an error response (§8.5, §8.2): `error`, `error_description`, `state`;\n * encrypted as `response=<JWE>` for `direct_post.jwt` when the target has a usable key, else\n * plain (§8.3.1 allows an unencrypted error response). `errorDescription` must be RFC 6749\n * characters (printable ASCII without `\"` and `\\`), at most 300; never put personal data in it.\n */\nexport async function createAuthorizationErrorResponse(input: {\n  target: AuthorizationRequest | AuthorizationErrorTarget;\n  error: AuthorizationErrorCode;\n  errorDescription?: string;\n}): Promise<AuthorizationResponse> {\n  if (!AUTHORIZATION_ERROR_CODES.has(input.error))\n    throw new TypeError('error is not an OpenID4VP error code');\n  if (\n    input.errorDescription !== undefined &&\n    !ERROR_DESCRIPTION.test(input.errorDescription)\n  )\n    throw new TypeError(\n      'errorDescription must be printable ASCII without \" and \\\\ (at most 300)'\n    );\n  return {\n    url: input.target.responseUri,\n    body: await formBody(input.target, {\n      error: input.error,\n      ...(input.errorDescription !== undefined\n        ? { error_description: input.errorDescription }\n        : {}),\n    }),\n    contentType: 'application/x-www-form-urlencoded',\n  };\n}\n\nexport interface SendAuthorizationErrorInput extends HostPolicy {\n  /** A verified request, or `error.errorTarget` of a refusal. */\n  target: AuthorizationRequest | AuthorizationErrorTarget;\n  error: AuthorizationErrorCode;\n  errorDescription?: string;\n  fetch: FetchLike;\n  timeoutMs?: number;\n}\n\n/**\n * Tell the verifier the request will not be answered (OpenID4VP §8.5): POST the error response\n * to its response URI (no redirects, timeout, capped answer). Privacy (§15.9): do not send an\n * error that reveals whether a matching credential exists before the person has decided; use\n * `access_denied` after they declined. Returns `{ delivered, status, redirectUri? }`\n * (`delivered` = HTTP 200; `status` null when unreachable). Throws `TypeError` for a bad code or\n * description, `Oid4vpError('insecure_response_uri')` when the URI fails the host policy.\n */\nexport async function sendAuthorizationError(\n  input: SendAuthorizationErrorInput\n): Promise<{\n  delivered: boolean;\n  status: number | null;\n  redirectUri?: string;\n}> {\n  const policy = {\n    allowHttp: input.allowHttp ?? false,\n    allowLocal: input.allowLocal ?? false,\n  };\n  if (!isFetchableUrl(input.target.responseUri, policy))\n    throw new Oid4vpError('insecure_response_uri');\n  const res = await createAuthorizationErrorResponse(input);\n  let answer;\n  try {\n    answer = await httpRequest(input.fetch, res.url, {\n      method: 'POST',\n      headers: {\n        'content-type': res.contentType,\n        accept: 'application/json',\n      },\n      body: res.body,\n      maxBytes: 16 * 1024,\n      ...(input.timeoutMs !== undefined ? { timeoutMs: input.timeoutMs } : {}),\n    });\n  } catch {\n    return { delivered: false, status: null };\n  }\n  let redirectUri: string | undefined;\n  if (answer.status === 200) {\n    try {\n      const json: unknown = JSON.parse(answer.text);\n      if (\n        isRecord(json) &&\n        typeof json.redirect_uri === 'string' &&\n        // A fragment is normal here (§8.2 example: `#response_code=…`).\n        isFetchableUrl(json.redirect_uri.split('#')[0] ?? '', policy)\n      )\n        redirectUri = json.redirect_uri;\n    } catch {\n      // not JSON: delivered all the same\n    }\n  }\n  return {\n    delivered: answer.status === 200,\n    status: answer.status,\n    ...(redirectUri !== undefined ? { redirectUri } : {}),\n  };\n}\n\n// ---------------------------------------------------------------------------------------------\n// Verifier: response.\n\nexport interface ParsedAuthorizationResponse {\n  vpToken: VpToken;\n  state?: string;\n}\n\n/**\n * Read the wallet's POST body (form-encoded string or `URLSearchParams`). With `decryptionKey`\n * the body MUST be `response=<JWE>` (`A128GCM` or `A256GCM`; an unencrypted response is\n * refused); without it the body must be `vp_token=…`. Pass your `request` to make the key\n * mandatory for a `direct_post.jwt` request (TypeError without it). A wallet error response\n * (encrypted or not, §8.3.1) throws `Oid4vpError('wallet_error')` carrying the OAuth error code.\n */\nexport async function parseAuthorizationResponse(\n  body: string | URLSearchParams,\n  opts: { decryptionKey?: P256PrivateJwk; request?: AuthorizationRequest } = {}\n): Promise<ParsedAuthorizationResponse> {\n  if (opts.request?.responseMode === 'direct_post.jwt' && !opts.decryptionKey)\n    throw new TypeError(\n      'decryptionKey is required for a direct_post.jwt request'\n    );\n  if (typeof body === 'string' && body.length > MAX_RESPONSE_BODY_LENGTH) {\n    throw new Oid4vpError('malformed_response');\n  }\n  const params = typeof body === 'string' ? new URLSearchParams(body) : body;\n  const error = params.get('error');\n  if (error !== null) {\n    throw new Oid4vpError('wallet_error', walletErrorCode(error));\n  }\n  let vpToken: unknown;\n  let state: unknown;\n  const response = params.get('response');\n  if (opts.decryptionKey) {\n    if (response === null || params.has('vp_token')) {\n      throw new Oid4vpError('malformed_response');\n    }\n    let payload: JsonObject;\n    try {\n      payload = await decryptJwe(response, opts.decryptionKey);\n    } catch (e) {\n      if (e instanceof JweError && e.kind === 'malformed') {\n        throw new Oid4vpError('malformed_response');\n      }\n      throw new Oid4vpError('decryption_failed');\n    }\n    if (typeof payload.error === 'string') {\n      throw new Oid4vpError('wallet_error', walletErrorCode(payload.error));\n    }\n    vpToken =\n      typeof payload.vp_token === 'string'\n        ? parseJson(payload.vp_token)\n        : payload.vp_token;\n    state = payload.state;\n  } else {\n    if (response !