@openeudi/openid4vp 0.1.0

package/dist/index.d.ts

@@ -0,0 +1,125 @@
+interface IssuerInfo {
+    certificate: Uint8Array;
+    country: string;
+    name?: string;
+    organization?: string;
+}
+
+type CredentialFormat = 'sd-jwt-vc' | 'mdoc';
+interface CredentialClaims {
+    age_over_18?: boolean;
+    age_over_21?: boolean;
+    resident_country?: string;
+    nationality?: string;
+    family_name_birth?: string;
+    [key: string]: unknown;
+}
+interface PresentationResult {
+    valid: boolean;
+    format: CredentialFormat;
+    claims: CredentialClaims;
+    issuer: IssuerInfo;
+    error?: string;
+}
+
+interface AuthorizationRequestInput {
+    requestedAttributes: string[];
+    acceptedFormats: CredentialFormat[];
+    responseUri: string;
+    nonce: string;
+    clientId: string;
+    state?: string;
+}
+interface AuthorizationRequest {
+    uri: string;
+    presentationDefinition: object;
+    nonce: string;
+    state: string;
+}
+
+interface ParseOptions {
+    trustedCertificates: Uint8Array[];
+    nonce: string;
+}
+interface ICredentialParser {
+    readonly format: CredentialFormat;
+    canParse(vpToken: unknown): boolean;
+    parse(vpToken: unknown, options: ParseOptions): Promise<PresentationResult>;
+}
+
+/**
+ * SD-JWT VC credential parser.
+ *
+ * Decodes and validates SD-JWT Verifiable Credentials as specified in
+ * the EUDI Wallet ecosystem. Performs:
+ *   - Structure validation (JWT~disclosure~kb format)
+ *   - Issuer certificate trust chain verification
+ *   - Expiry checking
+ *   - Nonce validation against the key binding JWT
+ *   - Selective disclosure claim extraction
+ */
+declare class SdJwtParser implements ICredentialParser {
+    readonly format: CredentialFormat;
+    /**
+     * Returns true when the token looks like an SD-JWT:
+     * it must be a string containing the `~` disclosure separator.
+     */
+    canParse(vpToken: unknown): boolean;
+    /**
+     * Parses and validates an SD-JWT VC token.
+     *
+     * @throws {MalformedCredentialError} when the token structure cannot be decoded
+     */
+    parse(vpToken: unknown, options: ParseOptions): Promise<PresentationResult>;
+}
+
+/**
+ * mDOC / mDL credential parser.
+ *
+ * Decodes and validates mDOC (Mobile Document) credentials as specified in
+ * ISO 18013-5 and the EUDI Wallet ecosystem. Processes CBOR-encoded
+ * DeviceResponse structures containing:
+ *   - Document type validation (eu.europa.ec.eudi.pid.1)
+ *   - Issuer certificate trust chain verification via COSE_Sign1 issuerAuth
+ *   - Validity period checking
+ *   - Claim extraction from IssuerSignedItem nameSpace elements
+ */
+declare class MdocParser implements ICredentialParser {
+    readonly format: CredentialFormat;
+    /**
+     * Returns true when the token is binary data (Uint8Array or Buffer),
+     * indicating a CBOR-encoded mDOC DeviceResponse.
+     */
+    canParse(vpToken: unknown): boolean;
+    /**
+     * Parses and validates an mDOC DeviceResponse token.
+     *
+     * @throws {MalformedCredentialError} when the CBOR structure cannot be decoded
+     *   or does not match the expected DeviceResponse format
+     */
+    parse(vpToken: unknown, options: ParseOptions): Promise<PresentationResult>;
+}
+
+declare class InvalidSignatureError extends Error {
+    constructor(message?: string);
+}
+declare class ExpiredCredentialError extends Error {
+    constructor(message?: string);
+}
+declare class UnsupportedFormatError extends Error {
+    constructor(format: string);
+}
+declare class MalformedCredentialError extends Error {
+    constructor(message?: string);
+}
+declare class NonceValidationError extends Error {
+    constructor(message?: string);
+}
+
+declare function createAuthorizationRequest(input: AuthorizationRequestInput): AuthorizationRequest;
+
+declare function parsePresentation(vpToken: unknown, options: ParseOptions): Promise<PresentationResult>;
+
+declare const VERSION = "0.1.0";
+
+export { type AuthorizationRequest, type AuthorizationRequestInput, type CredentialClaims, type CredentialFormat, ExpiredCredentialError, type ICredentialParser, InvalidSignatureError, type IssuerInfo, MalformedCredentialError, MdocParser, NonceValidationError, type ParseOptions, type PresentationResult, SdJwtParser, UnsupportedFormatError, VERSION, createAuthorizationRequest, parsePresentation };

