@ixo/credentials-kit 0.0.0-stage → 0.1.1

package/dist/chunk-STMMFNVW.js

@@ -0,0 +1,391 @@
+import { parseSdJwt, SdJwtError, processDisclosures, sdHash } from './chunk-XREZY53L.js';
+import { MAX_STATUS_LIST_TOKEN_LENGTH, STATUS_LIST_MEDIA_TYPE, statusAt, verifyStatusListToken, StatusListError } from './chunk-JBUX6V2Q.js';
+import { findKey, cacheGet, cachePut, ResolverUnavailable } from './chunk-WIEGZFUO.js';
+import { isFetchableUrl, request, HttpError } from './chunk-Q3MZNMCK.js';
+import { CredentialsKitError, clockMs, toSeconds, rawFromPublicJwk, JoseError, isEd25519JwsAlg, decodeJws, verifyEd25519, isRecord, publicJwkFromRaw, CLOCK_SKEW_S } from './chunk-VXKONZK4.js';
+import { timingSafeEqual, utf8, bytesToHex } from './chunk-AQ3IINHC.js';
+import { sha256 } from '@noble/hashes/sha2.js';
+
+var VERIFY_FAILURE_DETAILS = {
+  malformed: "The presentation is not a well-formed SD-JWT VC.",
+  untrusted_issuer: "The credential issuer is not accepted.",
+  wrong_type: "The credential type is not accepted.",
+  issuer_key_unpublished: "The credential's signing key is not an assertion key on the issuer's DID document.",
+  bad_signature: "The credential signature does not verify.",
+  expired: "The credential has expired.",
+  not_yet_valid: "The credential is not valid yet.",
+  bad_disclosure: "A disclosure does not belong to the credential.",
+  wrong_subject: "The credential was issued to someone else.",
+  key_binding_required: "The presentation has no key binding.",
+  bad_key_binding: "The key binding does not verify for this request.",
+  revoked: "The credential has been revoked.",
+  no_status: "The credential has no usable status list entry."
+};
+var VerificationUnavailable = class extends CredentialsKitError {
+  source;
+  /** A constant cause code (`unreachable`, `http_status`, `too_large`, a `StatusListError` code, …). */
+  reason;
+  constructor(source, reason) {
+    super(
+      "verification_unavailable",
+      source === "resolver" ? "The issuer's DID document could not be read." : "The credential status list could not be read or verified."
+    );
+    this.source = source;
+    this.reason = reason;
+  }
+};
+var KB_MAX_AGE_S = 300;
+var DEFAULT_STATUS_TTL_S = 300;
+var MAX_STATUS_TTL_S = 86400;
+var SD_JWT_TYPS = /* @__PURE__ */ new Set(["dc+sd-jwt", "vc+sd-jwt"]);
+var NEVER_DISCLOSED = /* @__PURE__ */ new Set([
+  "iss",
+  "nbf",
+  "exp",
+  "cnf",
+  "vct",
+  "vct#integrity",
+  "aka_vcts",
+  "status"
+]);
+var NOT_CLAIMS = /* @__PURE__ */ new Set([
+  "iss",
+  "sub",
+  "iat",
+  "nbf",
+  "exp",
+  "vct",
+  "vct#integrity",
+  "aka_vcts",
+  "cnf",
+  "status"
+]);
+var UNBOUND = { keyBindingValid: false, holderAuthenticated: false };
+function fail(code, binding = UNBOUND) {
+  return {
+    ok: false,
+    code,
+    detail: VERIFY_FAILURE_DETAILS[code],
+    holderAuthenticated: binding.holderAuthenticated,
+    keyBindingValid: binding.keyBindingValid
+  };
+}
+function issuerAccepted(issuers, did) {
+  return typeof issuers === "function" ? issuers(did) : issuers.includes(did);
+}
+async function resolveIssuer(resolver, did) {
+  try {
+    return await resolver(did);
+  } catch (e) {
+    if (e instanceof ResolverUnavailable) {
+      throw new VerificationUnavailable("resolver", e.source);
+    }
+    throw e;
+  }
+}
+function parse(presentation) {
+  try {
+    return parseSdJwt(
+      typeof presentation === "string" ? presentation.trim() : ""
+    );
+  } catch (e) {
+    if (e instanceof SdJwtError || e instanceof JoseError) return null;
+    throw e;
+  }
+}
+async function checkIssuerSigned(parsed, issuers, resolver) {
+  const { header, payload } = parsed;
+  if (!isEd25519JwsAlg(header.alg) || !SD_JWT_TYPS.has(header.typ))
+    return fail("malformed");
+  if (payload._sd_alg !== void 0 && payload._sd_alg !== "sha-256")
+    return fail("malformed");
+  const { iss, vct, exp, nbf, iat } = payload;
+  if (typeof iss !== "string" || typeof vct !== "string")
+    return fail("malformed");
+  if (typeof exp !== "number" || !Number.isFinite(exp))
+    return fail("malformed");
+  if (nbf !== void 0 && (typeof nbf !== "number" || !Number.isFinite(nbf)))
+    return fail("malformed");
+  if (iat !== void 0 && (typeof iat !== "number" || !Number.isFinite(iat)))
+    return fail("malformed");
+  if (!issuerAccepted(issuers, iss)) return fail("untrusted_issuer");
+  const issuerDoc = await resolveIssuer(resolver, iss);
+  const kid = typeof header.kid === "string" ? header.kid : "";
+  const issuerKey = issuerDoc?.id === iss ? findKey(issuerDoc, kid, "assertionMethod") : null;
+  if (!issuerDoc || !issuerKey) return fail("issuer_key_unpublished");
+  const jws = decodeJws(parsed.jwt);
+  if (!verifyEd25519(jws.signature, utf8(jws.signingInput), issuerKey.publicKey)) {
+    return fail("bad_signature");
+  }
+  let processed;
+  try {
+    processed = processDisclosures(payload, parsed.disclosures);
+  } catch (e) {
+    if (e instanceof SdJwtError)
+      return fail(e.code === "malformed" ? "malformed" : "bad_disclosure");
+    throw e;
+  }
+  if (processed.disclosed.some((name) => NEVER_DISCLOSED.has(name)))
+    return fail("bad_disclosure");
+  const { claims } = processed;
+  const sub = claims.sub;
+  if (typeof sub !== "string") return fail("malformed");
+  if (claims.iat !== void 0 && (typeof claims.iat !== "number" || !Number.isFinite(claims.iat)))
+    return fail("malformed");
+  let holderRaw = null;
+  let holderKey = null;
+  const cnf = payload.cnf;
+  if (cnf !== void 0) {
+    try {
+      holderRaw = rawFromPublicJwk(isRecord(cnf) ? cnf.jwk : void 0);
+      holderKey = publicJwkFromRaw(holderRaw);
+    } catch {
+      holderRaw = null;
+    }
+  }
+  return {
+    iss,
+    sub,
+    vct,
+    exp,
+    nbf: typeof nbf === "number" ? nbf : void 0,
+    claims: Object.fromEntries(
+      Object.entries(claims).filter(([name]) => !NOT_CLAIMS.has(name))
+    ),
+    disclosed: processed.disclosed,
+    issuerDoc,
+    holderRaw,
+    holderKey
+  };
+}
+function validity(c, nowS, binding) {
+  if (nowS > c.exp + CLOCK_SKEW_S) return fail("expired", binding);
+  if (c.nbf !== void 0 && nowS + CLOCK_SKEW_S < c.nbf)
+    return fail("not_yet_valid", binding);
+  return null;
+}
+async function nonceAccepted(check, nonce) {
+  return typeof check === "string" ? nonce === check : await check(nonce);
+}
+async function keyBindingHolds(kbJwt, presentedSdJwt, holderKey, audience, nonce, nowS) {
+  let kb;
+  try {
+    kb = decodeJws(kbJwt);
+  } catch {
+    return false;
+  }
+  if (kb.header.typ !== "kb+jwt" || !isEd25519JwsAlg(kb.header.alg))
+    return false;
+  if (!verifyEd25519(kb.signature, utf8(kb.signingInput), holderKey))
+    return false;
+  const { payload } = kb;
+  if (payload.aud !== audience) return false;
+  if (typeof payload.iat !== "number" || payload.iat > nowS + CLOCK_SKEW_S || payload.iat < nowS - KB_MAX_AGE_S - CLOCK_SKEW_S) {
+    return false;
+  }
+  if (payload.exp !== void 0 && (typeof payload.exp !== "number" || nowS > payload.exp + CLOCK_SKEW_S))
+    return false;
+  if (payload.nbf !== void 0 && (typeof payload.nbf !== "number" || nowS + CLOCK_SKEW_S < payload.nbf))
+    return false;
+  if (payload.sd_hash !== sdHash(presentedSdJwt)) return false;
+  if (typeof payload.nonce !== "string" || payload.nonce.length === 0)
+    return false;
+  return nonceAccepted(nonce, payload.nonce);
+}
+function statusRef(status, deps) {
+  const list = isRecord(status) ? status.status_list : void 0;
+  if (!isRecord(list)) return null;
+  const { uri, idx } = list;
+  if (typeof uri !== "string" || !isFetchableUrl(uri, {
+    allowHttp: deps.allowHttp ?? false,
+    allowLocal: deps.allowLocal ?? false
+  }))
+    return null;
+  if (typeof idx !== "number" || !Number.isSafeInteger(idx) || idx < 0)
+    return null;
+  return { uri, idx };
+}
+function readCachedStatus(raw) {
+  if (raw === null) return null;
+  try {
+    const v = JSON.parse(raw);