== null) throw new Oid4vpError('decryption_failed');\n    const raw = params.get('vp_token');\n    if (raw === null) throw new Oid4vpError('malformed_response');\n    vpToken = parseJson(raw);\n    state = params.get('state') ?? undefined;\n  }\n  if (state !== undefined && typeof state !== 'string') {\n    throw new Oid4vpError('malformed_response');\n  }\n  return {\n    vpToken: checkVpToken(vpToken, null),\n    ...(typeof state === 'string' ? { state } : {}),\n  };\n}\n\n/**\n * The wallet's `error` as a code safe to log: it is attacker-controlled (anyone can POST to a\n * response URI), so only a token of `[A-Za-z0-9_.-]` (every OAuth / OpenID4VP code is one) is\n * kept; anything else becomes `invalid`.\n */\nfunction walletErrorCode(error: string): string {\n  return /^[A-Za-z0-9_.-]{1,64}$/.test(error) ? error : 'invalid';\n}\n\nfunction parseJson(s: string): unknown {\n  try {\n    return JSON.parse(s);\n  } catch {\n    throw new Oid4vpError('malformed_response');\n  }\n}\n\nexport type ResponseFailureCode =\n  | VerifyFailureCode\n  | 'missing_presentation'\n  | 'unexpected_presentation'\n  | 'missing_claim'\n  | 'value_mismatch';\n\nexport interface FailedQuery {\n  ok: false;\n  code: ResponseFailureCode;\n  /**\n   * True when the person you expected (`expectedSubject` in `policyFor`, matched) is proven to\n   * have sent this presentation for this request's nonce, and it still does not meet the policy\n   * or query. Always false when the policy has no `expectedSubject`. See `FailedPresentation`.\n   */\n  holderAuthenticated: boolean;\n  /**\n   * True when the KB-JWT verified for this request's nonce and audience with the presented\n   * credential's own `cnf` key: its holder answered, whoever that is. Never close on it alone.\n   */\n  keyBindingValid: boolean;\n}\n\nexport type QueryResult = VerifiedPresentation | FailedQuery;\n\nexport interface VerifyAuthorizationResponseInput {\n  vpToken: VpToken;\n  /** The request (from `verifyAuthorizationRequest` / `decodeOwnAuthorizationRequest`), or your own request JWT. */\n  request: AuthorizationRequest | string;\n  /** The verifier's policy for one credential query (audience, nonce and key binding are set from the request). */\n  policyFor: (\n    queryId: string\n  ) => Omit<VerifyPolicy, 'audience' | 'nonce' | 'requireKeyBinding'>;\n  deps: VerifyDeps;\n  /** The `state` the response carried; must equal the request's (required when the request has one). */\n  state?: string;\n}\n\nexport interface VerifiedAuthorizationResponse {\n  /** True only when every credential query was answered and verified. */\n  ok: boolean;\n  results: Record<string, QueryResult>;\n  /**\n   * True when every query's policy named `expectedSubject` and every result is either verified\n   * or a failure after that person was authenticated: the answer certainly came from the person\n   * you asked (close the request). False when any part could have come from someone else (keep\n   * the request open), and ALWAYS false when a policy has no `expectedSubject`: anyone holding a\n   * credential from an accepted issuer can answer such a request (OpenID4VP §14.2; for\n   * subject-less flows bind the answer to the browser session with a redirect URI and response\n   * code instead).\n   */\n  holderAuthenticated: boolean;\n  /**\n   * True when every result is either verified or a failure after the key binding held: each\n   * presentation was signed by the holder of the credential it carries, for this nonce and\n   * audience. It says nothing about who that holder is.\n   */\n  keyBindingValid: boolean;\n}\n\n/**\n * Verify every presentation in a `vp_token` against the request: one presentation per credential\n * query, each verified with `verifyPresentation` (KB-JWT `aud` = the request's client_id, `nonce`\n * = its nonce, key binding required), each meeting its query (vct, accepted issuers, every\n * requested claim present and, when `values` is given, matching; a requested `sub` or `iat` is\n * read from the issuer-signed credential), and all of them from the same holder (`sub` and\n * `cnf`). `ok` is true only when every query passed. Pass `expectedSubject` in every policy:\n * without it `holderAuthenticated` is false. Throws\n * `VerificationUnavailable` when a dependency is down and `Oid4vpError('state_mismatch')` when\n * the state differs from the request's (or is missing while the request has one).\n */\nexport async function verifyAuthorizationResponse(\n  input: VerifyAuthorizationResponseInput\n): Promise<VerifiedAuthorizationResponse> {\n  const request =\n    typeof input.request === 'string'\n      ? // Your own request: its response URI was checked when you created it.\n        decodeOwnAuthorizationRequest(input.request, {\n          allowHttp: true,\n          allowLocal: true,\n        })\n      : input.request;\n  if (input.state !== request.state) {\n    throw new Oid4vpError('state_mismatch');\n  }\n  // Null prototype: ids come from the wallet, `__proto__` stays a plain key.\n  const results = Object.create(null) as Record<string, QueryResult>;\n  const unbound = (code: ResponseFailureCode): FailedQuery => ({\n    ok: false,\n    code,\n    holderAuthenticated: false,\n    keyBindingValid: false,\n  });\n  // Queries whose policy named the person expected: only those can be holder-authenticated.\n  let everySubjectExpected = true;\n  const queryIds = new Set(request.dcql.credentials.map(q => q.id));\n  for (const id of Object.keys(input.vpToken)) {\n    if (!queryIds.has(id)) results[id] = unbound('unexpected_presentation');\n  }\n  for (const query of request.dcql.credentials) {\n    const policy = input.policyFor(query.id);\n    const subjectExpected = policy.expectedSubject !== undefined;\n    if (!subjectExpected) everySubjectExpected = false;\n    const list = input.vpToken[query.id];\n    if (list?.length !