package/dist/index.js

@@ -0,0 +1,447 @@
+import { splitSdJwt, decodeJwt, decodeSdJwt, getClaims } from '@sd-jwt/decode';
+import { decode } from 'cbor-x';
+import { v4 } from 'uuid';
+
+// src/parsers/sd-jwt.parser.ts
+
+// src/errors.ts
+var InvalidSignatureError = class extends Error {
+  constructor(message = "Credential signature validation failed") {
+    super(message);
+    this.name = "InvalidSignatureError";
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
+var ExpiredCredentialError = class extends Error {
+  constructor(message = "Credential has expired") {
+    super(message);
+    this.name = "ExpiredCredentialError";
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
+var UnsupportedFormatError = class extends Error {
+  constructor(format) {
+    super(`Unsupported credential format: ${format}`);
+    this.name = "UnsupportedFormatError";
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
+var MalformedCredentialError = class extends Error {
+  constructor(message = "Credential structure is malformed") {
+    super(message);
+    this.name = "MalformedCredentialError";
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
+var NonceValidationError = class extends Error {
+  constructor(message = "Nonce does not match expected value") {
+    super(message);
+    this.name = "NonceValidationError";
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
+
+// src/parsers/sd-jwt.parser.ts
+var sha256Hasher = async (data, _alg) => {
+  const encoder = new TextEncoder();
+  const input = typeof data === "string" ? encoder.encode(data) : data;
+  const hashBuffer = await crypto.subtle.digest("SHA-256", input);
+  return new Uint8Array(hashBuffer);
+};
+var BASE64_CHARS = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+function base64ToBytes(base64) {
+  const cleaned = base64.replace(/=+$/, "");
+  const byteLength = Math.floor(cleaned.length * 3 / 4);
+  const buffer = new ArrayBuffer(byteLength);
+  const bytes = new Uint8Array(buffer);
+  let byteIndex = 0;
+  for (let i = 0; i < cleaned.length; i += 4) {
+    const a = BASE64_CHARS.indexOf(cleaned[i]);
+    const b = i + 1 < cleaned.length ? BASE64_CHARS.indexOf(cleaned[i + 1]) : 0;
+    const c = i + 2 < cleaned.length ? BASE64_CHARS.indexOf(cleaned[i + 2]) : 0;
+    const d = i + 3 < cleaned.length ? BASE64_CHARS.indexOf(cleaned[i + 3]) : 0;
+    bytes[byteIndex++] = a << 2 | b >> 4;
+    if (byteIndex < byteLength) bytes[byteIndex++] = (b & 15) << 4 | c >> 2;
+    if (byteIndex < byteLength) bytes[byteIndex++] = (c & 3) << 6 | d;
+  }
+  return bytes;
+}
+function extractCertificateFromX5c(x5cEntry) {
+  return base64ToBytes(x5cEntry);
+}
+function bytesEqual(a, b) {
+  if (a.length !== b.length) return false;
+  for (let i = 0; i < a.length; i++) {
+    if (a[i] !== b[i]) return false;
+  }
+  return true;
+}
+function mapToCredentialClaims(raw) {
+  const claims = {};
+  if (typeof raw["age_over_18"] === "boolean") {
+    claims.age_over_18 = raw["age_over_18"];
+  }
+  if (typeof raw["age_over_21"] === "boolean") {
+    claims.age_over_21 = raw["age_over_21"];
+  }
+  if (typeof raw["resident_country"] === "string") {
+    claims.resident_country = raw["resident_country"];
+  }
+  if (typeof raw["nationality"] === "string") {
+    claims.nationality = raw["nationality"];
+  }
+  if (typeof raw["family_name_birth"] === "string") {
+    claims.family_name_birth = raw["family_name_birth"];
+  }
+  for (const [key, value] of Object.entries(raw)) {
+    if (!(key in claims) && !key.startsWith("_sd") && key !== "iss" && key !== "exp" && key !== "iat" && key !== "cnf" && key !== "vct") {
+      claims[key] = value;
+    }
+  }
+  return claims;
+}
+var SdJwtParser = class {
+  format = "sd-jwt-vc";
+  /**
+   * Returns true when the token looks like an SD-JWT:
+   * it must be a string containing the `~` disclosure separator.
+   */
+  canParse(vpToken) {
+    return typeof vpToken === "string" && vpToken.includes("~");
+  }
+  /**
+   * Parses and validates an SD-JWT VC token.