+    if (isRecord(v) && typeof v.token === "string" && typeof v.iat === "number" && typeof v.freshUntil === "number") {
+      return { token: v.token, iat: v.iat, freshUntil: v.freshUntil };
+    }
+  } catch {
+  }
+  return null;
+}
+async function statusOf(deps, issuerDoc, ref, nowMs) {
+  const cacheKey = `ixo-credentials-kit:status:v1:${bytesToHex(
+    sha256(utf8(`${issuerDoc.id}|${ref.uri}`))
+  )}`;
+  const cached = readCachedStatus(await cacheGet(deps.statusCache, cacheKey));
+  const unavailable = (reason) => new VerificationUnavailable("status_list", reason);
+  const check = async (token2, minIat) => {
+    try {
+      return await verifyStatusListToken(token2, {
+        uri: ref.uri,
+        issuerDoc,
+        now: nowMs,
+        ...minIat !== void 0 ? { minIat } : {}
+      });
+    } catch (e) {
+      if (e instanceof StatusListError) throw unavailable(e.code);
+      throw e;
+    }
+  };
+  const valueAt = (list2) => {
+    try {
+      return statusAt(list2.bits, ref.idx, list2.bitsPerEntry);
+    } catch {
+      return "out_of_range";
+    }
+  };
+  if (cached && cached.freshUntil > nowMs) {
+    try {
+      return valueAt(await check(cached.token));
+    } catch (e) {
+      if (!(e instanceof VerificationUnavailable)) throw e;
+    }
+  }
+  let token;
+  try {
+    const res = await request(deps.fetch, ref.uri, {
+      headers: { accept: STATUS_LIST_MEDIA_TYPE },
+      maxBytes: MAX_STATUS_LIST_TOKEN_LENGTH
+    });
+    if (res.status !== 200) throw unavailable("http_status");
+    token = res.text.trim();
+  } catch (e) {
+    if (e instanceof VerificationUnavailable) throw e;
+    if (e instanceof HttpError) {
+      throw unavailable(
+        e.kind === "too_large" ? "too_large" : e.kind === "status" ? "http_status" : "unreachable"
+      );
+    }
+    throw unavailable("unreachable");
+  }
+  const list = await check(token, cached?.iat);
+  const ttl = Math.min(list.ttl ?? DEFAULT_STATUS_TTL_S, MAX_STATUS_TTL_S);
+  const entry = {
+    token,
+    iat: list.iat,
+    freshUntil: nowMs + ttl * 1e3
+  };
+  await cachePut(
+    deps.statusCache,
+    cacheKey,
+    JSON.stringify(entry),
+    ttl + MAX_STATUS_TTL_S
+  );
+  return valueAt(list);
+}
+function verified(c, jwt) {
+  return {
+    ok: true,
+    issuer: c.iss,
+    subject: c.sub,
+    vct: c.vct,
+    claims: c.claims,
+    disclosed: c.disclosed,
+    expiresAt: c.exp,
+    credentialSha256: bytesToHex(sha256(utf8(jwt))),
+    holderKey: c.holderKey
+  };
+}
+async function verifyPresentation(presentation, policy, deps) {
+  const nowMs = clockMs(policy.now);
+  const nowS = toSeconds(nowMs);
+  const requireKeyBinding = policy.requireKeyBinding ?? true;
+  const requireStatus = policy.requireStatus ?? true;
+  if (requireKeyBinding && (typeof policy.audience !== "string" || policy.audience.length === 0 || policy.nonce === void 0 || typeof policy.nonce === "string" && policy.nonce.length === 0)) {
+    throw new TypeError(
+      "policy.audience and policy.nonce are required when key binding is required"
+    );
+  }
+  const expectedSubject = policy.expectedSubject;
+  if (expectedSubject !== void 0 && (typeof expectedSubject !== "string" || expectedSubject.length === 0))
+    throw new TypeError("policy.expectedSubject must be a non-empty DID");
+  const parsed = parse(presentation);
+  if (!parsed) return fail("malformed");
+  const c = await checkIssuerSigned(parsed, policy.issuers, deps.resolver);
+  if ("ok" in c) return c;
+  if (policy.expectedSubject !== void 0 && c.sub !== policy.expectedSubject)
+    return fail("wrong_subject");
+  let binding = UNBOUND;
+  if (parsed.kbJwt === void 0) {
+    if (requireKeyBinding) return fail("key_binding_required");
+  } else {
+    if (!c.holderRaw || policy.audience === void 0 || policy.nonce === void 0)
+      return fail("bad_key_binding");
+    const presented = parsed.jwt + "~" + parsed.disclosures.map((d) => `${d.raw}~`).join("");
+    const holds = await keyBindingHolds(
+      parsed.kbJwt,
+      presented,
+      c.holderRaw,
+      policy.audience,
+      policy.nonce,
+      nowS
+    );
+    if (!holds) return fail("bad_key_binding");
+    binding = {
+      keyBindingValid: true,
+      holderAuthenticated: policy.expectedSubject !== void 0
+    };
+  }
+  if (!policy.vcts.includes(c.vct)) return fail("wrong_type", binding);
+  const invalid = validity(c, nowS, binding);
+  if (invalid) return invalid;
+  const status = parsed.payload.status;
+  if (status === void 0) {
+    if (requireStatus) return fail("no_status", binding);
+  } else {
+    const ref = statusRef(status, deps);
+    if (!ref) return fail("malformed", binding);
+    const value = await statusOf(deps, c.issuerDoc, ref, nowMs);
+    if (value === "out_of_range") return fail("no_status", binding);
+    if (value !== 0) return fail("revoked", binding);
+  }
+  return verified(c, parsed.jwt);
+}
+async function verifyIssuedCredential(credential, opts) {
+  const nowS = toSeconds(clockMs(opts.now));
+  let expectedHolder;
+  if (opts.holderKey instanceof Uint8Array) {
+    expectedHolder = opts.holderKey;
+  } else {
+    try {
+      expectedHolder = rawFromPublicJwk(opts.holderKey);
+    } catch {
+      expectedHolder = new Uint8Array(0);
+    }
+  }
+  if (expectedHolder.length !== 32)
+    throw new TypeError("holderKey is not an Ed25519 public key");
+  const expectedIssuer = opts.issuer;
+  if (expectedIssuer !== false && (typeof expectedIssuer !== "string" || expectedIssuer.length === 0))
+    throw new TypeError(
+      "issuer is required: the expected issuer DID, or false to accept any issuer"
+    );
+  const parsed = parse(credential);
+  if (!parsed || parsed.kbJwt !== void 0) return fail("malformed");
+  const c = await checkIssuerSigned(
+    parsed,
+    typeof expectedIssuer === "string" ? [expectedIssuer] : () => true,
+    opts.resolver
+  );
+  if ("ok" in c) return c;
+  if (c.sub !== opts.subject) return fail("wrong_subject");
+  if (!c.holderRaw || !timingSafeEqual(c.holderRaw, expectedHolder))
+    return fail("bad_key_binding");
+  const vcts = typeof opts.vct === "string" ? [opts.vct] : opts.vct;
+  if (!vcts.includes(c.vct)) return fail("wrong_type");
+  const invalid = validity(c, nowS, UNBOUND);
+  if (invalid) return invalid;
+  return verified(c, parsed.jwt);
+}
+
+export { VERIFY_FAILURE_DETAILS, VerificationUnavailable, verifyIssuedCredential, verifyPresentation };
+//# sourceMappingURL=chunk-STMMFNVW.js.map
+//# sourceMappingURL=chunk-STMMFNVW.js.map

package/dist/chunk-STMMFNVW.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/verify.ts"],"names":["token","list"],"mappings":";;;;;;;;AA+GO,IAAM,sBAAA,GAA4D;AAAA,EACvE,SAAA,EAAW,kDAAA;AAAA,EACX,gBAAA,EAAkB,wCAAA;AAAA,EAClB,UAAA,EAAY,sCAAA;AAAA,EACZ,sBAAA,EACE,oFAAA;AAAA,EACF,aAAA,EAAe,2CAAA;AAAA,EACf,OAAA,EAAS,6BAAA;AAAA,EACT,aAAA,EAAe,kCAAA;AAAA,EACf,cAAA,EAAgB,iDAAA;AAAA,EAChB,aAAA,EAAe,4CAAA;AAAA,EACf,oBAAA,EAAsB,sCAAA;AAAA,EACtB,eAAA,EAAiB,mDAAA;AAAA,EACjB,OAAA,EAAS,kCAAA;AAAA,EACT,SAAA,EAAW;AACb;AAiGO,IAAM,uBAAA,GAAN,cAAsC,mBAAA,CAAoB;AAAA,EAEtD,MAAA;AAAA;AAAA,EAEA,MAAA;AAAA,EACT,WAAA,CAAY,QAA2B,MAAA,EAAgB;AACrD,IAAA,KAAA;AAAA,MACE,0BAAA;AAAA,MACA,MAAA,KAAW,aACP,8CAAA,GACA;AAAA,KACN;AACA,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,EAChB;AACF;AAEA,IAAM,YAAA,GAAe,GAAA;AACrB,IAAM,oBAAA,GAAuB,GAAA;AAC7B,IAAM,gBAAA,GAAmB,KAAA;AACzB,IAAM,8BAAc,IAAI,GAAA,CAAI,CAAC,WAAA,EAAa,WAAW,CAAC,CAAA;AAMtD,IAAM,eAAA,uBAAsB,GAAA,CAAI;AAAA,EAC9B,KAAA;AAAA,EACA,KAAA;AAAA,EACA,KAAA;AAAA,EACA,KAAA;AAAA,EACA,KAAA;AAAA,EACA,eAAA;AAAA,EACA,UAAA;AAAA,EACA;AACF,CAAC,CAAA;AAED,IAAM,UAAA,uBAAiB,GAAA,CAAI;AAAA,EACzB,KAAA;AAAA,EACA,KAAA;AAAA,EACA,KAAA;AAAA,EACA,KAAA;AAAA,EACA,KAAA;AAAA,EACA,KAAA;AAAA,EACA,eAAA;AAAA,EACA,UAAA;AAAA,EACA,KAAA;AAAA,EACA;AACF,CAAC,CAAA;AAQD,IAAM,OAAA,GAAmB,EAAE,eAAA,EAAiB,KAAA,EAAO,qBAAqB,KAAA,EAAM;AAE9E,SAAS,IAAA,CACP,IAAA,EACA,OAAA,GAAmB,OAAA,EACC;AACpB,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,KAAA;AAAA,IACJ,IAAA;AAAA,IACA,MAAA,EAAQ,uBAAuB