== 1 || typeof list[0] !== 'string') {\n      results[query.id] = unbound('missing_presentation');\n      continue;\n    }\n    const presentation = list[0];\n    const out = await verifyPresentation(\n      presentation,\n      {\n        ...policy,\n        audience: request.clientId,\n        nonce: request.nonce,\n        requireKeyBinding: true,\n      },\n      input.deps\n    );\n    if (!out.ok) {\n      results[query.id] = {\n        ok: false,\n        code: out.code,\n        holderAuthenticated: out.holderAuthenticated,\n        keyBindingValid: out.keyBindingValid,\n      };\n      continue;\n    }\n    // Verified with key binding: the holder of this credential answered.\n    const failQuery = (code: ResponseFailureCode): FailedQuery => ({\n      ok: false,\n      code,\n      holderAuthenticated: subjectExpected,\n      keyBindingValid: true,\n    });\n    if (!query.meta.vct_values.includes(out.vct)) {\n      results[query.id] = failQuery('wrong_type');\n      continue;\n    }\n    const issuers = issuerFilter(query);\n    if (issuers && !issuers.includes(out.issuer)) {\n      results[query.id] = failQuery('untrusted_issuer');\n      continue;\n    }\n    const visible = visibleClaims(out, presentation, requestedClaims(query));\n    let failure: FailedQuery | null = null;\n    for (const claim of requestedClaims(query)) {\n      const name = claim.path[0];\n      if (!Object.hasOwn(visible, name)) {\n        failure = failQuery('missing_claim');\n        break;\n      }\n      if (!valueMatches(visible[name], claim.values)) {\n        failure = failQuery('value_mismatch');\n        break;\n      }\n    }\n    results[query.id] = failure ?? out;\n  }\n  // Every presentation must come from one holder.\n  const verifiedOnes = Object.values(results).filter(\n    (r): r is VerifiedPresentation => r.ok\n  );\n  const first = verifiedOnes[0];\n  if (\n    first &&\n    verifiedOnes.some(\n      r => r.subject !== first.subject || r.holderKey?.x !== first.holderKey?.x\n    )\n  ) {\n    for (const [id, r] of Object.entries(results)) {\n      if (r.ok) results[id] = unbound('wrong_subject');\n    }\n  }\n  const all = Object.values(results);\n  return {\n    ok: all.every(r => r.ok),\n    results,\n    holderAuthenticated:\n      everySubjectExpected && all.every(r => r.ok || r.holderAuthenticated),\n    keyBindingValid: all.every(r => r.ok || r.keyBindingValid),\n  };\n}\n\n/** Registered claims a query may ask for that `VerifiedPresentation.claims` leaves out. */\nconst SIGNED_REGISTERED_CLAIMS = ['sub', 'iat'] as const;\n\n/**\n * The claims a verified presentation shows, for matching a query: `out.claims` plus a requested\n * `sub` / `iat`, read from the issuer-signed payload (with the presented disclosures in place,\n * so a disclosed `iat` counts and a withheld one does not). Only called after\n * `verifyPresentation` accepted `presentation`.\n */\nfunction visibleClaims(\n  out: VerifiedPresentation,\n  presentation: string,\n  claims: readonly DcqlClaimQuery[]\n): JsonObject {\n  const wanted = SIGNED_REGISTERED_CLAIMS.filter(name =>\n    claims.some(c => c.path[0] === name)\n  );\n  if (wanted.length === 0) return out.claims;\n  const visible: JsonObject = { ...out.claims, sub: out.subject };\n  if (wanted.includes('iat')) {\n    const parsed = parseSdJwt(presentation.trim());\n    const all = processDisclosures(parsed.payload, parsed.disclosures).claims;\n    if (typeof all.iat === 'number') visible.iat = all.iat;\n  }\n  return visible;\n}\n"]}

package/dist/chunk-46VRPQPD.js

@@ -0,0 +1,176 @@
+import { isFetchableUrl, isLoopbackHost } from './chunk-Q3MZNMCK.js';
+
+// src/display.ts
+var CARD_DISPLAY_MEMBERS = [
+  "background_color",
+  "text_color",
+  "logo_uri",
+  "background_image_uri"
+];
+var MAX_CARD_URI_LENGTH = 512;
+var CARD_COLOR_PATTERN = /^#[0-9a-fA-F]{6}$/;
+var MIN_TEXT_CONTRAST = 4.5;
+var CARD_LIGHT_TEXT = "#ffffff";
+var CARD_DARK_TEXT = "#111111";
+var CARD_HUES = Object.freeze([
+  "#0b5566",
+  // teal
+  "#1e3a8a",
+  // indigo blue
+  "#5b21b6",
+  // violet
+  "#9d174d",
+  // raspberry
+  "#7c2d12",
+  // rust
+  "#14532d",
+  // forest
+  "#334155",
+  // slate
+  "#155e75",
+  // deep cyan
+  "#86198f",
+  // plum
+  "#713f12"
+  // bronze
+]);
+var CARD_PATTERNS = 6;
+function parseCardColor(value) {
+  if (typeof value !== "string" || value.length !== 7) return void 0;
+  return CARD_COLOR_PATTERN.test(value) ? value.toLowerCase() : void 0;
+}
+var URL_REFUSED_CHARS = /[\u0000- \u007f-\u009f\\"'<>`?#]/;
+var RAW_AUTHORITY = /^https?:\/\/([^/]+)/i;
+function parseCardUri(value, policy = {}) {
+  if (typeof value !== "string") return void 0;
+  if (value.length === 0 || value.length > MAX_CARD_URI_LENGTH)
+    return void 0;
+  if (URL_REFUSED_CHARS.test(value)) return void 0;
+  const authority = RAW_AUTHORITY.exec(value)?.[1];
+  if (authority === void 0 || authority.includes("@")) return void 0;
+  if (!isFetchableUrl(value, policy)) return void 0;
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return void 0;
+  }
+  if (url.search !== "" || url.hash !== "") return void 0;
+  if (url.hostname.endsWith(".")) return void 0;
+  if (url.port !== "") {
+    const localDev = (policy.allowHttp ?? false) && (policy.allowLocal ?? false);
+    if (!localDev || !isLoopbackHost(url.hostname)) return void 0;
+  }
+  const href = url.href;
+  if (href.includes("?") || href.includes("#")) return void 0;
+  return href.length <= MAX_CARD_URI_LENGTH ? href : void 0;
+}
+function ownValue(obj, key) {
+  try {
+    const d = Object.getOwnPropertyDescriptor(obj, key);
+    return d && "value" in d ? d.value : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function parseCardDisplay(input, policy = {}) {
+  const out = {};
+  if (typeof input !== "object" || input === null || Array.isArray(input))
+    return out;