+   *
+   * @throws {MalformedCredentialError} when the token structure cannot be decoded
+   */
+  async parse(vpToken, options) {
+    if (typeof vpToken !== "string") {
+      throw new MalformedCredentialError("VP token must be a string");
+    }
+    const invalidResult = (error) => ({
+      valid: false,
+      format: this.format,
+      claims: {},
+      issuer: { certificate: new Uint8Array(), country: "" },
+      error
+    });
+    let parts;
+    try {
+      parts = splitSdJwt(vpToken);
+    } catch {
+      throw new MalformedCredentialError("Failed to split SD-JWT structure");
+    }
+    let header;
+    let payload;
+    try {
+      const jwt = decodeJwt(parts.jwt);
+      header = jwt.header;
+      payload = jwt.payload;
+    } catch {
+      throw new MalformedCredentialError("Failed to decode SD-JWT issuer JWT");
+    }
+    const x5cArray = header["x5c"];
+    let issuerCertBytes = new Uint8Array();
+    let issuerInfo = { certificate: new Uint8Array(), country: "" };
+    if (Array.isArray(x5cArray) && x5cArray.length > 0 && typeof x5cArray[0] === "string") {
+      try {
+        issuerCertBytes = extractCertificateFromX5c(x5cArray[0]);
+        const issuerString = typeof payload["iss"] === "string" ? payload["iss"] : "";
+        issuerInfo = {
+          certificate: issuerCertBytes,
+          country: extractCountryHint(issuerString)
+        };
+      } catch {
+        return invalidResult("Failed to extract issuer certificate from x5c");
+      }
+    }
+    if (options.trustedCertificates.length > 0) {
+      const isTrusted = options.trustedCertificates.some((trusted) => bytesEqual(trusted, issuerCertBytes));
+      if (!isTrusted) {
+        return invalidResult("Issuer certificate is not trusted");
+      }
+    } else if (issuerCertBytes.length === 0) {
+      return invalidResult("No issuer certificate found and no trusted certificates configured");
+    }
+    const exp = payload["exp"];
+    if (typeof exp === "number") {
+      const nowSeconds = Math.floor(Date.now() / 1e3);
+      if (exp < nowSeconds) {
+        return invalidResult("Credential has expired");
+      }
+    }
+    if (parts.kbJwt) {
+      try {
+        const kbDecoded = decodeJwt(parts.kbJwt);
+        const kbPayload = kbDecoded.payload;
+        const kbNonce = kbPayload["nonce"];
+        if (typeof kbNonce === "string" && kbNonce !== options.nonce) {
+          return invalidResult("Key binding JWT nonce does not match");
+        }
+      } catch {
+        return invalidResult("Failed to decode key binding JWT");
+      }
+    }
+    let resolvedClaims;
+    try {
+      const decoded = await decodeSdJwt(vpToken, sha256Hasher);
+      resolvedClaims = await getClaims(
+        decoded.jwt.payload,
+        decoded.disclosures,
+        sha256Hasher
+      );
+    } catch {
+      resolvedClaims = payload;
+    }
+    const claims = mapToCredentialClaims(resolvedClaims);
+    return {
+      valid: true,
+      format: this.format,
+      claims,
+      issuer: issuerInfo
+    };
+  }
+};
+function extractCountryHint(issuer) {
+  try {
+    const url = new URL(issuer);
+    const tld = url.hostname.split(".").pop()?.toUpperCase();
+    if (tld && tld.length === 2) {
+      return tld;
+    }
+  } catch {
+  }
+  return "";
+}
+function isBinaryData(value) {
+  return value instanceof Uint8Array;
+}
+function bytesEqual2(a, b) {
+  if (a.length !== b.length) return false;
+  for (let i = 0; i < a.length; i++) {
+    if (a[i] !== b[i]) return false;
+  }
+  return true;
+}
+function extractCertificateFromIssuerAuth(issuerAuth) {
+  const unprotected = issuerAuth[1];
+  if (unprotected && typeof unprotected === "object") {
+    const certFromUnprotected = extractX5Chain(unprotected);
+    if (certFromUnprotected) return certFromUnprotected;
+  }
+  const protectedHeader = issuerAuth[0];
+  if (isBinaryData(protectedHeader)) {
+    try {
+      const decoded = decode(protectedHeader);
+      if (decoded && typeof decoded === "object") {
+        const certFromProtected = extractX5Chain(decoded);
+        if (certFromProtected) return certFromProtected;
+      }
+    } catch {
+    }
+    return new Uint8Array(protectedHeader);
+  }
+  return new Uint8Array();
+}
+function extractX5Chain(header) {
+  if (header instanceof Map) {
+    const cert = header.get(33);
+    if (isBinaryData(cert)) {
+      return new Uint8Array(cert);
+    }
+  } else if (typeof header === "object" && header !== null) {
+    const rec = header;
+    const cert = rec[33] ?? rec["x5chain"] ?? rec["33"];
+    if (isBinaryData(cert)) {
+      return new Uint8Array(cert);
+    }
+  }
+  return null;
+}
+function mapToCredentialClaims2(items) {
+  const claims = {};
+  for (const item of items) {
+    const key = item.elementIdentifier;
+    const value = item.elementValue;
+    switch (key) {
+      case "age_over_18":
+        if (typeof value === "boolean") claims.age_over_18 = value;
+        break;
+      case "age_over_21":
+        if (typeof value === "boolean") claims.age_over_21 = value;
+        break;
+      case "resident_country":
+        if (typeof value === "string") claims.resident_country = value;
+        break;
+      case "nationality":
+        if (typeof value === "string") claims.nationality = value;
+        break;
+      case "family_name_birth":
+        if (typeof value === "string") claims.family_name_birth = value;
+        break;
+      default:
+        claims[key] = value;
+        break;
+    }
+  }
+  return claims;
+}
+function extractValidityPeriod(issuerAuth) {
+  const payload = issuerAuth[2];
+  if (!payload) return {};
+  try {
+    const decoded = isBinaryData(payload) ? decode(payload) : payload;
+    if (decoded && typeof decoded === "object") {
+      const obj = decoded;
+      const validityInfo = obj["validityInfo"];
+      if (validityInfo) {
+        return {
+          validFrom: validityInfo["validFrom"] instanceof Date ? validityInfo["validFrom"] : typeof validityInfo["validFrom"] === "string" ? new Date(validityInfo["validFrom"]) : void 0,
+          validUntil: validityInfo["validUntil"] instanceof Date ? validityInfo["validUntil"] : typeof validityInfo["validUntil"] === "string" ? new Date(validityInfo["validUntil"]) : void 0
+        };
+      }
+    }
+  } catch {
+  }
+  return {};
+}
+var MdocParser = class {
+  format = "mdoc";
+  /**
+   * Returns true when the token is binary data (Uint8Array or Buffer),
+   * indicating a CBOR-encoded mDOC DeviceResponse.