,IAAI,CAAA;AAAA,IACnC,qBAAqB,OAAA,CAAQ,mBAAA;AAAA,IAC7B,iBAAiB,OAAA,CAAQ;AAAA,GAC3B;AACF;AAEA,SAAS,cAAA,CACP,SACA,GAAA,EACS;AACT,EAAA,OAAO,OAAO,YAAY,UAAA,GAAa,OAAA,CAAQ,GAAG,CAAA,GAAI,OAAA,CAAQ,SAAS,GAAG,CAAA;AAC5E;AAEA,eAAe,aAAA,CACb,UACA,GAAA,EAC6B;AAC7B,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,SAAS,GAAG,CAAA;AAAA,EAC3B,SAAS,CAAA,EAAG;AACV,IAAA,IAAI,aAAa,mBAAA,EAAqB;AACpC,MAAA,MAAM,IAAI,uBAAA,CAAwB,UAAA,EAAY,CAAA,CAAE,MAAM,CAAA;AAAA,IACxD;AACA,IAAA,MAAM,CAAA;AAAA,EACR;AACF;AAEA,SAAS,MAAM,YAAA,EAA2C;AACxD,EAAA,IAAI;AACF,IAAA,OAAO,UAAA;AAAA,MACL,OAAO,YAAA,KAAiB,QAAA,GAAW,YAAA,CAAa,MAAK,GAAI;AAAA,KAC3D;AAAA,EACF,SAAS,CAAA,EAAG;AACV,IAAA,IAAI,CAAA,YAAa,UAAA,IAAc,CAAA,YAAa,SAAA,EAAW,OAAO,IAAA;AAC9D,IAAA,MAAM,CAAA;AAAA,EACR;AACF;AAoBA,eAAe,iBAAA,CACb,MAAA,EACA,OAAA,EACA,QAAA,EACiD;AACjD,EAAA,MAAM,EAAE,MAAA,EAAQ,OAAA,EAAQ,GAAI,MAAA;AAC5B,EAAA,IAAI,CAAC,gBAAgB,MAAA,CAAO,GAAG,KAAK,CAAC,WAAA,CAAY,GAAA,CAAI,MAAA,CAAO,GAAa,CAAA;AACvE,IAAA,OAAO,KAAK,WAAW,CAAA;AACzB,EAAA,IAAI,OAAA,CAAQ,OAAA,KAAY,MAAA,IAAa,OAAA,CAAQ,OAAA,KAAY,SAAA;AACvD,IAAA,OAAO,KAAK,WAAW,CAAA;AACzB,EAAA,MAAM,EAAE,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,KAAI,GAAI,OAAA;AACpC,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,OAAO,GAAA,KAAQ,QAAA;AAC5C,IAAA,OAAO,KAAK,WAAW,CAAA;AACzB,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,CAAC,MAAA,CAAO,SAAS,GAAG,CAAA;AACjD,IAAA,OAAO,KAAK,WAAW,CAAA;AACzB,EAAA,IAAI,GAAA,KAAQ,WAAc,OAAO,GAAA,KAAQ,YAAY,CAAC,MAAA,CAAO,SAAS,GAAG,CAAA,CAAA;AACvE,IAAA,OAAO,KAAK,WAAW,CAAA;AACzB,EAAA,IAAI,GAAA,KAAQ,WAAc,OAAO,GAAA,KAAQ,YAAY,CAAC,MAAA,CAAO,SAAS,GAAG,CAAA,CAAA;AACvE,IAAA,OAAO,KAAK,WAAW,CAAA;AAGzB,EAAA,IAAI,CAAC,cAAA,CAAe,OAAA,EAAS,GAAG,CAAA,EAAG,OAAO,KAAK,kBAAkB,CAAA;AAGjE,EAAA,MAAM,SAAA,GAAY,MAAM,aAAA,CAAc,QAAA,EAAU,GAAG,CAAA;AACnD,EAAA,MAAM,MAAM,OAAO,MAAA,CAAO,GAAA,KAAQ,QAAA,GAAW,OAAO,GAAA,GAAM,EAAA;AAE1D,EAAA,MAAM,SAAA,GACJ,WAAW,EAAA,KAAO,GAAA,GAAM,QAAQ,SAAA,EAAW,GAAA,EAAK,iBAAiB,CAAA,GAAI,IAAA;AACvE,EAAA,IAAI,CAAC,SAAA,IAAa,CAAC,SAAA,EAAW,OAAO,KAAK,wBAAwB,CAAA;AAClE,EAAA,MAAM,GAAA,GAAM,SAAA,CAAU,MAAA,CAAO,GAAG,CAAA;AAChC,EAAA,IACE,CAAC,aAAA,CAAc,GAAA,CAAI,SAAA,EAAW,IAAA,CAAK,IAAI,YAAY,CAAA,EAAG,SAAA,CAAU,SAAS,CAAA,EACzE;AACA,IAAA,OAAO,KAAK,eAAe,CAAA;AAAA,EAC7B;AAGA,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI;AACF,IAAA,SAAA,GAAY,kBAAA,CAAmB,OAAA,EAAS,MAAA,CAAO,WAAW,CAAA;AAAA,EAC5D,SAAS,CAAA,EAAG;AACV,IAAA,IAAI,CAAA,YAAa,UAAA;AACf,MAAA,OAAO,IAAA,CAAK,CAAA,CAAE,IAAA,KAAS,WAAA,GAAc,cAAc,gBAAgB,CAAA;AACrE,IAAA,MAAM,CAAA;AAAA,EACR;AACA,EAAA,IAAI,UAAU,SAAA,CAAU,IAAA,CAAK,UAAQ,eAAA,CAAgB,GAAA,CAAI,IAAI,CAAC,CAAA;AAC5D,IAAA,OAAO,KAAK,gBAAgB,CAAA;AAC9B,EAAA,MAAM,EAAE,QAAO,GAAI,SAAA;AACnB,EAAA,MAAM,MAAM,MAAA,CAAO,GAAA;AACnB,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,EAAU,OAAO,KAAK,WAAW,CAAA;AACpD,EAAA,IACE,MAAA,CAAO,GAAA,KAAQ,MAAA,KACd,OAAO,MAAA,CAAO,GAAA,KAAQ,QAAA,IAAY,CAAC,MAAA,CAAO,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAA;AAE9D,IAAA,OAAO,KAAK,WAAW,CAAA;AAEzB,EAAA,IAAI,SAAA,GAA+B,IAAA;AACnC,EAAA,IAAI,SAAA,GAAqC,IAAA;AACzC,EAAA,MAAM,MAAM,OAAA,CAAQ,GAAA;AACpB,EAAA,IAAI,QAAQ,MAAA,EAAW;AACrB,IAAA,IAAI;AACF,MAAA,SAAA,GAAY,iBAAiB,QAAA,CAAS,GAAG,CAAA,GAAI,GAAA,CAAI,MAAM,KAAA,CAAS,CAAA;AAChE,MAAA,SAAA,GAAY,iBAAiB,SAAS,CAAA;AAAA,IACxC,CAAA,CAAA,MAAQ;AACN,MAAA,SAAA,GAAY,IAAA;AAAA,IACd;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,GAAA;AAAA,IACA,GAAA;AAAA,IACA,GAAA;AAAA,IACA,GAAA;AAAA,IACA,GAAA,EAAK,OAAO,GAAA,KAAQ,QAAA,GAAW,GAAA,GAAM,MAAA;AAAA,IACrC,QAAQ,MAAA,CAAO,WAAA;AAAA,MACb,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,CAAE,MAAA,CAAO,CAAC,CAAC,IAAI,CAAA,KAAM,CAAC,UAAA,CAAW,GAAA,CAAI,IAAI,CAAC;AAAA,KACjE;AAAA,IACA,WAAW,SAAA,CAAU,SAAA;AAAA,IACrB,SAAA;AAAA,IACA,SAAA;AAAA,IACA;AAAA,GACF;AACF;AAEA,SAAS,QAAA,CACP,CAAA,EACA,IAAA,EACA,OAAA,EAC2B;AAC3B,EAAA,IAAI,OAAO,CAAA,CAAE,GAAA,GAAM,cAAc,OAAO,IAAA,CAAK,WAAW,OAAO,CAAA;AAC/D,EAAA,IAAI,CAAA,CAAE,GAAA,KAAQ,MAAA,IAAa,IAAA,GAAO,eAAe,CAAA,CAAE,GAAA;AACjD,IAAA,OAAO,IAAA,CAAK,iBAAiB,OAAO,CAAA;AACtC,EAAA,OAAO,IAAA;AACT;AAEA,eAAe,aAAA,CAAc,OAAmB,KAAA,EAAe;AAC7D,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,GAAW,UAAU,KAAA,GAAQ,MAAM,MAAM,KAAK,CAAA;AACxE;AAEA,eAAe,gBACb,KAAA,EACA,cAAA,EACA,SAAA,EACA,QAAA,EACA,OACA,IAAA,EACkB;AAClB,EAAA,IAAI,EAAA;AACJ,EAAA,IAAI;AACF,IAAA,EAAA,GAAK,UAAU,KAAK,CAAA;AAAA,EACtB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI,EAAA,CAAG,OAAO,GAAA,KAAQ,QAAA,IAAY,CAAC,eAAA,CAAgB,EAAA,CAAG,OAAO,GAAG,CAAA;AAC9D,IAAA,OAAO,KAAA;AACT,EAAA,IAAI,CAAC,cAAc,EAAA,CAAG,SAAA,EAAW,KAAK,EAAA,CAAG,YAAY,GAAG,SAAS,CAAA;AAC/D,IAAA,OAAO,KAAA;AACT,EAAA,MAAM,EAAE,SAAQ,GAAI,EAAA;AACpB,EAAA,IAAI,OAAA,CAAQ,GAAA,KAAQ,QAAA,EAAU,OAAO,KAAA;AACrC,EAAA,IACE,OAAO,OAAA,CAAQ,GAAA,KAAQ,QAAA,IACvB,OAAA,CAAQ,GAAA,GAAM,IAAA,GAAO,YAAA,IACrB,OAAA,CAAQ,GAAA,GAAM,IAAA,GAAO,YAAA,GAAe,YAAA,EACpC;AACA,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IACE,OAAA,CAAQ,QAAQ,MAAA,KACf,OAAO,QAAQ,GAAA,KAAQ,QAAA,IAAY,IAAA,GAAO,OAAA,CAAQ,GAAA,GAAM,YAAA,CAAA;AAEzD,IAAA,OAAO,KAAA;AACT,EAAA,IACE,OAAA,CAAQ,QAAQ,MAAA,KACf,OAAO,QAAQ,GAAA,KAAQ,QAAA,IAAY,IAAA,GAAO,YAAA,GAAe,OAAA,CAAQ,GAAA,CAAA;AAElE,IAAA,OAAO,KAAA;AACT,EAAA,IAAI,OAAA,CAAQ,OAAA,KAAY,MAAA,CAAO,cAAc,GAAG,OAAO,KAAA;AAEvD,EAAA,IAAI,OAAO,OAAA,CAAQ,KAAA,KAAU,QAAA,IAAY,OAAA,CAAQ,MAAM,MAAA,KAAW,CAAA;AAChE,IAAA,OAAO,KAAA;AACT,EAAA,OAAO,aAAA,CAAc,KAAA,EAAO,OAAA,CAAQ,KAAK,CAAA;AAC3C;AAOA,SAAS,SAAA,CAAU,QAAiB,IAAA,EAAoC;AACtE,EAAA,MAAM,IAAA,GAAO,QAAA,CAAS,MAAM,CAAA,GAAI,OAAO,WAAA,GAAc,MAAA;AACrD,EAAA,IAAI,CAAC,QAAA,CAAS,IAAI,CAAA,EAAG,OAAO,IAAA;AAC5B,EAAA,MAAM,EAAE,GAAA,EAAK,GAAA,EAAI,GAAI,IAAA;AACrB,EAAA,IACE,OAAO,GAAA,KAAQ,QAAA,IACf,CAAC,eAAe,GAAA,EAAK;AAAA,IACnB,SAAA,EAAW,KAAK,SAAA,IAAa,KAAA;AAAA,IAC7B,UAAA,EAAY,KAAK,UAAA,IAAc;AAAA,GAChC,CAAA;AAED,IAAA,OAAO,IAAA;AACT,EAAA,IAAI,OAAO,QAAQ,QAAA,IAAY,CAAC,OAAO,aAAA,CAAc,GAAG,KAAK,GAAA,GAAM,CAAA;AACjE,IAAA,OAAO,IAAA;AACT,EAAA,OAAO,EAAE,KAAK,GAAA,EAAI;AACpB;AASA,SAAS,iBAAiB,GAAA,EAAyC;AACjE,EAAA,IAAI,GAAA,KAAQ,MAAM,OAAO,IAAA;AACzB,EAAA,IAAI;AACF,IAAA,MAAM,CAAA,GAAa,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AACjC,IAAA,IACE,QAAA,CAAS,CAAC,CAAA,IACV,OAAO,EAAE,KAAA,KAAU,QAAA,IACnB,OAAO,CAAA,CAAE,GAAA,KAAQ,QAAA,IACjB,OAAO,CAAA,CAAE,eAAe,QAAA,EACxB;AACA,MAAA,OAAO,EAAE,OAAO,CAAA,CAAE,KAAA,EAAO,KAAK,CAAA,CAAE,GAAA,EAAK,UAAA,EAAY,CAAA,CAAE,UAAA,EAAW;AAAA,IAChE;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,OAAO,IAAA;AACT;AAQA,eAAe,QAAA,CACb,IAAA,EACA,SAAA,EACA,GAAA,EACA,KAAA,EACkC;AAClC,EAAA,MAAM,WAAW,CAAA,8BAAA,EAAiC,UAAA;AAAA,IAChD,MAAA,CAAO,KAAK,CAAA,EAAG,SAAA,CAAU,EAAE,CAAA,CAAA,EAAI,GAAA,CAAI,GAAG,CAAA,CAAE,CAAC;AAAA,GAC1C,CAAA,CAAA;AACD,EAAA,MAAM,SAAS,gBAAA,CAAiB,MAAM,SAAS,IAAA,CAAK,WAAA,EAAa,QAAQ,CAAC,CAAA;AAC1E,EAAA,MAAM,cAAc,CAAC,MAAA,KACnB,IAAI,uBAAA,CAAwB,eAAe,MAAM,CAAA;AACnD,EAAA,MAAM,KAAA,GAAQ,OAAOA,MAAAA,EAAe,MAAA,KAAoB;AACtD,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,sBAAsBA,MAAAA,EAAO;AAAA,QACxC,KAAK,GAAA,CAAI,GAAA;AAAA,QACT,SAAA;AAAA,QACA,GAAA,EAAK,KAAA;AAAA,QACL,GAAI,MAAA,KAAW,KAAA,CAAA,GAAY,EAAE,MAAA,KAAW;AAAC,OAC1C,CAAA;AAAA,IACH,SAAS,CAAA,EAAG;AACV,MAAA,IAAI,CAAA,YAAa,eAAA,EAAiB,MAAM,WAAA,CAAY,EAAE,IAAI,CAAA;AAC1D,MAAA,MAAM,CAAA;AAAA,IACR;AAAA,EACF,CAAA;AACA,EAAA,MAAM,OAAA,GAAU,CACdC,KAAAA,KAC4B;AAC5B,IAAA,IAAI;AACF,MAAA,OAAO,SAASA,KAAAA,CAAK,IAAA,EAAM,GAAA,CAAI,GAAA,EAAKA,MAAK,YAAY,CAAA;AAAA,IACvD,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,cAAA;AAAA,IACT;AAAA,EACF,CAAA;AAEA,EAAA,IAAI,MAAA,IAAU,MAAA,CAAO,UAAA,GAAa,KAAA,EAAO;AACvC,IAAA,IAAI;AACF,MAAA,OAAO,OAAA,CAAQ,MAAM,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,IAC1C,SAAS,CAAA,EAAG;AAEV,MAAA,IAAI,EAAE,CAAA,YAAa,uBAAA,CAAA,EAA0B,MAAM,CAAA;AAAA,IACrD;AAAA,EACF;AAEA,EAAA,IAAI,KAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAM,MAAM,MAAM,OAAA,CAAQ,IAAA,CAAK,KAAA,EAAO,IAAI,GAAA,EAAK;AAAA,MAC7C,OAAA,EAAS,EAAE,MAAA,EAAQ,sBAAA,EAAuB;AAAA,MAC1C,QAAA,EAAU;AAAA,KACX,CAAA;AACD,IAAA,IAAI,GAAA,CAAI,MAAA,KAAW,GAAA,EAAK,MAAM,YAAY,aAAa,CAAA;AACvD,IAAA,KAAA,GAAQ,GAAA,CAAI,KAAK,IAAA,EAAK;AAAA,EACxB,SAAS,CAAA,EAAG;AACV,IAAA,IAAI,CAAA,YAAa,yBAAyB,MAAM,CAAA;AAChD,IAAA,IAAI,aAAa,SAAA,EAAW;