+  const background = parseCardColor(ownValue(input, "background_color"));
+  if (background !== void 0) out.background_color = background;
+  const text = parseCardColor(ownValue(input, "text_color"));
+  if (text !== void 0) out.text_color = text;
+  const logo = parseCardUri(ownValue(input, "logo_uri"), policy);
+  if (logo !== void 0) out.logo_uri = logo;
+  const image = parseCardUri(ownValue(input, "background_image_uri"), policy);
+  if (image !== void 0) out.background_image_uri = image;
+  return out;
+}
+function channel(hex, at) {
+  const c = Number.parseInt(hex.slice(at, at + 2), 16) / 255;
+  return c <= 0.04045 ? c / 12.92 : ((c + 0.055) / 1.055) ** 2.4;
+}
+function luminance(color) {
+  return 0.2126 * channel(color, 1) + 0.7152 * channel(color, 3) + 0.0722 * channel(color, 5);
+}
+function contrastRatio(a, b) {
+  const ca = parseCardColor(a);
+  const cb = parseCardColor(b);
+  if (ca === void 0 || cb === void 0)
+    throw new TypeError("contrastRatio takes two #rrggbb colours");
+  const la = luminance(ca);
+  const lb = luminance(cb);
+  return (Math.max(la, lb) + 0.05) / (Math.min(la, lb) + 0.05);
+}
+function readableOn(background) {
+  return contrastRatio(CARD_LIGHT_TEXT, background) >= contrastRatio(CARD_DARK_TEXT, background) ? CARD_LIGHT_TEXT : CARD_DARK_TEXT;
+}
+function fnv1a(text) {
+  let h = 2166136261;
+  for (const byte of new TextEncoder().encode(text)) {
+    h ^= byte;
+    h = Math.imul(h, 16777619) >>> 0;
+  }
+  return h >>> 0;
+}
+function didHash(did) {
+  return fnv1a(typeof did === "string" ? did : "");
+}
+function hueFor(hash) {
+  return CARD_HUES[hash % CARD_HUES.length];
+}
+var NAME_NOISE = /[\u0000-\u001f\u007f-\u009f]/g;
+var NAME_INVISIBLE = new RegExp(
+  "[\\u061c\\u180e\\u200b-\\u200f\\u202a-\\u202e\\u2060-\\u2064\\u2066-\\u2069\\ufeff]",
+  "g"
+);
+var MAX_NAME_SCAN = 256;
+function upperFirst(ch) {
+  const up = ch.toUpperCase();
+  return [...up][0] ?? ch;
+}
+function nameInitials(name) {
+  if (typeof name !== "string") return "";
+  const clean = name.slice(0, MAX_NAME_SCAN).normalize("NFC").replace(NAME_NOISE, " ").replace(NAME_INVISIBLE, "");
+  const initials = clean.split(/[^\p{L}\p{N}]+/u).map((word) => /\p{L}/u.exec(word)?.[0]).filter((ch) => ch !== void 0);
+  if (initials.length === 0) return "";
+  const first = upperFirst(initials[0]);
+  return initials.length === 1 ? first : first + upperFirst(initials[initials.length - 1]);
+}
+function didInitial(did) {
+  if (typeof did !== "string") return "?";
+  const parts = did.slice(0, MAX_NAME_SCAN).split(":");
+  const segment = parts.length > 2 ? parts[parts.length - 1] : "";
+  const word = parts[1] === "web" ? segment.split(".")[0] ?? segment : segment;
+  const ch = /\p{L}/u.exec(word)?.[0] ?? /\p{N}/u.exec(word)?.[0];
+  return ch === void 0 ? "?" : upperFirst(ch);
+}
+function monogramOf(name, did) {
+  return nameInitials(name) || didInitial(did);
+}
+function cardLook(input) {
+  input ??= { issuerDid: "" };
+  const hash = didHash(input.issuerDid);
+  const display = typeof input.display === "object" && input.display !== null ? input.display : {};
+  const background = parseCardColor(ownValue(display, "background_color")) ?? hueFor(hash);
+  const chosen = parseCardColor(ownValue(display, "text_color"));
+  const foreground = chosen !== void 0 && contrastRatio(chosen, background) >= MIN_TEXT_CONTRAST ? chosen : readableOn(background);
+  return {
+    background,
+    foreground,
+    monogram: monogramOf(input.issuerName, input.issuerDid),
+    pattern: (hash >>> 16) % CARD_PATTERNS
+  };
+}
+function markLook(input) {
+  input ??= { did: "" };
+  return {
+    color: parseCardColor(input.color) ?? hueFor(didHash(input.did)),
+    monogram: monogramOf(input.name, input.did)
+  };
+}
+
+export { CARD_COLOR_PATTERN, CARD_DARK_TEXT, CARD_DISPLAY_MEMBERS, CARD_HUES, CARD_LIGHT_TEXT, CARD_PATTERNS, MAX_CARD_URI_LENGTH, MIN_TEXT_CONTRAST, cardLook, contrastRatio, markLook, parseCardColor, parseCardDisplay, parseCardUri };
+//# sourceMappingURL=chunk-46VRPQPD.js.map
+//# sourceMappingURL=chunk-46VRPQPD.js.map

package/dist/chunk-46VRPQPD.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/display.ts"],"names":[],"mappings":";;;AAgCO,IAAM,oBAAA,GAAuB;AAAA,EAClC,kBAAA;AAAA,EACA,YAAA;AAAA,EACA,UAAA;AAAA,EACA;AACF;AAIO,IAAM,mBAAA,GAAsB;AAG5B,IAAM,kBAAA,GAAqB;AAG3B,IAAM,iBAAA,GAAoB;AAG1B,IAAM,eAAA,GAAkB;AACxB,IAAM,cAAA,GAAiB;AAMvB,IAAM,SAAA,GAA+B,OAAO,MAAA,CAAO;AAAA,EACxD,SAAA;AAAA;AAAA,EACA,SAAA;AAAA;AAAA,EACA,SAAA;AAAA;AAAA,EACA,SAAA;AAAA;AAAA,EACA,SAAA;AAAA;AAAA,EACA,SAAA;AAAA;AAAA,EACA,SAAA;AAAA;AAAA,EACA,SAAA;AAAA;AAAA,EACA,SAAA;AAAA;AAAA,EACA;AAAA;AACF,CAAC;AAGM,IAAM,aAAA,GAAgB;AAsBtB,SAAS,eAAe,KAAA,EAAoC;AACjE,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,MAAA,KAAW,GAAG,OAAO,MAAA;AAC5D,EAAA,OAAO,mBAAmB,IAAA,CAAK,KAAK,CAAA,GAAI,KAAA,CAAM,aAAY,GAAI,MAAA;AAChE;AAMA,IAAM,iBAAA,GAAoB,kCAAA;AAE1B,IAAM,aAAA,GAAgB,sBAAA;AAoBf,SAAS,YAAA,CACd,KAAA,EACA,MAAA,GAAqB,EAAC,EACF;AACpB,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,MAAA;AACtC,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,IAAK,KAAA,CAAM,MAAA,GAAS,mBAAA;AACvC,IAAA,OAAO,MAAA;AACT,EAAA,IAAI,iBAAA,CAAkB,IAAA,CAAK,KAAK,CAAA,EAAG,OAAO,MAAA;AAG1C,EAAA,MAAM,SAAA,GAAY,aAAA,CAAc,IAAA,CAAK,KAAK,IAAI,CAAC,CAAA;AAC/C,EAAA,IAAI,cAAc,MAAA,IAAa,SAAA,CAAU,QAAA,CAAS,GAAG,GAAG,OAAO,MAAA;AAC/D,EAAA,IAAI,CAAC,cAAA,CAAe,KAAA,EAAO,MAAM,GAAG,OAAO,MAAA;AAC3C,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,IAAI,IAAI,KAAK,CAAA;AAAA,EACrB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,IAAI,IAAI,MAAA,KAAW,EAAA,IAAM,GAAA,CAAI,IAAA,KAAS,IAAI,OAAO,MAAA;AACjD,EAAA,IAAI,GAAA,CAAI,QAAA,CAAS,QAAA,CAAS,GAAG,GAAG,OAAO,MAAA;AACvC,EAAA,IAAI,GAAA,CAAI,SAAS,EAAA,EAAI;AACnB,IAAA,MAAM,QAAA,GAAA,CACH,MAAA,CAAO,SAAA,IAAa,KAAA,MAAW,OAAO,UAAA,IAAc,KAAA,CAAA;AACvD,IAAA,IAAI,CAAC,QAAA,IAAY,CAAC,eAAe,GAAA,CAAI,QAAQ,GAAG,OAAO,MAAA;AAAA,EACzD;AACA,EAAA,MAAM,OAAO,GAAA,CAAI,IAAA;AACjB,EAAA,IAAI,IAAA,CAAK,SAAS,GAAG,CAAA,IAAK,KAAK,QAAA,CAAS,GAAG,GAAG,OAAO,MAAA;AACrD,EAAA,OAAO,IAAA,CAAK,MAAA,IAAU,mBAAA,GAAsB,IAAA,GAAO,MAAA;AACrD;AAGA,SAAS,QAAA,CAAS,KAAa,GAAA,EAAsB;AACnD,EAAA,IAAI;AACF,IAAA,MAAM,CAAA,GAAI,MAAA,CAAO,wBAAA,CAAyB,GAAA,EAAK,GAAG,CAAA;AAClD,IAAA,OAAO,CAAA,IAAK,OAAA,IAAW,CAAA,GAAK,CAAA,CAAE,KAAA,GAAoB,KAAA,CAAA;AAAA,EACpD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAOO,SAAS,gBAAA,CACd,KAAA,EACA,MAAA,GAAqB,EAAC,EACT;AACb,EAAA,MAAM,MAAmB,EAAC;AAC1B,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,UAAU,IAAA,IAAQ,KAAA,CAAM,QAAQ,KAAK,CAAA;AACpE,IAAA,OAAO,GAAA;AACT,EAAA,MAAM,UAAA,GAAa,cAAA,CAAe,QAAA,CAAS,KAAA,EAAO,kBAAkB,CAAC,CAAA;AACrE,EAAA,IAAI,UAAA,KAAe,MAAA,EAAW,GAAA,CAAI,gBAAA,GAAmB,UAAA;AACrD,EAAA,MAAM,IAAA,GAAO,cAAA,CAAe,QAAA,CAAS,KAAA,EAAO,YAAY,CAAC,CAAA;AACzD,EAAA,IAAI,IAAA,KAAS,MAAA,EAAW,GAAA,CAAI,UAAA,GAAa,IAAA;AACzC,EAAA,MAAM,OAAO,YAAA,CAAa,QAAA,CAAS,KAAA,EAAO,UAAU,GAAG,MAAM,CAAA;AAC7D,EAAA,IAAI,IAAA,KAAS,MAAA,EAAW,GAAA,CAAI,QAAA,GAAW,IAAA;AACvC,EAAA,MAAM,QAAQ,YAAA,CAAa,QAAA,CAAS,KAAA,EAAO,sBAAsB,GAAG,MAAM,CAAA;AAC1E,EAAA,IAAI,KAAA,KAAU,MAAA,EAAW,GAAA,CAAI,oBAAA,GAAuB,KAAA;AACpD,EAAA,OAAO,GAAA;AACT;AAKA,SAAS,OAAA,CAAQ,KAAa,EAAA,EAAoB;AAChD,EAAA,MAAM,CAAA,GAAI,MAAA,CAAO,QAAA,CAAS,GAAA,CAAI,KAAA,CAAM,IAAI,EAAA,GAAK,CAAC,CAAA,EAAG,EAAE,CAAA,GAAI,GAAA;AACvD,EAAA,OAAO,KAAK,OAAA,GAAU,CAAA,GAAI,KAAA,GAAA,CAAA,CAAU,CAAA,GAAI,SAAS,KAAA,KAAU,GAAA;AAC7D;AAEA,SAAS,UAAU,KAAA,EAAuB;AACxC,EAAA,OACE,MAAA,GAAS,OAAA,CAAQ,KAAA,EAAO,CAAC,CAAA,GACzB,MAAA,GAAS,OAAA,CAAQ,KAAA,EAAO,CAAC,CAAA,GACzB,MAAA,GAAS,OAAA,CAAQ,OAAO,CAAC,CAAA;AAE7B;AAMO,SAAS,aAAA,CAAc,GAAW,CAAA,EAAmB;AAC1D,EAAA,MAAM,EAAA,GAAK,eAAe,CAAC,CAAA;AAC3B,EAAA,MAAM,EAAA,GAAK,eAAe,CAAC,CAAA;AAC3B,EAAA,IAAI,EAAA,KAAO,UAAa,EAAA,KAAO,MAAA;AAC7B,IAAA,MAAM,IAAI,UAAU,yCAAyC,CAAA;AAC/D,EAAA,MAAM,EAAA,GAAK,UAAU,EAAE,CAAA;AACvB,EAAA,MAAM,EAAA,GAAK,UAAU,EAAE,CAAA;AACvB,EAAA,OAAA,CAAQ,IAAA,CAAK,GAAA,CAAI,EAAA,EAAI,EAAE,CAAA,GAAI,SAAS,IAAA,CAAK,GAAA,CAAI,EAAA,EAAI,EAAE,CAAA,GAAI,IAAA,CAAA;AACzD;AAGA,SAAS,WAAW,UAAA,EAA4B;AAC9C,EAAA,OAAO,aAAA,CAAc,iBAAiB,UAAU,CAAA,IAC9C,cAAc,cAAA,EAAgB,UAAU,IACtC,eAAA,GACA,cAAA;AACN;AAMA,SAAS,MAAM,IAAA,EAAsB;AACnC,EAAA,IAAI,CAAA,GAAI,UAAA;AACR,EAAA,KAAA,MAAW,QAAQ,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,IAAI,CAAA,EAAG;AACjD,IAAA,CAAA,IAAK,IAAA;AACL,IAAA,CAAA,GAAI,IAAA,CAAK,IAAA,CAAK,CAAA,EAAG,QAAU,CAAA,KAAM,CAAA;AAAA,EACnC;AACA,EAAA,OAAO,CAAA,KAAM,CAAA;AACf;AAEA,SAAS,QAAQ,GAAA,EAAsB;AACrC,EAAA,OAAO,KAAA,CAAM,OAAO,GAAA,KAAQ,QAAA,GAAW,MAAM,EAAE,CAAA;AACjD;AAGA,SAAS,OAAO,IAAA,EAAsB;AACpC,EAAA,OAAO,SAAA,CAAU,IAAA,GAAO,SAAA,CAAU,MAAM,CAAA;AAC1C;AAGA,IAAM,UAAA,GAAa,+BAAA;AACnB,IAAM,iBAAiB,IAAI,MAAA;AAAA,EACzB,qFAAA;AAAA,EACA;AACF,CAAA;AAEA,IAAM,aAAA,GAAgB,GAAA;AAEtB,SAAS,WAAW,EAAA,EAAoB;AACtC,EAAA,MAAM,EAAA,GAAK,GAAG,WAAA,EAAY;AAC1B,EAAA,OAAO,CAAC,GAAG,EAAE,CAAA,CAAE,CAAC,CAAA,IAAK,EAAA;AACvB;AAGA,SAAS,aAAa,IAAA,EAAuB;AAC3C,EAAA,IAAI,OAAO,IAAA,KAAS,QAAA,EAAU,OAAO,EAAA;AACrC,EAAA,MAAM,KAAA,GAAQ,IAAA,CACX,KAAA,CAAM,CAAA,EAAG,aAAa,CAAA,CACtB,SAAA,CAAU,KAAK,CAAA,CACf,QAAQ,UAAA,EAAY,GAAG,CAAA,CACvB,OAAA,CAAQ,gBAAgB,EAAE,CAAA;AAC7B,EAAA,MAAM,WAAW,KAAA,CACd,KAAA,CAAM,iBAAiB,CAAA,CACvB,GAAA,CAAI,UAAQ,QAAA,CAAS,IAAA,CAAK,IAAI,CAAA,GAAI,CAAC,CAAC,CAAA,CACpC,OAAO,CAAC,EAAA,KAAqB,OAAO,MAAS,CAAA;AAChD,EAAA,IAAI,QAAA,CAAS,MAAA,KAAW,CAAA,EAAG,OAAO,EAAA;AAClC,EAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,QAAA,CAAS,CAAC,CAAE,CAAA;AACrC,EAAA,OAAO,QAAA,CAAS,MAAA,KAAW,CAAA,GACvB,KAAA,GACA,KAAA,GAAQ,WAAW,QAAA,CAAS,QAAA,CAAS,MAAA,GAAS,CAAC,CAAE,CAAA;AACvD;AAMA,SAAS,WAAW,GAAA,EAAsB;AACxC,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,EAAU,OAAO,GAAA;AACpC,EAAA,MAAM,QAAQ,GAAA,CAAI,KAAA,CAAM,GAAG,aAAa,CAAA,CAAE,MAAM,GAAG,CAAA;AACnD,EAAA,MAAM,OAAA,GAAU,MAAM,MAAA,GAAS,CAAA,GAAI,MAAM,KAAA,CAAM,MAAA,GAAS,CAAC,CAAA,GAAK,EAAA;AAC9D,EAAA,MAAM,IAAA,GACJ,KAAA,CAAM,CAAC,CAAA,KAAM,KAAA,GAAS,OAAA,CAAQ,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,IAAK,OAAA,GAAW,OAAA;AAC5D,EAAA,MAAM,EAAA,GAAK,QAAA,CAAS,IAAA,CAAK,IAAI,CAAA,GAAI,CAAC,CAAA,IAAK,QAAA,CAAS,IAAA,CAAK,IAAI,CAAA,GAAI,CAAC,CAAA;AAC9D,EAAA,OAAO,EAAA,KAAO,MAAA,GAAY,GAAA,GAAM,UAAA,CAAW,EAAE,CAAA;AAC/C;AAEA,SAAS,UAAA,CAAW,MAAe,GAAA,EAAsB;AACvD,EAAA,OAAO,YAAA,CAAa,IAAI,CAAA,IAAK,UAAA,CAAW,GAAG,CAAA;AAC7C;AAUO,SAAS,SAAS,KAAA,EAIZ;AACX,EAAA,KAAA,KAAU,EAAE,WAAW,EAAA,EAAG;AAC1B,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,KAAA,CAAM,SAAS,CAAA;AACpC,EAAA,MAAM,OAAA,GACJ,OAAO,KAAA,CAAM,OAAA,KAAY,QAAA,IAAY,MAAM,OAAA,KAAY,IAAA,GAClD,KAAA,CAAM,OAAA,GACP,EAAC;AACP,EAAA,MAAM,UAAA,GACJ,eAAe,QAAA,CAAS,OAAA,EAAS,kBAAkB,CAAC,CAAA,IAAK,OAAO,IAAI,CAAA;AACtE,EAAA,MAAM,MAAA,GAAS,cAAA,CAAe,QAAA,CAAS,OAAA,EAAS,YAAY,CAAC,CAAA;AAC7D,EAAA,MAAM,UAAA,GACJ,MAAA,KAAW,MAAA,IACX,aAAA,CAAc,MAAA,EAAQ,UAAU,CAAA,IAAK,iBAAA,GACjC,MAAA,GACA,UAAA,CAAW,UAAU,CAAA;AAC3B,EAAA,OAAO;AAAA,IACL,UAAA;AAAA,IACA,UAAA;AAAA,IACA,QAAA,EAAU,UAAA,CAAW,KAAA,CAAM,UAAA,EAAY,MAAM,SAAS,CAAA;AAAA,IACtD,OAAA,EAAA,CAAU,SAAS,EAAA,IAAM;AAAA,GAC3B;AACF;AAMO,SAAS,SAAS,KAAA,EAIZ;AACX,EAAA,KAAA,KAAU,EAAE,KAAK,EAAA,EAAG;AACpB,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,eAAe,KAAA,CAAM,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAA,CAAM,GAAG,CAAC,CAAA;AAAA,IAC/D,QAAA,EAAU,UAAA,CAAW,KAAA,CAAM,IAAA,EAAM,MAAM,GAAG;AAAA,GAC5C;AACF","file":"chunk-46VRPQPD.js","sourcesContent":["/**\n * `@ixo/credentials-kit/display` — the card look of a credential (SPEC §15.1): what an issuer may\n * set (`CardDisplay`), how it is validated (`parseCardDisplay`), and the look a wallet shows,\n * with a neutral fallback derived from the issuer DID (`cardLook`, `markLook`).\n *\n * Pure functions: no fetch, no dependencies, no Node built-ins (workerd, Node 22, browsers). The\n * image URLs are only validated here (https, default port, no query string or fragment: see\n * `parseCardUri`); a wallet that shows them fetches them itself under its own rules (the Auth Hub\n * proxies them: png, jpeg or webp, at most 256 KB and 2048 px per side, no animation, never SVG).