+   */
+  canParse(vpToken) {
+    return isBinaryData(vpToken);
+  }
+  /**
+   * Parses and validates an mDOC DeviceResponse token.
+   *
+   * @throws {MalformedCredentialError} when the CBOR structure cannot be decoded
+   *   or does not match the expected DeviceResponse format
+   */
+  async parse(vpToken, options) {
+    if (!isBinaryData(vpToken)) {
+      throw new MalformedCredentialError("VP token must be a Uint8Array or Buffer");
+    }
+    const invalidResult = (error) => ({
+      valid: false,
+      format: this.format,
+      claims: {},
+      issuer: { certificate: new Uint8Array(), country: "" },
+      error
+    });
+    let deviceResponse;
+    try {
+      deviceResponse = decode(vpToken);
+    } catch {
+      throw new MalformedCredentialError("Failed to decode CBOR DeviceResponse");
+    }
+    if (!deviceResponse || typeof deviceResponse !== "object" || !Array.isArray(deviceResponse.documents) || deviceResponse.documents.length === 0) {
+      throw new MalformedCredentialError("Invalid DeviceResponse structure: missing or empty documents array");
+    }
+    const document = deviceResponse.documents[0];
+    if (!document.issuerSigned || !document.issuerSigned.nameSpaces || !document.issuerSigned.issuerAuth) {
+      throw new MalformedCredentialError("Invalid mDOC document: missing issuerSigned data");
+    }
+    const issuerAuth = document.issuerSigned.issuerAuth;
+    if (!Array.isArray(issuerAuth) || issuerAuth.length < 4) {
+      throw new MalformedCredentialError("Invalid issuerAuth: expected COSE_Sign1 array with 4 elements");
+    }
+    const issuerCertBytes = extractCertificateFromIssuerAuth(issuerAuth);
+    const issuerInfo = {
+      certificate: issuerCertBytes,
+      country: ""
+    };
+    if (options.trustedCertificates.length > 0) {
+      const isTrusted = options.trustedCertificates.some((trusted) => bytesEqual2(trusted, issuerCertBytes));
+      if (!isTrusted) {
+        return invalidResult("Issuer certificate is not trusted");
+      }
+    } else if (issuerCertBytes.length === 0) {
+      return invalidResult("No issuer certificate found and no trusted certificates configured");
+    }
+    const { validUntil } = extractValidityPeriod(issuerAuth);
+    if (validUntil) {
+      const now = /* @__PURE__ */ new Date();
+      if (validUntil < now) {
+        return invalidResult("Credential has expired");
+      }
+    }
+    const pidNamespace = "eu.europa.ec.eudi.pid.1";
+    const nameSpaces = document.issuerSigned.nameSpaces;
+    const items = nameSpaces[pidNamespace] ?? nameSpaces[document.docType] ?? Object.values(nameSpaces)[0] ?? [];
+    const claims = mapToCredentialClaims2(items);
+    if (claims.resident_country && typeof claims.resident_country === "string") {
+      issuerInfo.country = claims.resident_country;
+    }
+    return {
+      valid: true,
+      format: this.format,
+      claims,
+      issuer: issuerInfo
+    };
+  }
+};
+function createAuthorizationRequest(input) {