AAC1B,MAAA,MAAM,WAAA;AAAA,QACJ,EAAE,IAAA,KAAS,WAAA,GACP,cACA,CAAA,CAAE,IAAA,KAAS,WACT,aAAA,GACA;AAAA,OACR;AAAA,IACF;AACA,IAAA,MAAM,YAAY,aAAa,CAAA;AAAA,EACjC;AACA,EAAA,MAAM,IAAA,GAAO,MAAM,KAAA,CAAM,KAAA,EAAO,QAAQ,GAAG,CAAA;AAC3C,EAAA,MAAM,MAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,GAAA,IAAO,sBAAsB,gBAAgB,CAAA;AACvE,EAAA,MAAM,KAAA,GAAsB;AAAA,IAC1B,KAAA;AAAA,IACA,KAAK,IAAA,CAAK,GAAA;AAAA,IACV,UAAA,EAAY,QAAQ,GAAA,GAAM;AAAA,GAC5B;AAEA,EAAA,MAAM,QAAA;AAAA,IACJ,IAAA,CAAK,WAAA;AAAA,IACL,QAAA;AAAA,IACA,IAAA,CAAK,UAAU,KAAK,CAAA;AAAA,IACpB,GAAA,GAAM;AAAA,GACR;AACA,EAAA,OAAO,QAAQ,IAAI,CAAA;AACrB;AAEA,SAAS,QAAA,CAAS,GAAsB,GAAA,EAAmC;AACzE,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,IAAA;AAAA,IACJ,QAAQ,CAAA,CAAE,GAAA;AAAA,IACV,SAAS,CAAA,CAAE,GAAA;AAAA,IACX,KAAK,CAAA,CAAE,GAAA;AAAA,IACP,QAAQ,CAAA,CAAE,MAAA;AAAA,IACV,WAAW,CAAA,CAAE,SAAA;AAAA,IACb,WAAW,CAAA,CAAE,GAAA;AAAA,IACb,kBAAkB,UAAA,CAAW,MAAA,CAAO,IAAA,CAAK,GAAG,CAAC,CAAC,CAAA;AAAA,IAC9C,WAAW,CAAA,CAAE;AAAA,GACf;AACF;AASA,eAAsB,kBAAA,CACpB,YAAA,EACA,MAAA,EACA,IAAA,EACuB;AACvB,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,MAAA,CAAO,GAAG,CAAA;AAChC,EAAA,MAAM,IAAA,GAAO,UAAU,KAAK,CAAA;AAC5B,EAAA,MAAM,iBAAA,GAAoB,OAAO,iBAAA,IAAqB,IAAA;AACtD,EAAA,MAAM,aAAA,GAAgB,OAAO,aAAA,IAAiB,IAAA;AAC9C,EAAA,IACE,sBACC,OAAO,MAAA,CAAO,aAAa,QAAA,IAC1B,MAAA,CAAO,SAAS,MAAA,KAAW,CAAA,IAC3B,OAAO,KAAA,KAAU,MAAA,IAChB,OAAO,MAAA,CAAO,KAAA,KAAU,YAAY,MAAA,CAAO,KAAA,CAAM,WAAW,CAAA,CAAA,EAC/D;AACA,IAAA,MAAM,IAAI,SAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,kBAA2B,MAAA,CAAO,eAAA;AACxC,EAAA,IACE,oBAAoB,MAAA,KACnB,OAAO,eAAA,KAAoB,QAAA,IAAY,gBAAgB,MAAA,KAAW,CAAA,CAAA;AAEnE,IAAA,MAAM,IAAI,UAAU,gDAAgD,CAAA;AAGtE,EAAA,MAAM,MAAA,GAAS,MAAM,YAAY,CAAA;AACjC,EAAA,IAAI,CAAC,MAAA,EAAQ,OAAO,IAAA,CAAK,WAAW,CAAA;AAGpC,EAAA,MAAM,IAAI,MAAM,iBAAA,CAAkB,QAAQ,MAAA,CAAO,OAAA,EAAS,KAAK,QAAQ,CAAA;AACvE,EAAA,IAAI,IAAA,IAAQ,GAAG,OAAO,CAAA;AAGtB,EAAA,IAAI,MAAA,CAAO,eAAA,KAAoB,MAAA,IAAa,CAAA,CAAE,QAAQ,MAAA,CAAO,eAAA;AAC3D,IAAA,OAAO,KAAK,eAAe,CAAA;AAG7B,EAAA,IAAI,OAAA,GAAmB,OAAA;AACvB,EAAA,IAAI,MAAA,CAAO,UAAU,MAAA,EAAW;AAC9B,IAAA,IAAI,iBAAA,EAAmB,OAAO,IAAA,CAAK,sBAAsB,CAAA;AAAA,EAC3D,CAAA,MAAO;AACL,IAAA,IACE,CAAC,CAAA,CAAE,SAAA,IACH,OAAO,QAAA,KAAa,MAAA,IACpB,OAAO,KAAA,KAAU,MAAA;AAEjB,MAAA,OAAO,KAAK,iBAAiB,CAAA;AAC/B,IAAA,MAAM,SAAA,GACJ,MAAA,CAAO,GAAA,GAAM,GAAA,GAAM,OAAO,WAAA,CAAY,GAAA,CAAI,CAAA,CAAA,KAAK,CAAA,EAAG,CAAA,CAAE,GAAG,CAAA,CAAA,CAAG,CAAA,CAAE,KAAK,EAAE,CAAA;AACrE,IAAA,MAAM,QAAQ,MAAM,eAAA;AAAA,MAClB,MAAA,CAAO,KAAA;AAAA,MACP,SAAA;AAAA,MACA,CAAA,CAAE,SAAA;AAAA,MACF,MAAA,CAAO,QAAA;AAAA,MACP,MAAA,CAAO,KAAA;AAAA,MACP;AAAA,KACF;AACA,IAAA,IAAI,CAAC,KAAA,EAAO,OAAO,IAAA,CAAK,iBAAiB,CAAA;AAEzC,IAAA,OAAA,GAAU;AAAA,MACR,eAAA,EAAiB,IAAA;AAAA,MACjB,mBAAA,EAAqB,OAAO,eAAA,KAAoB;AAAA,KAClD;AAAA,EACF;AAGA,EAAA,IAAI,CAAC,MAAA,CAAO,IAAA,CAAK,QAAA,CAAS,CAAA,CAAE,GAAG,CAAA,EAAG,OAAO,IAAA,CAAK,YAAA,EAAc,OAAO,CAAA;AAGnE,EAAA,MAAM,OAAA,GAAU,QAAA,CAAS,CAAA,EAAG,IAAA,EAAM,OAAO,CAAA;AACzC,EAAA,IAAI,SAAS,OAAO,OAAA;AAGpB,EAAA,MAAM,MAAA,GAAS,OAAO,OAAA,CAAQ,MAAA;AAC9B,EAAA,IAAI,WAAW,MAAA,EAAW;AACxB,IAAA,IAAI,aAAA,EAAe,OAAO,IAAA,CAAK,WAAA,EAAa,OAAO,CAAA;AAAA,EACrD,CAAA,MAAO;AACL,IAAA,MAAM,GAAA,GAAM,SAAA,CAAU,MAAA,EAAQ,IAAI,CAAA;AAClC,IAAA,IAAI,CAAC,GAAA,EAAK,OAAO,IAAA,CAAK,aAAa,OAAO,CAAA;AAC1C,IAAA,MAAM,QAAQ,MAAM,QAAA,CAAS,MAAM,CAAA,CAAE,SAAA,EAAW,KAAK,KAAK,CAAA;AAC1D,IAAA,IAAI,KAAA,KAAU,cAAA,EAAgB,OAAO,IAAA,CAAK,aAAa,OAAO,CAAA;AAC9D,IAAA,IAAI,KAAA,KAAU,CAAA,EAAG,OAAO,IAAA,CAAK,WAAW,OAAO,CAAA;AAAA,EACjD;AAEA,EAAA,OAAO,QAAA,CAAS,CAAA,EAAG,MAAA,CAAO,GAAG,CAAA;AAC/B;AAiCA,eAAsB,sBAAA,CACpB,YACA,IAAA,EACuB;AACvB,EAAA,MAAM,IAAA,GAAO,SAAA,CAAU,OAAA,CAAQ,IAAA,CAAK,GAAG,CAAC,CAAA;AACxC,EAAA,IAAI,cAAA;AACJ,EAAA,IAAI,IAAA,CAAK,qBAAqB,UAAA,EAAY;AACxC,IAAA,cAAA,GAAiB,IAAA,CAAK,SAAA;AAAA,EACxB,CAAA,MAAO;AACL,IAAA,IAAI;AACF,MAAA,cAAA,GAAiB,gBAAA,CAAiB,KAAK,SAAS,CAAA;AAAA,IAClD,CAAA,CAAA,MAAQ;AACN,MAAA,cAAA,GAAiB,IAAI,WAAW,CAAC,CAAA;AAAA,IACnC;AAAA,EACF;AACA,EAAA,IAAI,eAAe,MAAA,KAAW,EAAA;AAC5B,IAAA,MAAM,IAAI,UAAU,wCAAwC,CAAA;AAC9D,EAAA,MAAM,iBAA0B,IAAA,CAAK,MAAA;AACrC,EAAA,IACE,mBAAmB,KAAA,KAClB,OAAO,cAAA,KAAmB,QAAA,IAAY,eAAe,MAAA,KAAW,CAAA,CAAA;AAEjE,IAAA,MAAM,IAAI,SAAA;AAAA,MACR;AAAA,KACF;AACF,EAAA,MAAM,MAAA,GAAS,MAAM,UAAU,CAAA;AAC/B,EAAA,IAAI,CAAC,MAAA,IAAU,MAAA,CAAO,UAAU,MAAA,EAAW,OAAO,KAAK,WAAW,CAAA;AAClE,EAAA,MAAM,IAAI,MAAM,iBAAA;AAAA,IACd,MAAA;AAAA,IACA,OAAO,cAAA,KAAmB,QAAA,GAAW,CAAC,cAAc,IAAI,MAAM,IAAA;AAAA,IAC9D,IAAA,CAAK;AAAA,GACP;AACA,EAAA,IAAI,IAAA,IAAQ,GAAG,OAAO,CAAA;AACtB,EAAA,IAAI,EAAE,GAAA,KAAQ,IAAA,CAAK,OAAA,EAAS,OAAO,KAAK,eAAe,CAAA;AACvD,EAAA,IAAI,CAAC,CAAA,CAAE,SAAA,IAAa,CAAC,eAAA,CAAgB,CAAA,CAAE,WAAW,cAAc,CAAA;AAC9D,IAAA,OAAO,KAAK,iBAAiB,CAAA;AAC/B,EAAA,MAAM,IAAA,GAAO,OAAO,IAAA,CAAK,GAAA,KAAQ,WAAW,CAAC,IAAA,CAAK,GAAG,CAAA,GAAI,IAAA,CAAK,GAAA;AAC9D,EAAA,IAAI,CAAC,KAAK,QAAA,CAAS,CAAA,CAAE,GAAG,CAAA,EAAG,OAAO,KAAK,YAAY,CAAA;AACnD,EAAA,MAAM,OAAA,GAAU,QAAA,CAAS,CAAA,EAAG,IAAA,EAAM,OAAO,CAAA;AACzC,EAAA,IAAI,SAAS,OAAO,OAAA;AACpB,EAAA,OAAO,QAAA,CAAS,CAAA,EAAG,MAAA,CAAO,GAAG,CAAA;AAC/B","file":"chunk-STMMFNVW.js","sourcesContent":["/**\n * `@ixo/credentials-kit/verify` — verify an SD-JWT VC under a verifier's policy\n * (`verifyPresentation`) or as a wallet receiving it from an issuer (`verifyIssuedCredential`).\n * A generalisation of ixo-yo-rewards `src/eligibility/credential.ts` (itself a port of\n * pay-convert-oracle `src/convert/kyc.ts`) that returns the disclosed claims instead of reducing\n * them to booleans.\n *\n * `verifyPresentation` rules, in order:\n *\n *  1. well formed (`malformed`): an SD-JWT of at most 32 KiB, header `alg` `EdDSA` or `Ed25519`\n *     and `typ: dc+sd-jwt` (`vc+sd-jwt`, the pre-November-2024 value, is still accepted),\n *     `_sd_alg` absent or `sha-256`, string `iss` and `vct`, numeric `exp` (a credential without\n *     an expiry is refused), numeric `nbf`/`iat` when present;\n *  2. `iss` accepted by `policy.issuers` (`untrusted_issuer`);\n *  3. signed by THE key the header `kid` names: an Ed25519 `assertionMethod` key of the issuer's\n *     DID document controlled by the issuer (`issuer_key_unpublished`, `bad_signature`); no\n *     \"try every key\";\n *  4. disclosures, RFC 9901 §7.1 (`bad_disclosure`): processed recursively (nested objects and\n *     array elements); every disclosure must match exactly one digest, no digest may appear twice,\n *     a disclosure never overwrites a claim at its level, and `iss`, `nbf`, `exp`, `cnf`, `vct`,\n *     `vct#integrity`, `aka_vcts` and `status` are never accepted from a disclosure (SD-JWT VC\n *     §2.2.2.3). `sub` and `iat` may be disclosed. `_sd`, `_sd_alg` and `...` never reach\n *     `claims`; claims named `__proto__`, `constructor`, `prototype` are refused (`malformed`).\n *     `sub` must then be a string (plaintext or disclosed);\n *  5. `sub` = `policy.expectedSubject` when given (`wrong_subject`);\n *  6. key binding (default required): a KB-JWT `typ: kb+jwt`, `alg` `EdDSA`/`Ed25519`, signed by\n *     the credential's `cnf.jwk` (Ed25519), `aud` = `policy.audience`, `nonce` accepted by\n *     `policy.nonce` (the exact string, or a callback for single-use nonce stores), `iat` at most\n *     5 minutes old (2 minutes of skew), `exp`/`nbf` honoured when present, `sd_hash` over the\n *     presented `<jwt>~<disclosures>~` (`key_binding_required`, `bad_key_binding`). Whenever key\n *     binding is required, `policy.audience` and `policy.nonce` MUST be given (TypeError\n *     otherwise: there is no \"accept any nonce\"). A KB-JWT that is present is always checked; when\n *     key binding is not required and no audience/nonce is given, a present KB-JWT fails\n *     (`bad_key_binding`) rather than being accepted unchecked;\n *     — up to here, a failure says nothing about who sent the presentation. From here on the\n *       key binding holds (`keyBindingValid: true` on a failure): the issuer is trusted, its\n *       signature holds and the KB-JWT proved possession of the credential's own `cnf` for this\n *       nonce and audience. Whoever holds ANY credential from an accepted issuer gets that far,\n *       so it is `holderAuthenticated: true` only when `policy.expectedSubject` was given (and\n *       matched): then the answer is bound to the person the verifier expected. —\n *  7. `vct` ∈ `policy.vcts` (`wrong_type`);\n *  8. `exp` / `nbf` hold, 2 minutes of skew (`expired`, `not_yet_valid`);\n *  9. status (default required): `status.status_list.