\n *\n * Member names follow OpenID4VCI credential display metadata, flattened: `background_color`,\n * `text_color`, `logo.uri` → `logo_uri`, `background_image.uri` → `background_image_uri`.\n */\nimport {\n  isFetchableUrl,\n  isLoopbackHost,\n  type HostPolicy,\n} from './internal/http';\n\n/** The look an issuer may set for a credential. Every member is optional. */\nexport interface CardDisplay {\n  /** `#rrggbb`, lower case once parsed. */\n  background_color?: string;\n  /** `#rrggbb`; a wallet ignores it when its contrast with the background is below 4.5:1. */\n  text_color?: string;\n  /** https URL (default port, no query or fragment) of the issuer's mark (png, jpeg or webp), shown small. */\n  logo_uri?: string;\n  /** https URL (default port, no query or fragment) of an image that covers the card (png, jpeg or webp). */\n  background_image_uri?: string;\n}\n\n/** The members of `CardDisplay`, in a fixed order. */\nexport const CARD_DISPLAY_MEMBERS = [\n  'background_color',\n  'text_color',\n  'logo_uri',\n  'background_image_uri',\n] as const;\nexport type CardDisplayMember = (typeof CARD_DISPLAY_MEMBERS)[number];\n\n/** Longest accepted image URL (characters, before and after normalising). */\nexport const MAX_CARD_URI_LENGTH = 512;\n\n/** The only colour form accepted anywhere: `#rrggbb`. */\nexport const CARD_COLOR_PATTERN = /^#[0-9a-fA-F]{6}$/;\n\n/** Minimum WCAG contrast for the text colour an issuer chose (WCAG 2.x AA, normal text). */\nexport const MIN_TEXT_CONTRAST = 4.5;\n\n/** Foregrounds used when the issuer's text colour is missing or too faint. */\nexport const CARD_LIGHT_TEXT = '#ffffff';\nexport const CARD_DARK_TEXT = '#111111';\n\n/**\n * The fixed set of deep hues the neutral card picks from (by a hash of the issuer DID). Every\n * one has at least 7:1 contrast with white.\n */\nexport const CARD_HUES: readonly string[] = Object.freeze([\n  '#0b5566', // teal\n  '#1e3a8a', // indigo blue\n  '#5b21b6', // violet\n  '#9d174d', // raspberry\n  '#7c2d12', // rust\n  '#14532d', // forest\n  '#334155', // slate\n  '#155e75', // deep cyan\n  '#86198f', // plum\n  '#713f12', // bronze\n]);\n\n/** Number of generated card patterns; `pattern` is 0 … CARD_PATTERNS - 1. */\nexport const CARD_PATTERNS = 6;\n\n/** What a wallet draws for a card. Colours are `#rrggbb`, lower case. */\nexport interface CardLook {\n  background: string;\n  foreground: string;\n  /** 1–2 upper-case letters (`?` only when neither a name nor a DID gives one). */\n  monogram: string;\n  /** 0–5, from the issuer DID. */\n  pattern: number;\n}\n\n/** What a wallet draws for a party (issuer or verifier) mark. */\nexport interface MarkLook {\n  color: string;\n  monogram: string;\n}\n\n// ---------------------------------------------------------------------------------------------\n// Validation.\n\n/** A `#rrggbb` colour in lower case, or `undefined` for anything else (never throws). */\nexport function parseCardColor(value: unknown): string | undefined {\n  if (typeof value !== 'string' || value.length !== 7) return undefined;\n  return CARD_COLOR_PATTERN.test(value) ? value.toLowerCase() : undefined;\n}\n\n// Whitespace, controls and characters a URL never needs in its raw form (the WHATWG parser would\n// silently strip or rewrite some of them), plus `?` and `#`: a card image address never has a\n// query string or a fragment, not even an empty one (SPEC §15.4 L7).\n// eslint-disable-next-line no-control-regex\nconst URL_REFUSED_CHARS = /[\\u0000- \\u007f-\\u009f\\\\\"'<>`?#]/;\n/** `https://` or `http://` (any case) and the raw authority up to the first `/`. */\nconst RAW_AUTHORITY = /^https?:\\/\\/([^/]+)/i;\n\n/**\n * An image URL a wallet may fetch for a card (SPEC §15.1, §15.4 L7), returned in normalised form\n * (`URL.href`: lower-case scheme and host, IDN hosts in punycode, an explicit default port\n * removed), or `undefined` for anything else (never throws). Rules:\n * - https on the default port (`:443` is accepted and normalised away; any other port is refused);\n * - no query string and no fragment, not even an empty `?` or `#` (a per-person query string\n *   would turn the image into a tracking pixel; an odd port would turn the wallet's image proxy\n *   into a fetch relay);\n * - written as `https://host/…` (the parser's repairs of `https:host` or `https:///host` refused);\n * - the kit's fetchable-URL rules (`isFetchableUrl`): no user name or password (not even an\n *   empty `@`), a public host;\n * - no trailing dot on the host (`cdn.example.com.` is a second spelling of the same host);\n * - at most `MAX_CARD_URI_LENGTH` characters, before and after normalising.\n *\n * Local development (`allowHttp` and `allowLocal` together) also accepts http, and any port, on a\n * loopback host (`localhost`, `127.0.0.1`, `[::1]`) only; `allowLocal` alone also accepts https\n * on other local hosts on the default port. The query string and fragment rule has no exception.\n */\nexport function parseCardUri(\n  value: unknown,\n  policy: HostPolicy = {}\n): string | undefined {\n  if (typeof value !== 'string') return undefined;\n  if (value.length === 0 || value.length > MAX_CARD_URI_LENGTH)\n    return undefined;\n  if (URL_REFUSED_CHARS.test(value)) return undefined;\n  // The raw form must be `scheme://authority…` with a non-empty authority and no `@` in it: the\n  // WHATWG parser would quietly repair `https:host`, `https:///host` and an empty `https://@host`.\n  const authority = RAW_AUTHORITY.exec(value)?.[1];\n  if (authority === undefined || authority.includes('@')) return undefined;\n  if (!isFetchableUrl(value, policy)) return undefined;\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch {\n    return undefined;\n  }\n  // Belt and braces: the refused characters above already keep both out.\n  if (url.search !