+  const state = input.state ?? v4();
+  const presentationDefinition = {
+    id: v4(),
+    input_descriptors: input.requestedAttributes.map((attr, index) => ({
+      id: `descriptor_${index}`,
+      format: Object.fromEntries(
+        input.acceptedFormats.map((fmt) => {
+          if (fmt === "sd-jwt-vc") return ["vc+sd-jwt", { "sd-jwt_alg_values": ["ES256"] }];
+          return ["mso_mdoc", { alg: ["ES256"] }];
+        })
+      ),
+      constraints: {
+        fields: [
+          {
+            path: [`$.${attr}`, `$['${attr}']`],
+            filter: { type: attr.startsWith("age_over") ? "boolean" : "string" }
+          }
+        ]
+      }
+    }))
+  };
+  const params = new URLSearchParams({
+    response_type: "vp_token",
+    response_mode: "direct_post",
+    response_uri: input.responseUri,
+    client_id: input.clientId,
+    nonce: input.nonce,
+    state,
+    presentation_definition: JSON.stringify(presentationDefinition)
+  });
+  return {
+    uri: `openid4vp://authorize?${params.toString()}`,
+    presentationDefinition,
+    nonce: input.nonce,
+    state
+  };
+}
+
+// src/presentation.ts
+var parsers = [new SdJwtParser(), new MdocParser()];
+async function parsePresentation(vpToken, options) {
+  for (const parser of parsers) {
+    if (parser.canParse(vpToken)) {
+      return parser.parse(vpToken, options);
+    }
+  }
+  return {
+    valid: false,
+    format: "sd-jwt-vc",
+    claims: {},
+    issuer: { certificate: new Uint8Array(), country: "" },
+    error: "Unsupported credential format"
+  };
+}
+
+// src/index.ts
+var VERSION = "0.1.0";
+
+export { ExpiredCredentialError, InvalidSignatureError, MalformedCredentialError, MdocParser, NonceValidationError, SdJwtParser, UnsupportedFormatError, VERSION, createAuthorizationRequest, parsePresentation };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/errors.ts","../src/parsers/sd-jwt.parser.ts","../src/parsers/mdoc.parser.ts","../src/authorization.ts","../src/presentation.ts","../src/index.ts"],"names":["bytesEqual","mapToCredentialClaims","uuidv4"],"mappings":";;;;;;;AAAO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EAC7C,WAAA,CAAY,UAAU,wCAAA,EAA0C;AAC5D,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AACZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,GAAA,CAAA,MAAA,CAAW,SAAS,CAAA;AAAA,EACpD;AACJ;AAEO,IAAM,sBAAA,GAAN,cAAqC,KAAA,CAAM;AAAA,EAC9C,WAAA,CAAY,UAAU,wBAAA,EAA0B;AAC5C,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,wBAAA;AACZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,GAAA,CAAA,MAAA,CAAW,SAAS,CAAA;AAAA,EACpD;AACJ;AAEO,IAAM,sBAAA,GAAN,cAAqC,KAAA,CAAM;AAAA,EAC9C,YAAY,MAAA,EAAgB;AACxB,IAAA,KAAA,CAAM,CAAA,+BAAA,EAAkC,MAAM,CAAA,CAAE,CAAA;AAChD,IAAA,IAAA,CAAK,IAAA,GAAO,wBAAA;AACZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,GAAA,CAAA,MAAA,CAAW,SAAS,CAAA;AAAA,EACpD;AACJ;AAEO,IAAM,wBAAA,GAAN,cAAuC,KAAA,CAAM;AAAA,EAChD,WAAA,CAAY,UAAU,mCAAA,EAAqC;AACvD,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,0BAAA;AACZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,GAAA,CAAA,MAAA,CAAW,SAAS,CAAA;AAAA,EACpD;AACJ;AAEO,IAAM,oBAAA,GAAN,cAAmC,KAAA,CAAM;AAAA,EAC5C,WAAA,CAAY,UAAU,qCAAA,EAAuC;AACzD,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,sBAAA;AACZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,GAAA,CAAA,MAAA,CAAW,SAAS,CAAA;AAAA,EACpD;AACJ;;;ACpBA,IAAM,YAAA,GAA4B,OAAO,IAAA,EAA4B,IAAA,KAAsC;AACvG,EAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,EAAA,MAAM,QAAQ,OAAO,IAAA,KAAS,WAAW,OAAA,CAAQ,MAAA,CAAO,IAAI,CAAA,GAAI,IAAA;AAChE,EAAA,MAAM,aAAa,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,WAAW,KAAK,CAAA;AAC9D,EAAA,OAAO,IAAI,WAAW,UAAU,CAAA;AACpC,CAAA;AAGA,IAAM,YAAA,GAAe,kEAAA;AAMrB,SAAS,cAAc,MAAA,EAAyC;AAE5D,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AACxC,EAAA,MAAM,aAAa,IAAA,CAAK,KAAA,CAAO,OAAA,CAAQ,MAAA,GAAS,IAAK,CAAC,CAAA;AACtD,EAAA,MAAM,MAAA,GAAS,IAAI,WAAA,CAAY,UAAU,CAAA;AACzC,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,MAAM,CAAA;AAEnC,EAAA,IAAI,SAAA,GAAY,CAAA;AAChB,EAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,OAAA,CAAQ,MAAA,EAAQ,KAAK,CAAA,EAAG;AACxC,IAAA,MAAM,CAAA,GAAI,YAAA,CAAa,OAAA,CAAQ,OAAA,CAAQ,CAAC,CAAC,CAAA;AACzC,IAAA,MAAM,CAAA,GAAI,CAAA,GAAI,CAAA,GAAI,OAAA,CAAQ,MAAA,GAAS,YAAA,CAAa,OAAA,CAAQ,OAAA,CAAQ,CAAA,GAAI,CAAC,CAAC,CAAA,GAAI,CAAA;AAC1E,IAAA,MAAM,CAAA,GAAI,CAAA,GAAI,CAAA,GAAI,OAAA,CAAQ,MAAA,GAAS,YAAA,CAAa,OAAA,CAAQ,OAAA,CAAQ,CAAA,GAAI,CAAC,CAAC,CAAA,GAAI,CAAA;AAC1E,IAAA,MAAM,CAAA,GAAI,CAAA,GAAI,CAAA,GAAI,OAAA,CAAQ,MAAA,GAAS,YAAA,CAAa,OAAA,CAAQ,OAAA,CAAQ,CAAA,GAAI,CAAC,CAAC,CAAA,GAAI,CAAA;AAE1E,IAAA,KAAA,CAAM,SAAA,EAAW,CAAA,GAAK,CAAA,IAAK,CAAA,GAAM,CAAA,IAAK,CAAA;AACtC,IAAA,IAAI,SAAA,GAAY,YAAY,KAAA,CAAM,SAAA,EAAW,KAAM,CAAA,GAAI,EAAA,KAAS,IAAM,CAAA,IAAK,CAAA;AAC3E,IAAA,IAAI,YAAY,UAAA,EAAY,KAAA,CAAM,WAAW,CAAA,GAAA,CAAM,CAAA,GAAI,MAAS,CAAA,GAAK,CAAA;AAAA,EACzE;AAEA,EAAA,OAAO,KAAA;AACX;AAMA,SAAS,0BAA0B,QAAA,EAA2C;AAC1E,EAAA,OAAO,cAAc,QAAQ,CAAA;AACjC;AAKA,SAAS,UAAA,CAAW,GAAe,CAAA,EAAwB;AACvD,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,CAAE,MAAA,EAAQ,OAAO,KAAA;AAClC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,QAAQ,CAAA,EAAA,EAAK;AAC/B,IAAA,IAAI,EAAE,CAAC,CAAA,KAAM,CAAA,CAAE,CAAC,GAAG,OAAO,KAAA;AAAA,EAC9B;AACA,EAAA,OAAO,IAAA;AACX;AAMA,SAAS,sBAAsB,GAAA,EAAgD;AAC3E,EAAA,MAAM,SAA2B,EAAC;AAElC,EAAA,IAAI,OAAO,GAAA,CAAI,aAAa,CAAA,KAAM,SAAA,EAAW;AACzC,IAAA,MAAA,CAAO,WAAA,GAAc,IAAI,aAAa,CAAA;AAAA,EAC1C;AACA,EAAA,IAAI,OAAO,GAAA,CAAI,aAAa,CAAA,KAAM,SAAA,EAAW;AACzC,IAAA,MAAA,CAAO,WAAA,GAAc,IAAI,aAAa,CAAA;AAAA,EAC1C;AACA,EAAA,IAAI,OAAO,GAAA,CAAI,kBAAkB,CAAA,KAAM,QAAA,EAAU;AAC7C,IAAA,MAAA,CAAO,gBAAA,GAAmB,IAAI,kBAAkB,CAAA;AAAA,EACpD;AACA,EAAA,IAAI,OAAO,GAAA,CAAI,aAAa,CAAA,KAAM,QAAA,EAAU;AACxC,IAAA,MAAA,CAAO,WAAA,GAAc,IAAI,aAAa,CAAA;AAAA,EAC1C;AACA,EAAA,IAAI,OAAO,GAAA,CAAI,mBAAmB,CAAA,KAAM,QAAA,EAAU;AAC9C,IAAA,MAAA,CAAO,iBAAA,GAAoB,IAAI,mBAAmB,CAAA;AAAA,EACtD;AAGA,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAA,EAAG;AAC5C,IAAA,IACI,EAAE,GAAA,IAAO,MAAA,CAAA,IACT,CAAC,GAAA,CAAI,WAAW,KAAK,CAAA,IACrB,GAAA,KAAQ,KAAA,IACR