{uri, idx}` names a Token Status List that\n *     verifies (see `status`) and whose entry is 0 (`no_status`, `revoked`). An index outside the\n *     list is a hard failure (`no_status`, TSL §8.3 step 6).\n *\n * Infrastructure failures (DID source down, status list unreachable or not verifying) THROW\n * `VerificationUnavailable`: \"down is not no\", and never \"yes\".\n */\nimport { sha256 } from '@noble/hashes/sha2.js';\nimport {\n  ResolverUnavailable,\n  findKey,\n  type DidDocument,\n  type DidResolver,\n} from './did';\nimport { bytesToHex, timingSafeEqual, utf8 } from './internal/bytes';\nimport { cacheGet, cachePut, type KeyValueCache } from './internal/cache';\nimport { CredentialsKitError } from './internal/errors';\nimport {\n  HttpError,\n  isFetchableUrl,\n  request,\n  type FetchLike,\n} from './internal/http';\nimport {\n  CLOCK_SKEW_S,\n  clockMs,\n  isRecord,\n  toSeconds,\n  type JsonObject,\n} from './internal/util';\nimport {\n  JoseError,\n  decodeJws,\n  isEd25519JwsAlg,\n  publicJwkFromRaw,\n  rawFromPublicJwk,\n  verifyEd25519,\n  type Ed25519PublicJwk,\n} from './jose';\nimport {\n  SdJwtError,\n  parseSdJwt,\n  processDisclosures,\n  sdHash,\n  type ParsedSdJwt,\n} from './sdjwt';\nimport {\n  MAX_STATUS_LIST_TOKEN_LENGTH,\n  STATUS_LIST_MEDIA_TYPE,\n  StatusListError,\n  statusAt,\n  verifyStatusListToken,\n} from './status';\n\nexport type VerifyFailureCode =\n  | 'malformed'\n  | 'untrusted_issuer'\n  | 'wrong_type'\n  | 'issuer_key_unpublished'\n  | 'bad_signature'\n  | 'expired'\n  | 'not_yet_valid'\n  | 'bad_disclosure'\n  | 'wrong_subject'\n  | 'key_binding_required'\n  | 'bad_key_binding'\n  | 'revoked'\n  | 'no_status';\n\nexport const VERIFY_FAILURE_DETAILS: Record<VerifyFailureCode, string> = {\n  malformed: 'The presentation is not a well-formed SD-JWT VC.',\n  untrusted_issuer: 'The credential issuer is not accepted.',\n  wrong_type: 'The credential type is not accepted.',\n  issuer_key_unpublished:\n    \"The credential's signing key is not an assertion key on the issuer's DID document.\",\n  bad_signature: 'The credential signature does not verify.',\n  expired: 'The credential has expired.',\n  not_yet_valid: 'The credential is not valid yet.',\n  bad_disclosure: 'A disclosure does not belong to the credential.',\n  wrong_subject: 'The credential was issued to someone else.',\n  key_binding_required: 'The presentation has no key binding.',\n  bad_key_binding: 'The key binding does not verify for this request.',\n  revoked: 'The credential has been revoked.',\n  no_status: 'The credential has no usable status list entry.',\n};\n\n/** Checks a KB-JWT nonce: the exact value, or a callback (e.g. a single-use nonce store). */\nexport type NonceCheck =\n  string | ((nonce: string) => boolean | Promise<boolean>);\n\nexport interface VerifyPolicy {\n  /** Accepted issuer DIDs, or a predicate. */\n  issuers: readonly string[] | ((did: string) => boolean);\n  /** Accepted `vct` values. */\n  vcts: readonly string[];\n  /**\n   * The KB-JWT `aud`: the verifier's full OpenID4VP client_id (or the audience your own protocol\n   * fixed). REQUIRED when key binding is required.\n   */\n  audience?: string;\n  /**\n   * The nonce the KB-JWT must carry: the one you issued for THIS check, or a callback that\n   * accepts each issued nonce once. REQUIRED when key binding is required.\n   */\n  nonce?: NonceCheck;\n  /** Default true. */\n  requireKeyBinding?: boolean;\n  /** Default true. */\n  requireStatus?: boolean;\n  /**\n   * The credential's `sub` must equal this (`wrong_subject`). Also what makes a failure\n   * `holderAuthenticated`: without it no answer is bound to a person you expected, so\n   * `holderAuthenticated` is always false (see `keyBindingValid`).\n   */\n  expectedSubject?: string;\n  /** ms since the epoch; default `Date.now()`. */\n  now?: number;\n}\n\nexport interface VerifyDeps {\n  resolver: DidResolver;\n  fetch: FetchLike;\n  /**\n   * Verified status list tokens (pass a KV binding or `createMemoryCache()`). Without one every\n   * verification fetches the list.\n   */\n  statusCache?: KeyValueCache;\n  /** Fetch a status list on a loopback host over http (local development only; needs `allowLocal`). */\n  allowHttp?: boolean;\n  /** Fetch a status list on a loopback / private / local-name host (local development only). */\n  allowLocal?: boolean;\n}\n\nexport interface VerifiedPresentation {\n  ok: true;\n  issuer: string;\n  subject: string;\n  vct: string;\n  /**\n   * The processed claims: plaintext claims (registered claims removed) plus the disclosed ones,\n   * with nested disclosures in place. Never contains `_sd`, `_sd_alg` or `...`.\n   */\n  claims: JsonObject;\n  /** Names of the top-level claims that came from a disclosure. */\n  disclosed: string[];\n  /** The credential's `exp` (unix seconds). */\n  expiresAt: number | null;\n  /** Lower-case hex SHA-256 of the issuer-signed JWT: one value per credential, whatever is disclosed. */\n  credentialSha256: string;\n  /** The credential's `cnf.jwk`, when it has one. */\n  holderKey: Ed25519PublicJwk | null;\n}\n\nexport interface FailedPresentation {\n  ok: false;\n  code: VerifyFailureCode;\n  /** A fixed sentence for the code (no credential content). */\n  detail: string;\n  /**\n   * True only when the failure came AFTER the answer was bound to the person you expected: a\n   * trusted issuer's valid signature, the key binding for this nonce and audience, AND\n   * `policy.expectedSubject` given and equal to `sub`. The person really answered, and their\n   * answer does not meet the policy (wrong type, expired, revoked, …). False for everything a\n   * third party could have sent, always false without key binding, and always false without\n   * `expectedSubject` (a stranger's own credential would pass every other step).\n   */\n  holderAuthenticated: boolean;\n  /**\n   * True when the failure came after the KB-JWT verified for this nonce and audience with the\n   * presented credential's OWN `cnf` key (trusted issuer, valid signature). It proves that the\n   * holder of THAT credential answered, not that it is the person you meant: never close a\n   * check on it alone. Always false without key binding.\n   */\n  keyBindingValid: boolean;\n}\n\nexport type VerifyResult = VerifiedPresentation | FailedPresentation;\n\nexport type UnavailableSource = 'resolver' | 'status_list';\n\n/** A dependency could not answer; nothing can be concluded about the credential (answer 503). */\nexport class VerificationUnavailable extends CredentialsKitError {\n  declare readonly code: 'verification_unavailable';\n  readonly source: UnavailableSource;\n  /** A constant cause code (`unreachable`, `http_status`, `too_large`, a `StatusListError` code, …). */\n  readonly reason: string;\n  constructor(source: UnavailableSource, reason: string) {\n    super(\n      'verification_unavailable',\n      source === 'resolver'\n        ? \"The issuer's DID document could not be read.\"\n        : 'The credential status list could not be read or verified.'\n    );\n    this.source = source;\n    this.reason = reason;\n  }\n}\n\nconst KB_MAX_AGE_S = 300;\nconst DEFAULT_STATUS_TTL_S = 300;\nconst MAX_STATUS_TTL_S = 86_400;\nconst SD_JWT_TYPS = new Set(['dc+sd-jwt', 'vc+sd-jwt']);\n/**\n * Top-level claims never accepted from a disclosure (SD-JWT VC §2.2.2.3 \"MUST NOT be selectively\n * disclosed\"). Taking them only from the issuer-signed plaintext means a holder can never\n * withhold `status`, `exp` or `cnf`.