== '' || url.hash !== '') return undefined;\n  if (url.hostname.endsWith('.')) return undefined;\n  if (url.port !== '') {\n    const localDev =\n      (policy.allowHttp ?? false) && (policy.allowLocal ?? false);\n    if (!localDev || !isLoopbackHost(url.hostname)) return undefined;\n  }\n  const href = url.href;\n  if (href.includes('?') || href.includes('#')) return undefined;\n  return href.length <= MAX_CARD_URI_LENGTH ? href : undefined;\n}\n\n/** Own data property of a plain object, without running getters on anything inherited. */\nfunction ownValue(obj: object, key: string): unknown {\n  try {\n    const d = Object.getOwnPropertyDescriptor(obj, key);\n    return d && 'value' in d ? (d.value as unknown) : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Validate an issuer's `display` look: returns only the members that pass (colours `#rrggbb`,\n * normalised to lower case; URLs as `parseCardUri`). Unknown members, wrong types and anything\n * that is not an object give nothing. Never throws.\n */\nexport function parseCardDisplay(\n  input: unknown,\n  policy: HostPolicy = {}\n): CardDisplay {\n  const out: CardDisplay = {};\n  if (typeof input !== 'object' || input === null || Array.isArray(input))\n    return out;\n  const background = parseCardColor(ownValue(input, 'background_color'));\n  if (background !== undefined) out.background_color = background;\n  const text = parseCardColor(ownValue(input, 'text_color'));\n  if (text !== undefined) out.text_color = text;\n  const logo = parseCardUri(ownValue(input, 'logo_uri'), policy);\n  if (logo !== undefined) out.logo_uri = logo;\n  const image = parseCardUri(ownValue(input, 'background_image_uri'), policy);\n  if (image !== undefined) out.background_image_uri = image;\n  return out;\n}\n\n// ---------------------------------------------------------------------------------------------\n// Contrast (WCAG 2.x).\n\nfunction channel(hex: string, at: number): number {\n  const c = Number.parseInt(hex.slice(at, at + 2), 16) / 255;\n  return c <= 0.04045 ? c / 12.92 : ((c + 0.055) / 1.055) ** 2.4;\n}\n\nfunction luminance(color: string): number {\n  return (\n    0.2126 * channel(color, 1) +\n    0.7152 * channel(color, 3) +\n    0.0722 * channel(color, 5)\n  );\n}\n\n/**\n * WCAG contrast ratio of two `#rrggbb` colours, 1 … 21 (order does not matter). Throws\n * `TypeError` for anything that is not `#rrggbb`.\n */\nexport function contrastRatio(a: string, b: string): number {\n  const ca = parseCardColor(a);\n  const cb = parseCardColor(b);\n  if (ca === undefined || cb === undefined)\n    throw new TypeError('contrastRatio takes two #rrggbb colours');\n  const la = luminance(ca);\n  const lb = luminance(cb);\n  return (Math.max(la, lb) + 0.05) / (Math.min(la, lb) + 0.05);\n}\n\n/** White or near-black, whichever contrasts more with `background` (white on a tie). */\nfunction readableOn(background: string): string {\n  return contrastRatio(CARD_LIGHT_TEXT, background) >=\n    contrastRatio(CARD_DARK_TEXT, background)\n    ? CARD_LIGHT_TEXT\n    : CARD_DARK_TEXT;\n}\n\n// ---------------------------------------------------------------------------------------------\n// The neutral look, derived from the DID.\n\n/** FNV-1a (32-bit) over the UTF-8 bytes of `text`: the same number in every runtime. */\nfunction fnv1a(text: string): number {\n  let h = 0x811c9dc5;\n  for (const byte of new TextEncoder().encode(text)) {\n    h ^= byte;\n    h = Math.imul(h, 0x01000193) >>> 0;\n  }\n  return h >>> 0;\n}\n\nfunction didHash(did: unknown): number {\n  return fnv1a(typeof did === 'string' ? did : '');\n}\n\n/** The neutral colour for a DID: `CARD_HUES[fnv1a(did) % CARD_HUES.length]`. */\nfunction hueFor(hash: number): string {\n  return CARD_HUES[hash % CARD_HUES.length]!;\n}\n\n// eslint-disable-next-line no-control-regex\nconst NAME_NOISE = /[\\u0000-\\u001f\\u007f-\\u009f]/g;\nconst NAME_INVISIBLE = new RegExp(\n  '[\\\\u061c\\\\u180e\\\\u200b-\\\\u200f\\\\u202a-\\\\u202e\\\\u2060-\\\\u2064\\\\u2066-\\\\u2069\\\\ufeff]',\n  'g'\n);\n/** Longest name the monogram looks at. */\nconst MAX_NAME_SCAN = 256;\n\nfunction upperFirst(ch: string): string {\n  const up = ch.toUpperCase();\n  return [...up][0] ?? ch;\n}\n\n/** First and last word initials of a name (letters only), or '' when it has no letter. */\nfunction nameInitials(name: unknown): string {\n  if (typeof name !== 'string') return '';\n  const clean = name\n    .slice(0, MAX_NAME_SCAN)\n    .normalize('NFC')\n    .replace(NAME_NOISE, ' ')\n    .replace(NAME_INVISIBLE, '');\n  const initials = clean\n    .split(/[^\\p{L}\\p{N}]+/u)\n    .map(word => /\\p{L}/u.exec(word)?.[0])\n    .filter((ch): ch is string => ch !== undefined);\n  if (initials.length === 0) return '';\n  const first = upperFirst(initials[0]!);\n  return initials.length === 1\n    ? first\n    : first + upperFirst(initials[initials.length - 1]!);\n}\n\n/**\n * One character from a DID: the last `:` segment of its method-specific id (for did:web, the\n * first label of that segment's host), first letter, else first digit; `?` when there is none.\n */\nfunction didInitial(did: unknown): string {\n  if (typeof did !== 'string') return '?';\n  const parts = did.slice(0, MAX_NAME_SCAN).split(':');\n  const segment = parts.length > 2 ? parts[parts.length - 1]! : '';\n  const word =\n    parts[1] === 'web' ? (segment.split('.')[0] ?? segment) : segment;\n  const ch = /\\p{L}/u.exec(word)?.[0] ?? /\\p{N}/u.exec(word)?.[0];\n  return ch === undefined ? '?' : upperFirst(ch);\n}\n\nfunction monogramOf(name: unknown, did: unknown): string {\n  return nameInitials(name) || didInitial(did);\n}\n\n/**\n * The look of a credential's card. `background` is the issuer's `background_color`, else a deep\n * hue picked by the DID hash from `CARD_HUES`; `foreground` is the issuer's `text_color` when it\n * has at least 4.5:1 contrast with the background, else white or near-black, whichever contrasts\n * more; `monogram` is 1–2 upper-case initials of `issuerName` (or one character from the DID);\n * `pattern` is 0–5 from the DID hash. `display` may be unvalidated: only valid colours are used.