,QAAQ,KAAA,IACR,GAAA,KAAQ,SACR,GAAA,KAAQ,KAAA,IACR,QAAQ,KAAA,EACV;AACE,MAAA,MAAA,CAAO,GAAG,CAAA,GAAI,KAAA;AAAA,IAClB;AAAA,EACJ;AAEA,EAAA,OAAO,MAAA;AACX;AAaO,IAAM,cAAN,MAA+C;AAAA,EACzC,MAAA,GAA2B,WAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMpC,SAAS,OAAA,EAA2B;AAChC,IAAA,OAAO,OAAO,OAAA,KAAY,QAAA,IAAY,OAAA,CAAQ,SAAS,GAAG,CAAA;AAAA,EAC9D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,KAAA,CAAM,OAAA,EAAkB,OAAA,EAAoD;AAC9E,IAAA,IAAI,OAAO,YAAY,QAAA,EAAU;AAC7B,MAAA,MAAM,IAAI,yBAAyB,2BAA2B,CAAA;AAAA,IAClE;AAEA,IAAA,MAAM,aAAA,GAAgB,CAAC,KAAA,MAAuC;AAAA,MAC1D,KAAA,EAAO,KAAA;AAAA,MACP,QAAQ,IAAA,CAAK,MAAA;AAAA,MACb,QAAQ,EAAC;AAAA,MACT,QAAQ,EAAE,WAAA,EAAa,IAAI,UAAA,EAAW,EAAG,SAAS,EAAA,EAAG;AAAA,MACrD;AAAA,KACJ,CAAA;AAGA,IAAA,IAAI,KAAA;AACJ,IAAA,IAAI;AACA,MAAA,KAAA,GAAQ,WAAW,OAAO,CAAA;AAAA,IAC9B,CAAA,CAAA,MAAQ;AACJ,MAAA,MAAM,IAAI,yBAAyB,kCAAkC,CAAA;AAAA,IACzE;AAGA,IAAA,IAAI,MAAA;AACJ,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACA,MAAA,MAAM,GAAA,GAAM,SAAA,CAAU,KAAA,CAAM,GAAG,CAAA;AAC/B,MAAA,MAAA,GAAS,GAAA,CAAI,MAAA;AACb,MAAA,OAAA,GAAU,GAAA,CAAI,OAAA;AAAA,IAClB,CAAA,CAAA,MAAQ;AACJ,MAAA,MAAM,IAAI,yBAAyB,oCAAoC,CAAA;AAAA,IAC3E;AAGA,IAAA,MAAM,QAAA,GAAW,OAAO,KAAK,CAAA;AAC7B,IAAA,IAAI,eAAA,GAAkB,IAAI,UAAA,EAAW;AACrC,IAAA,IAAI,aAAyB,EAAE,WAAA,EAAa,IAAI,UAAA,EAAW,EAAG,SAAS,EAAA,EAAG;AAE1E,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,QAAQ,CAAA,IAAK,QAAA,CAAS,MAAA,GAAS,CAAA,IAAK,OAAO,QAAA,CAAS,CAAC,CAAA,KAAM,QAAA,EAAU;AACnF,MAAA,IAAI;AACA,QAAA,eAAA,GAAkB,yBAAA,CAA0B,QAAA,CAAS,CAAC,CAAC,CAAA;AAIvD,QAAA,MAAM,YAAA,GAAe,OAAO,OAAA,CAAQ,KAAK,MAAM,QAAA,GAAW,OAAA,CAAQ,KAAK,CAAA,GAAI,EAAA;AAC3E,QAAA,UAAA,GAAa;AAAA,UACT,WAAA,EAAa,eAAA;AAAA,UACb,OAAA,EAAS,mBAAmB,YAAY;AAAA,SAC5C;AAAA,MACJ,CAAA,CAAA,MAAQ;AACJ,QAAA,OAAO,cAAc,+CAA+C,CAAA;AAAA,MACxE;AAAA,IACJ;AAGA,IAAA,IAAI,OAAA,CAAQ,mBAAA,CAAoB,MAAA,GAAS,CAAA,EAAG;AACxC,MAAA,MAAM,SAAA,GAAY,QAAQ,mBAAA,CAAoB,IAAA,CAAK,CAAC,OAAA,KAAY,UAAA,CAAW,OAAA,EAAS,eAAe,CAAC,CAAA;AACpG,MAAA,IAAI,CAAC,SAAA,EAAW;AACZ,QAAA,OAAO,cAAc,mCAAmC,CAAA;AAAA,MAC5D;AAAA,IACJ,CAAA,MAAA,IAAW,eAAA,CAAgB,MAAA,KAAW,CAAA,EAAG;AACrC,MAAA,OAAO,cAAc,oEAAoE,CAAA;AAAA,IAC7F;AAGA,IAAA,MAAM,GAAA,GAAM,QAAQ,KAAK,CAAA;AACzB,IAAA,IAAI,OAAO,QAAQ,QAAA,EAAU;AACzB,MAAA,MAAM,aAAa,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAC/C,MAAA,IAAI,MAAM,UAAA,EAAY;AAClB,QAAA,OAAO,cAAc,wBAAwB,CAAA;AAAA,MACjD;AAAA,IACJ;AAGA,IAAA,IAAI,MAAM,KAAA,EAAO;AACb,MAAA,IAAI;AACA,QAAA,MAAM,SAAA,GAAY,SAAA,CAAU,KAAA,CAAM,KAAK,CAAA;AACvC,QAAA,MAAM,YAAY,SAAA,CAAU,OAAA;AAC5B,QAAA,MAAM,OAAA,GAAU,UAAU,OAAO,CAAA;AACjC,QAAA,IAAI,OAAO,OAAA,KAAY,QAAA,IAAY,OAAA,KAAY,QAAQ,KAAA,EAAO;AAC1D,UAAA,OAAO,cAAc,sCAAsC,CAAA;AAAA,QAC/D;AAAA,MACJ,CAAA,CAAA,MAAQ;AACJ,QAAA,OAAO,cAAc,kCAAkC,CAAA;AAAA,MAC3D;AAAA,IACJ;AAGA,IAAA,IAAI,cAAA;AACJ,IAAA,IAAI;AACA,MAAA,MAAM,OAAA,GAAU,MAAM,WAAA,CAAY,OAAA,EAAS,YAAY,CAAA;AACvD,MAAA,cAAA,GAAiB,MAAM,SAAA;AAAA,QACnB,QAAQ,GAAA,CAAI,OAAA;AAAA,QACZ,OAAA,CAAQ,WAAA;AAAA,QACR;AAAA,OACJ;AAAA,IACJ,CAAA,CAAA,MAAQ;AAEJ,MAAA,cAAA,GAAiB,OAAA;AAAA,IACrB;AAEA,IAAA,MAAM,MAAA,GAAS,sBAAsB