\n */\nconst NEVER_DISCLOSED = new Set([\n  'iss',\n  'nbf',\n  'exp',\n  'cnf',\n  'vct',\n  'vct#integrity',\n  'aka_vcts',\n  'status',\n]);\n/** Registered / structural members left out of `claims`. */\nconst NOT_CLAIMS = new Set([\n  'iss',\n  'sub',\n  'iat',\n  'nbf',\n  'exp',\n  'vct',\n  'vct#integrity',\n  'aka_vcts',\n  'cnf',\n  'status',\n]);\n\n/** How far a failed presentation got: see `FailedPresentation`. */\ninterface Binding {\n  keyBindingValid: boolean;\n  holderAuthenticated: boolean;\n}\n\nconst UNBOUND: Binding = { keyBindingValid: false, holderAuthenticated: false };\n\nfunction fail(\n  code: VerifyFailureCode,\n  binding: Binding = UNBOUND\n): FailedPresentation {\n  return {\n    ok: false,\n    code,\n    detail: VERIFY_FAILURE_DETAILS[code],\n    holderAuthenticated: binding.holderAuthenticated,\n    keyBindingValid: binding.keyBindingValid,\n  };\n}\n\nfunction issuerAccepted(\n  issuers: VerifyPolicy['issuers'],\n  did: string\n): boolean {\n  return typeof issuers === 'function' ? issuers(did) : issuers.includes(did);\n}\n\nasync function resolveIssuer(\n  resolver: DidResolver,\n  did: string\n): Promise<DidDocument | null> {\n  try {\n    return await resolver(did);\n  } catch (e) {\n    if (e instanceof ResolverUnavailable) {\n      throw new VerificationUnavailable('resolver', e.source);\n    }\n    throw e;\n  }\n}\n\nfunction parse(presentation: unknown): ParsedSdJwt | null {\n  try {\n    return parseSdJwt(\n      typeof presentation === 'string' ? presentation.trim() : ''\n    );\n  } catch (e) {\n    if (e instanceof SdJwtError || e instanceof JoseError) return null;\n    throw e;\n  }\n}\n\ninterface CheckedCredential {\n  iss: string;\n  sub: string;\n  vct: string;\n  exp: number;\n  nbf: number | undefined;\n  claims: JsonObject;\n  disclosed: string[];\n  issuerDoc: DidDocument;\n  /** Raw cnf key, when `cnf.jwk` is an Ed25519 OKP key. */\n  holderRaw: Uint8Array | null;\n  holderKey: Ed25519PublicJwk | null;\n}\n\n/**\n * Steps 1–4 (shape, trust, issuer signature, disclosures), shared by `verifyPresentation` and\n * `verifyIssuedCredential`. Returns the checked credential or the failure.\n */\nasync function checkIssuerSigned(\n  parsed: ParsedSdJwt,\n  issuers: VerifyPolicy['issuers'],\n  resolver: DidResolver\n): Promise<CheckedCredential | FailedPresentation> {\n  const { header, payload } = parsed;\n  if (!isEd25519JwsAlg(header.alg) || !SD_JWT_TYPS.has(header.typ as string))\n    return fail('malformed');\n  if (payload._sd_alg !== undefined && payload._sd_alg !== 'sha-256')\n    return fail('malformed');\n  const { iss, vct, exp, nbf, iat } = payload;\n  if (typeof iss !== 'string' || typeof vct !== 'string')\n    return fail('malformed');\n  if (typeof exp !== 'number' || !Number.isFinite(exp))\n    return fail('malformed');\n  if (nbf !== undefined && (typeof nbf !== 'number' || !Number.isFinite(nbf)))\n    return fail('malformed');\n  if (iat !== undefined && (typeof iat !== 'number' || !Number.isFinite(iat)))\n    return fail('malformed');\n\n  // 2. Trust.\n  if (!issuerAccepted(issuers, iss)) return fail('untrusted_issuer');\n\n  // 3. The issuer's key, by kid, under assertionMethod.\n  const issuerDoc = await resolveIssuer(resolver, iss);\n  const kid = typeof header.kid === 'string' ? header.kid : '';\n  // findKey only returns a key whose id is a DID URL of the document (= iss).\n  const issuerKey =\n    issuerDoc?.id === iss ? findKey(issuerDoc, kid, 'assertionMethod') : null;\n  if (!issuerDoc || !issuerKey) return fail('issuer_key_unpublished');\n  const jws = decodeJws(parsed.jwt);\n  if (\n    !verifyEd25519(jws.signature, utf8(jws.signingInput), issuerKey.publicKey)\n  ) {\n    return fail('bad_signature');\n  }\n\n  // 4. Disclosures (RFC 9901 §7.1, recursive).\n  let processed;\n  try {\n    processed = processDisclosures(payload, parsed.disclosures);\n  } catch (e) {\n    if (e instanceof SdJwtError)\n      return fail(e.code === 'malformed' ? 'malformed' : 'bad_disclosure');\n    throw e;\n  }\n  if (processed.disclosed.some(name => NEVER_DISCLOSED.has(name)))\n    return fail('bad_disclosure');\n  const { claims } = processed;\n  const sub = claims.sub;\n  if (typeof sub !== 'string') return fail('malformed');\n  if (\n    claims.iat !== undefined &&\n    (typeof claims.iat !== 'number' || !Number.isFinite(claims.iat))\n  )\n    return fail('malformed');\n\n  let holderRaw: Uint8Array | null = null;\n  let holderKey: Ed25519PublicJwk | null = null;\n  const cnf = payload.cnf;\n  if (cnf !== undefined) {\n    try {\n      holderRaw = rawFromPublicJwk(isRecord(cnf) ? cnf.jwk : undefined);\n      holderKey = publicJwkFromRaw(holderRaw);\n    } catch {\n      holderRaw = null;\n    }\n  }\n\n  return {\n    iss,\n    sub,\n    vct,\n    exp,\n    nbf: typeof nbf === 'number' ? nbf : undefined,\n    claims: Object.fromEntries(\n      Object.entries(claims).filter(([name]) => !NOT_CLAIMS.has(name))\n    ),\n    disclosed: processed.disclosed,\n    issuerDoc,\n    holderRaw,\n    holderKey,\n  };\n}\n\nfunction validity(\n  c: CheckedCredential,\n  nowS: number,\n  binding: Binding\n): FailedPresentation | null {\n  if (nowS > c.exp + CLOCK_SKEW_S) return fail('expired', binding);\n  if (c.nbf !== undefined && nowS + CLOCK_SKEW_S < c.nbf)\n    return fail('not_yet_valid', binding);\n  return null;\n}\n\nasync function nonceAccepted(check: NonceCheck, nonce: string) {\n  return typeof check === 'string' ? nonce === check : await check(nonce);\n}\n\nasync function keyBindingHolds(\n  kbJwt: string,\n  presentedSdJwt: string,\n  holderKey: Uint8Array,\n  audience: string,\n  nonce: NonceCheck,\n  nowS: number\n): Promise<boolean> {\n  let kb;\n  try {\n    kb = decodeJws(kbJwt);\n  } catch {\n    return false;\n  }\n  if (kb.header.typ !== 'kb+jwt' || !isEd25519JwsAlg(kb.header.alg))\n    return false;\n  if (!verifyEd25519(kb.signature, utf8(kb.signingInput), holderKey))\n    return false;\n  const { payload } = kb;\n  if (payload.aud !== audience) return false;\n  if (\n    typeof payload.iat !== 'number' ||\n    payload.iat > nowS + CLOCK_SKEW_S ||\n    payload.iat < nowS - KB_MAX_AGE_S - CLOCK_SKEW_S\n  ) {\n    return false;\n  }\n  if (\n    payload.exp !== undefined &&\n    (typeof payload.exp !== 'number' || nowS > payload.exp + CLOCK_SKEW_S)\n  )\n    return false;\n  if (\n    payload.nbf !== undefined &&\n    (typeof payload.nbf !== 'number' || nowS + CLOCK_SKEW_S < payload.nbf)\n  )\n    return false;\n  if (payload.sd_hash !== sdHash(presentedSdJwt)) return false;\n  // Last: a callback may consume a single-use nonce, so only a binding that holds reaches it.\n  if (typeof payload.nonce !== 'string' || payload.nonce.length === 0)\n    return false;\n  return nonceAccepted(nonce, payload.nonce);\n}\n\ninterface StatusRef {\n  uri: string;\n  idx: number;\n}\n\nfunction statusRef(status: unknown, deps: VerifyDeps): StatusRef | null {\n  const list = isRecord(status) ? status.status_list : undefined;\n  if (!isRecord(list)) return null;\n  const { uri, idx } = list;\n  if (\n    typeof uri !== 'string' ||\n    !isFetchableUrl(uri, {\n      allowHttp: deps.allowHttp ?? false,\n      allowLocal: deps.allowLocal ?? false,\n    })\n  )\n    return null;\n  if (typeof idx !== 'number' || !Number.isSafeInteger(idx) || idx < 0)\n    return null;\n  return { uri, idx };\n}\n\ninterface CachedStatus {\n  token: string;\n  iat: number;\n  /** ms since the epoch until which the token may be used without a fetch. */\n  freshUntil: number;\n}\n\nfunction readCachedStatus(raw: string | null): CachedStatus | null {\n  if (raw === null) return null;\n  try {\n    const v: unknown = JSON.parse(raw);\n    if (\n      isRecord(v) &&\n      typeof v.token === 'string' &&\n      typeof v.iat === 'number' &&\n      typeof v.freshUntil === 'number'\n    ) {\n      return { token: v.token, iat: v.iat, freshUntil: v.freshUntil };\n    }\n  } catch {\n    // a bad cache entry is a miss\n  }\n  return null;\n}\n\n/**\n * The status value at `ref.idx` of the issuer's list, or `'out_of_range'` when the index is\n * past the list. A cached token is used until its `ttl` (capped at a day; 5 minutes when\n * absent) runs out, and re-verified each time; a fresh token must not be older than the cached\n * one (rollback protection).