\n * Never throws.\n */\nexport function cardLook(input: {\n  display?: CardDisplay | null;\n  issuerDid: string;\n  issuerName?: string | null;\n}): CardLook {\n  input ??= { issuerDid: '' };\n  const hash = didHash(input.issuerDid);\n  const display: Partial<Record<string, unknown>> =\n    typeof input.display === 'object' && input.display !== null\n      ? (input.display as Record<string, unknown>)\n      : {};\n  const background =\n    parseCardColor(ownValue(display, 'background_color')) ?? hueFor(hash);\n  const chosen = parseCardColor(ownValue(display, 'text_color'));\n  const foreground =\n    chosen !== undefined &&\n    contrastRatio(chosen, background) >= MIN_TEXT_CONTRAST\n      ? chosen\n      : readableOn(background);\n  return {\n    background,\n    foreground,\n    monogram: monogramOf(input.issuerName, input.issuerDid),\n    pattern: (hash >>> 16) % CARD_PATTERNS,\n  };\n}\n\n/**\n * The mark of a party (issuer or verifier, e.g. in inbox rows): its `color` when valid, else the\n * same DID-derived hue `cardLook` uses; the same monogram rule. Never throws.\n */\nexport function markLook(input: {\n  color?: string | null;\n  did: string;\n  name?: string | null;\n}): MarkLook {\n  input ??= { did: '' };\n  return {\n    color: parseCardColor(input.color) ?? hueFor(didHash(input.did)),\n    monogram: monogramOf(input.name, input.did),\n  };\n}\n"]}

package/dist/chunk-AQ3IINHC.js

@@ -0,0 +1,138 @@
+// src/internal/bytes.ts
+var te = new TextEncoder();
+var td = new TextDecoder("utf-8", { fatal: true });
+function utf8(s) {
+  return te.encode(s);
+}
+function fromUtf8(bytes) {
+  return td.decode(bytes);
+}
+var B64URL = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+var B64URL_LOOKUP = (() => {
+  const t = new Int16Array(128).fill(-1);
+  for (let i = 0; i < B64URL.length; i++) t[B64URL.charCodeAt(i)] = i;
+  return t;
+})();
+function base64urlEncode(bytes) {
+  let out = "";
+  let i = 0;
+  for (; i + 2 < bytes.length; i += 3) {
+    const n = bytes[i] << 16 | bytes[i + 1] << 8 | bytes[i + 2];
+    out += B64URL[n >> 18 & 63] + B64URL[n >> 12 & 63] + B64URL[n >> 6 & 63] + B64URL[n & 63];
+  }
+  const rest = bytes.length - i;
+  if (rest === 1) {
+    const n = bytes[i] << 16;
+    out += B64URL[n >> 18 & 63] + B64URL[n >> 12 & 63];
+  } else if (rest === 2) {
+    const n = bytes[i] << 16 | bytes[i + 1] << 8;
+    out += B64URL[n >> 18 & 63] + B64URL[n >> 12 & 63] + B64URL[n >> 6 & 63];
+  }
+  return out;
+}
+function base64urlDecode(s) {
+  if (s.length % 4 === 1) throw new Error("invalid base64url");
+  const out = new Uint8Array(Math.floor(s.length * 3 / 4));
+  let buffer = 0;
+  let bits = 0;
+  let at = 0;
+  for (let i = 0; i < s.length; i++) {
+    const c = s.charCodeAt(i);
+    const v = c < 128 ? B64URL_LOOKUP[c] : -1;
+    if (v < 0) throw new Error("invalid base64url");
+    buffer = (buffer << 6 | v) & 16383;
+    bits += 6;
+    if (bits >= 8) {
+      bits -= 8;
+      out[at++] = buffer >> bits & 255;
+    }
+  }
+  if (bits > 0 && (buffer & (1 << bits) - 1) !== 0) {
+    throw new Error("invalid base64url");
+  }
+  return out;
+}
+function base64urlJson(value) {
+  return base64urlEncode(utf8(JSON.stringify(value)));
+}
+function concatBytes(...parts) {
+  const size = parts.reduce((n, p) => n + p.length, 0);
+  const out = new Uint8Array(size);
+  let at = 0;
+  for (const p of parts) {
+    out.set(p, at);
+    at += p.length;
+  }
+  return out;
+}
+function timingSafeEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];
+  return diff === 0;
+}
+function bytesToHex(bytes) {
+  let out = "";
+  for (const b of bytes) out += b.toString(16).padStart(2, "0");
+  return out;
+}
+function hexToBytes(hex) {
+  if (!/^(?:[0-9a-fA-F]{2})*$/.test(hex)) throw new Error("invalid hex");
+  const out = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < out.length; i++) {
+    out[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  }
+  return out;
+}
+var B58 = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
+function base58btcEncode(bytes) {
+  let zeros = 0;
+  while (zeros < bytes.length && bytes[zeros] === 0) zeros++;
+  const digits = [];
+  for (let i = zeros; i < bytes.length; i++) {
+    let carry = bytes[i];
+    for (let j = 0; j < digits.length; j++) {
+      carry += digits[j] << 8;
+      digits[j] = carry % 58;
+      carry = carry / 58 | 0;
+    }
+    while (carry > 0) {
+      digits.push(carry % 58);
+      carry = carry / 58 | 0;
+    }
+  }
+  let out = "1".repeat(zeros);
+  for (let i = digits.length - 1; i >= 0; i--) out += B58[digits[i]];
+  return out;
+}
+function base58btcDecode(s) {
+  let zeros = 0;
+  while (zeros < s.length && s[zeros] === "1") zeros++;
+  const bytes = [];
+  for (let i = zeros; i < s.length; i++) {
+    const v = B58.indexOf(s[i]);
+    if (v < 0) throw new Error("invalid base58btc");
+    let carry = v;
+    for (let j = 0; j < bytes.length; j++) {
+      carry += bytes[j] * 58;
+      bytes[j] = carry & 255;
+      carry >>= 8;
+    }
+    while (carry > 0) {
+      bytes.push(carry & 255);
+      carry >>= 8;
+    }
+  }
+  const out = new Uint8Array(zeros + bytes.length);
+  for (let i = 0; i < bytes.length; i++) {
+    out[zeros + i] = bytes[bytes.length - 1 - i];
+  }
+  return out;
+}
+function randomToken(bytes = 32) {
+  return base64urlEncode(crypto.getRandomValues(new Uint8Array(bytes)));
+}
+
+export { base58btcDecode, base58btcEncode, base64urlDecode, base64urlEncode, base64urlJson, bytesToHex, concatBytes, fromUtf8, hexToBytes, randomToken, timingSafeEqual, utf8 };
+//# sourceMappingURL=chunk-AQ3IINHC.js.map
+//# sourceMappingURL=chunk-AQ3IINHC.js.map