\n */\nasync function statusOf(\n  deps: VerifyDeps,\n  issuerDoc: DidDocument,\n  ref: StatusRef,\n  nowMs: number\n): Promise<number | 'out_of_range'> {\n  const cacheKey = `ixo-credentials-kit:status:v1:${bytesToHex(\n    sha256(utf8(`${issuerDoc.id}|${ref.uri}`))\n  )}`;\n  const cached = readCachedStatus(await cacheGet(deps.statusCache, cacheKey));\n  const unavailable = (reason: string) =>\n    new VerificationUnavailable('status_list', reason);\n  const check = async (token: string, minIat?: number) => {\n    try {\n      return await verifyStatusListToken(token, {\n        uri: ref.uri,\n        issuerDoc,\n        now: nowMs,\n        ...(minIat !== undefined ? { minIat } : {}),\n      });\n    } catch (e) {\n      if (e instanceof StatusListError) throw unavailable(e.code);\n      throw e;\n    }\n  };\n  const valueAt = (\n    list: Awaited<ReturnType<typeof check>>\n  ): number | 'out_of_range' => {\n    try {\n      return statusAt(list.bits, ref.idx, list.bitsPerEntry);\n    } catch {\n      return 'out_of_range';\n    }\n  };\n\n  if (cached && cached.freshUntil > nowMs) {\n    try {\n      return valueAt(await check(cached.token));\n    } catch (e) {\n      // A cached token that no longer verifies (expired, key rotated): fetch a fresh one.\n      if (!(e instanceof VerificationUnavailable)) throw e;\n    }\n  }\n\n  let token: string;\n  try {\n    const res = await request(deps.fetch, ref.uri, {\n      headers: { accept: STATUS_LIST_MEDIA_TYPE },\n      maxBytes: MAX_STATUS_LIST_TOKEN_LENGTH,\n    });\n    if (res.status !== 200) throw unavailable('http_status');\n    token = res.text.trim();\n  } catch (e) {\n    if (e instanceof VerificationUnavailable) throw e;\n    if (e instanceof HttpError) {\n      throw unavailable(\n        e.kind === 'too_large'\n          ? 'too_large'\n          : e.kind === 'status'\n            ? 'http_status'\n            : 'unreachable'\n      );\n    }\n    throw unavailable('unreachable');\n  }\n  const list = await check(token, cached?.iat);\n  const ttl = Math.min(list.ttl ?? DEFAULT_STATUS_TTL_S, MAX_STATUS_TTL_S);\n  const entry: CachedStatus = {\n    token,\n    iat: list.iat,\n    freshUntil: nowMs + ttl * 1000,\n  };\n  // Kept for a day past freshness so the rollback check has the last iat.\n  await cachePut(\n    deps.statusCache,\n    cacheKey,\n    JSON.stringify(entry),\n    ttl + MAX_STATUS_TTL_S\n  );\n  return valueAt(list);\n}\n\nfunction verified(c: CheckedCredential, jwt: string): VerifiedPresentation {\n  return {\n    ok: true,\n    issuer: c.iss,\n    subject: c.sub,\n    vct: c.vct,\n    claims: c.claims,\n    disclosed: c.disclosed,\n    expiresAt: c.exp,\n    credentialSha256: bytesToHex(sha256(utf8(jwt))),\n    holderKey: c.holderKey,\n  };\n}\n\n/**\n * Verify an SD-JWT VC presentation (`<jwt>~<disclosures>~<kb-jwt>`). Returns\n * `{ ok: true, … }` or `{ ok: false, code, detail, holderAuthenticated, keyBindingValid }`\n * (`holderAuthenticated` needs `policy.expectedSubject`); throws\n * `VerificationUnavailable` when a dependency cannot answer, and `TypeError` when key binding is\n * required but `policy.audience` or `policy.nonce` is missing.\n */\nexport async function verifyPresentation(\n  presentation: string,\n  policy: VerifyPolicy,\n  deps: VerifyDeps\n): Promise<VerifyResult> {\n  const nowMs = clockMs(policy.now);\n  const nowS = toSeconds(nowMs);\n  const requireKeyBinding = policy.requireKeyBinding ?? true;\n  const requireStatus = policy.requireStatus ?? true;\n  if (\n    requireKeyBinding &&\n    (typeof policy.audience !== 'string' ||\n      policy.audience.length === 0 ||\n      policy.nonce === undefined ||\n      (typeof policy.nonce === 'string' && policy.nonce.length === 0))\n  ) {\n    throw new TypeError(\n      'policy.audience and policy.nonce are required when key binding is required'\n    );\n  }\n  const expectedSubject: unknown = policy.expectedSubject;\n  if (\n    expectedSubject !== undefined &&\n    (typeof expectedSubject !== 'string' || expectedSubject.length === 0)\n  )\n    throw new TypeError('policy.expectedSubject must be a non-empty DID');\n\n  // 1. Shape.\n  const parsed = parse(presentation);\n  if (!parsed) return fail('malformed');\n\n  // 1–4. Shape, trust, issuer signature, disclosures.\n  const c = await checkIssuerSigned(parsed, policy.issuers, deps.resolver);\n  if ('ok' in c) return c;\n\n  // 5. Subject.\n  if (policy.expectedSubject !== undefined && c.sub !== policy.expectedSubject)\n    return fail('wrong_subject');\n\n  // 6. Key binding.\n  let binding: Binding = UNBOUND;\n  if (parsed.kbJwt === undefined) {\n    if (requireKeyBinding) return fail('key_binding_required');\n  } else {\n    if (\n      !c.holderRaw ||\n      policy.audience === undefined ||\n      policy.nonce === undefined\n    )\n      return fail('bad_key_binding');\n    const presented =\n      parsed.jwt + '~' + parsed.disclosures.map(d => `${d.raw}~`).join('');\n    const holds = await keyBindingHolds(\n      parsed.kbJwt,\n      presented,\n      c.holderRaw,\n      policy.audience,\n      policy.nonce,\n      nowS\n    );\n    if (!holds) return fail('bad_key_binding');\n    // Bound to the person only when the verifier said who it expected (step 5 matched).\n    binding = {\n      keyBindingValid: true,\n      holderAuthenticated: policy.expectedSubject !== undefined,\n    };\n  }\n\n  // 7. Type.\n  if (!policy.vcts.includes(c.vct)) return fail('wrong_type', binding);\n\n  // 8. Validity period.\n  const invalid = validity(c, nowS, binding);\n  if (invalid) return invalid;\n\n  // 9. Status (last: it reaches the network).\n  const status = parsed.payload.status;\n  if (status === undefined) {\n    if (requireStatus) return fail('no_status', binding);\n  } else {\n    const ref = statusRef(status, deps);\n    if (!ref) return fail('malformed', binding);\n    const value = await statusOf(deps, c.issuerDoc, ref, nowMs);\n    if (value === 'out_of_range') return fail('no_status', binding);\n    if (value !== 0) return fail('revoked', binding);\n  }\n\n  return verified(c, parsed.jwt);\n}\n\nexport interface VerifyIssuedCredentialOptions {\n  /**\n   * The issuer DID the credential must name in `iss` (for example the DID that deposited the\n   * offer). REQUIRED. `false` accepts any issuer whose own DID document holds the signing key:\n   * UNSAFE, since the credential is then authentic but anyone may have issued it (a foreign\n   * issuer can mint your types); judge `result.issuer` yourself before storing or showing it.\n   */\n  issuer: string | false;\n  /** The holder DID: the credential's `sub` must equal it. */\n  subject: string;\n  /** The key the wallet proved possession of: the credential's `cnf.jwk` must be exactly it. */\n  holderKey: Ed25519PublicJwk | Uint8Array;\n  /** The `vct` of the offered credential configuration (or the accepted list). */\n  vct: string | readonly string[];\n  resolver: DidResolver;\n  /** ms since the epoch; default `Date.now()`. */\n  now?: number;\n}\n\n/**\n * Check a credential a wallet just received from an issuer, before storing it (RFC 9901 §7.2,\n * SPEC §13.3): no KB-JWT, header and shape as `verifyPresentation`, `iss` = `opts.issuer` when\n * given (`untrusted_issuer`), the issuer's signature by its `assertionMethod` key named by `kid`,\n * every disclosure matching exactly one digest (recursive, `bad_disclosure`), `sub` =\n * `opts.subject` (`wrong_subject`), `cnf.jwk` = `opts.holderKey` (`bad_key_binding`), `vct` as\n * offered (`wrong_type`), `exp`/`nbf` (`expired`, `not_yet_valid`). The status list is not read\n * (a just-issued credential); verifiers check it at presentation. Returns the same result shape\n * as `verifyPresentation` (`holderAuthenticated` and `keyBindingValid` are always false); throws\n * `VerificationUnavailable` when the issuer's DID document cannot be read and `TypeError` when\n * `issuer` is neither a DID nor `false`.\n */\nexport async function verifyIssuedCredential(\n  credential: string,\n  opts: VerifyIssuedCredentialOptions\n): Promise<VerifyResult> {\n  const nowS = toSeconds(clockMs(opts.now));\n  let expectedHolder: Uint8Array;\n  if (opts.holderKey instanceof Uint8Array) {\n    expectedHolder = opts.holderKey;\n  } else {\n    try {\n      expectedHolder = rawFromPublicJwk(opts.holderKey);\n    } catch {\n      expectedHolder = new Uint8Array(0);\n    }\n  }\n  if (expectedHolder.length !== 32)\n    throw new TypeError('holderKey is not an Ed25519 public key');\n  const expectedIssuer: unknown = opts.issuer;\n  if (\n    expectedIssuer !== false &&\n    (typeof expectedIssuer !== 'string' || expectedIssuer.length === 0)\n  )\n    throw new TypeError(\n      'issuer is required: the expected issuer DID, or false to accept any issuer'\n    );\n  const parsed = parse(credential);\n  if (!parsed || parsed.kbJwt !== undefined) return fail('malformed');\n  const c = await checkIssuerSigned(\n    parsed,\n    typeof expectedIssuer === 'string' ? [expectedIssuer] : () => true,\n    opts.resolver\n  );\n  if ('ok' in c) return c;\n  if (c.sub !== opts.subject) return fail('wrong_subject');\n  if (!c.holderRaw || !timingSafeEqual(c.holderRaw, expectedHolder))\n    return fail('bad_key_binding');\n  const vcts = typeof opts.vct === 'string' ? [opts.vct] : opts.vct;\n  if (!vcts.includes(c.vct)) return fail('wrong_type');\n  const invalid = validity(c, nowS, UNBOUND);\n  if (invalid) return invalid;\n  return verified(c, parsed.jwt);\n}\n"]}

package/dist/chunk-VXKONZK4.js

@@ -0,0 +1,189 @@
+import { base58btcDecode, base58btcEncode, base64urlDecode, base64urlEncode, base64urlJson, utf8, fromUtf8 } from './chunk-AQ3IINHC.js';
+import { ed25519 as ed25519$1 } from '@noble/curves/ed25519.js';
+import { sha256 } from '@noble/hashes/sha2.js';
+
+// src/internal/errors.ts
+var CredentialsKitError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = new.target.name;
+  }
+};
+
+// src/internal/util.ts
+function isRecord(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function toSeconds(ms) {
+  return Math.floor(ms / 1e3);
+}
+var CLOCK_SKEW_S = 120;
+function clockMs(now) {
+  if (now === void 0) return Date.now();
+  if (typeof now !== "number" || !Number.isFinite(now) || now < 1e12) {
+    throw new TypeError(
+      "`now` is milliseconds since the epoch (Date.now()), not seconds."
+    );
+  }
+  return now;
+}
+
+// src/jose.ts
+var ED25519_JWS_ALGS = ["EdDSA", "Ed25519"];
+function isEd25519JwsAlg(alg) {
+  return alg === "EdDSA" || alg === "Ed25519";
+}
+var JOSE_MESSAGES = {
+  malformed: "The JWS is not a well-formed compact JWS with JSON header and payload.",
+  unsupported_alg: "The JWS does not use an Ed25519 algorithm.",
+  bad_signature: "The JWS signature does not verify.",
+  bad_key: "The key is not a valid Ed25519 public key."
+};
+var JoseError = class extends CredentialsKitError {
+  constructor(code) {
+    super(code, JOSE_MESSAGES[code]);
+  }
+};
+var MAX_JWS_LENGTH = 1024 * 1024;
+async function signJws(header, payload, signer) {
+  if (!isEd25519JwsAlg(header.alg)) throw new JoseError("unsupported_alg");
+  const signingInput = `${base64urlJson(header)}.${base64urlJson(payload)}`;
+  const signature = await signer.sign(utf8(signingInput));
+  return `${signingInput}.${base64urlEncode(signature)}`;
+}
+function decodeJws(compact) {
+  if (typeof compact !== "string" || compact.length > MAX_JWS_LENGTH) {
+    throw new JoseError("malformed");
+  }
+  const parts = compact.split(".");
+  if (parts.length !== 3) throw new JoseError("malformed");
+  const [h, p, s] = parts;
+  let header;
+  let payload;
+  let signature;
+  try {
+    header = JSON.parse(fromUtf8(base64urlDecode(h)));
+    payload = JSON.parse(fromUtf8(base64urlDecode(p)));
+    signature = base64urlDecode(s);
+  } catch {
+    throw new JoseError("malformed");
+  }
+  if (!isRecord(header) || !isRecord(payload)) throw new JoseError("malformed");
+  if (header.crit !== void 0) throw new JoseError("malformed");
+  return { header, payload, signature, signingInput: `${h}.${p}` };
+}
+function verifyEd25519(signature, message, publicKey) {
+  if (signature.length !== 64 || publicKey.length !== 32) return false;
+  try {
+    return ed25519$1.verify(signature, message, publicKey, {
+      zip215: false
+    });
+  } catch {
+    return false;
+  }
+}
+function verifyJws(compact, publicKey) {
+  try {
+    const jws = decodeJws(compact);
+    if (!isEd25519JwsAlg(jws.header.alg))
+      throw new JoseError("unsupported_alg");
+    if (!verifyEd25519(jws.signature, utf8(jws.signingInput), publicKey)) {
+      throw new JoseError("bad_signature");
+    }
+    return Promise.resolve(jws);
+  } catch (e) {
+    return Promise.reject(e instanceof Error ? e : new JoseError("malformed"));
+  }
+}
+function publicJwkFromRaw(raw) {
+  if (raw.length !== 32) throw new JoseError("bad_key");
+  return { kty: "OKP", crv: "Ed25519", x: base64urlEncode(raw) };
+}
+function rawFromPublicJwk(jwk) {
+  if (!isRecord(jwk) || jwk.kty !== "OKP" || jwk.crv !== "Ed25519" || typeof jwk.x !== "string" || jwk.x.length > MAX_KEY_STRING_LENGTHS.jwkX || "d" in jwk) {
+    throw new JoseError("bad_key");
+  }
+  let raw;
+  try {
+    raw = base64urlDecode(jwk.x);
+  } catch {
+    throw new JoseError("bad_key");
+  }
+  if (raw.length !== 32) throw new JoseError("bad_key");
+  return raw;
+}
+var MAX_KEY_STRING_LENGTHS = {
+  multibase: 60,
+  base58: 50,
+  hex: 64,
+  jwkX: 43
+};
+var ED25519_PUB_MULTICODEC = [237, 1];
+function multibaseToRaw(multibase) {
+  if (typeof multibase !== "string" || !multibase.startsWith("z") || multibase.length > MAX_KEY_STRING_LENGTHS.multibase) {
+    throw new JoseError("bad_key");
+  }
+  let bytes;
+  try {
+    bytes = base58btcDecode(multibase.slice(1));
+  } catch {
+    throw new JoseError("bad_key");
+  }
+  if (bytes.length === 34 && bytes[0] === ED25519_PUB_MULTICODEC[0] && bytes[1] === ED25519_PUB_MULTICODEC[1]) {
+    return bytes.slice(2);
+  }
+  if (bytes.length === 32) return bytes;
+  throw new JoseError("bad_key");
+}
+function rawToMultibase(raw) {
+  if (raw.length !== 32) throw new JoseError("bad_key");
+  const prefixed = new Uint8Array(34);
+  prefixed.set(ED25519_PUB_MULTICODEC);
+  prefixed.set(raw, 2);
+  return `z${base58btcEncode(prefixed)}`;
+}
+var base58btc = {
+  encode: base58btcEncode,
+  decode: base58btcDecode
+};
+var base64url = {
+  encode: base64urlEncode,
+  decode: base64urlDecode
+};
+var ed25519 = {
+  publicJwkFromRaw,
+  rawFromPublicJwk,
+  base58btc,
+  multibaseToRaw,
+  rawToMultibase,
+  verify: verifyEd25519,
+  /** The raw 32-byte public key of a 32-byte seed. */
+  publicKeyFromSeed(seed) {
+    if (seed.length !== 32) throw new JoseError("bad_key");
+    return ed25519$1.getPublicKey(seed);
+  }
+};
+function signerFromEd25519Seed(seed, kid) {
+  if (!(seed instanceof Uint8Array) || seed.length !== 32) {
+    throw new JoseError("bad_key");
+  }
+  const secret = Uint8Array.from(seed);
+  const publicKey = ed25519$1.getPublicKey(secret);
+  return {
+    kid,
+    publicKey,
+    publicJwk: publicJwkFromRaw(publicKey),
+    sign(bytes) {
+      return Promise.resolve(ed25519$1.sign(bytes, secret));
+    }
+  };
+}
+function ed25519SeedFromMnemonic(mnemonic) {
+  return sha256(utf8(mnemonic.trim()));
+}
+
+export { CLOCK_SKEW_S, CredentialsKitError, ED25519_JWS_ALGS, JoseError, MAX_JWS_LENGTH, MAX_KEY_STRING_LENGTHS, base58btc, base64url, clockMs, decodeJws, ed25519, ed25519SeedFromMnemonic, isEd25519JwsAlg, isRecord, multibaseToRaw, publicJwkFromRaw, rawFromPublicJwk, rawToMultibase, signJws, signerFromEd25519Seed, toSeconds, verifyEd25519, verifyJws };
+//# sourceMappingURL=chunk-VXKONZK4.js.map
+//# sourceMappingURL=chunk-VXKONZK4.js.map