,cAAc,CAAA;AAEnD,IAAA,OAAO;AAAA,MACH,KAAA,EAAO,IAAA;AAAA,MACP,QAAQ,IAAA,CAAK,MAAA;AAAA,MACb,MAAA;AAAA,MACA,MAAA,EAAQ;AAAA,KACZ;AAAA,EACJ;AACJ;AAMA,SAAS,mBAAmB,MAAA,EAAwB;AAChD,EAAA,IAAI;AACA,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,MAAM,CAAA;AAC1B,IAAA,MAAM,GAAA,GAAM,IAAI,QAAA,CAAS,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,IAAO,WAAA,EAAY;AACvD,IAAA,IAAI,GAAA,IAAO,GAAA,CAAI,MAAA,KAAW,CAAA,EAAG;AACzB,MAAA,OAAO,GAAA;AAAA,IACX;AAAA,EACJ,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,OAAO,EAAA;AACX;AC9PA,SAAS,aAAa,KAAA,EAAqC;AACvD,EAAA,OAAO,KAAA,YAAiB,UAAA;AAC5B;AAKA,SAASA,WAAAA,CAAW,GAAe,CAAA,EAAwB;AACvD,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,CAAE,MAAA,EAAQ,OAAO,KAAA;AAClC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,QAAQ,CAAA,EAAA,EAAK;AAC/B,IAAA,IAAI,EAAE,CAAC,CAAA,KAAM,CAAA,CAAE,CAAC,GAAG,OAAO,KAAA;AAAA,EAC9B;AACA,EAAA,OAAO,IAAA;AACX;AAyCA,SAAS,iCAAiC,UAAA,EAAmC;AAEzE,EAAA,MAAM,WAAA,GAAc,WAAW,CAAC,CAAA;AAChC,EAAA,IAAI,WAAA,IAAe,OAAO,WAAA,KAAgB,QAAA,EAAU;AAEhD,IAAA,MAAM,mBAAA,GAAsB,eAAe,WAAW,CAAA;AACtD,IAAA,IAAI,qBAAqB,OAAO,mBAAA;AAAA,EACpC;AAGA,EAAA,MAAM,eAAA,GAAkB,WAAW,CAAC,CAAA;AACpC,EAAA,IAAI,YAAA,CAAa,eAAe,CAAA,EAAG;AAC/B,IAAA,IAAI;AACA,MAAA,MAAM,OAAA,GAAU,OAAO,eAAe,CAAA;AACtC,MAAA,IAAI,OAAA,IAAW,OAAO,OAAA,KAAY,QAAA,EAAU;AACxC,QAAA,MAAM,iBAAA,GAAoB,eAAe,OAAO,CAAA;AAChD,QAAA,IAAI,mBAAmB,OAAO,iBAAA;AAAA,MAClC;AAAA,IACJ,CAAA,CAAA,MAAQ;AAAA,IAER;AAEA,IAAA,OAAO,IAAI,WAAW,eAAe,CAAA;AAAA,EACzC;AAEA,EAAA,OAAO,IAAI,UAAA,EAAW;AAC1B;AAMA,SAAS,eAAe,MAAA,EAAoC;AACxD,EAAA,IAAI,kBAAkB,GAAA,EAAK;AACvB,IAAA,MAAM,IAAA,GAAO,MAAA,CAAO,GAAA,CAAI,EAAE,CAAA;AAC1B,IAAA,IAAI,YAAA,CAAa,IAAI,CAAA,EAAG;AACpB,MAAA,OAAO,IAAI,WAAW,IAAI,CAAA;AAAA,IAC9B;AAAA,EACJ,CAAA,MAAA,IAAW,OAAO,MAAA,KAAW,QAAA,IAAY,WAAW,IAAA,EAAM;AACtD,IAAA,MAAM,GAAA,GAAM,MAAA;AACZ,IAAA,MAAM,IAAA,GAAO,IAAI,EAAE,CAAA,IAAK,IAAI,SAAS,CAAA,IAAK,IAAI,IAAI,CAAA;AAClD,IAAA,IAAI,YAAA,CAAa,IAAI,CAAA,EAAG;AACpB,MAAA,OAAO,IAAI,WAAW,IAAI,CAAA;AAAA,IAC9B;AAAA,EACJ;AACA,EAAA,OAAO,IAAA;AACX;AAMA,SAASC,uBAAsB,KAAA,EAA6C;AACxE,EAAA,MAAM,SAA2B,EAAC;AAElC,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACtB,IAAA,MAAM,MAAM,IAAA,CAAK,iBAAA;AACjB,IAAA,MAAM,QAAQ,IAAA,CAAK,YAAA;AAEnB,IAAA,QAAQ,GAAA;AAAK,MACT,KAAK,aAAA;AACD,QAAA,IAAI,OAAO,KAAA,KAAU,SAAA,EAAW,MAAA,CAAO,WAAA,GAAc,KAAA;AACrD,QAAA;AAAA,MACJ,KAAK,aAAA;AACD,QAAA,IAAI,OAAO,KAAA,KAAU,SAAA,EAAW,MAAA,CAAO,WAAA,GAAc,KAAA;AACrD,QAAA;AAAA,MACJ,KAAK,kBAAA;AACD,QAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,MAAA,CAAO,gBAAA,GAAmB,KAAA;AACzD,QAAA;AAAA,MACJ,KAAK,aAAA;AACD,QAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,MAAA,CAAO,WAAA,GAAc,KAAA;AACpD,QAAA;AAAA,MACJ,KAAK,mBAAA;AACD,QAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,MAAA,CAAO,iBAAA,GAAoB,KAAA;AAC1D,QAAA;AAAA,MACJ;AACI,QAAA,MAAA,CAAO,GAAG,CAAA,GAAI,KAAA;AACd,QAAA;AAAA;AACR,EACJ;AAEA,EAAA,OAAO,MAAA;AACX;AASA,SAAS,sBAAsB,UAAA,EAAgE;AAC3F,EAAA,MAAM,OAAA,GAAU,WAAW,CAAC,CAAA;AAC5B,EAAA,IAAI,CAAC,OAAA,EAAS,OAAO,EAAC;AAEtB,EAAA,IAAI;AAEA,IAAA,MAAM,UAAU,YAAA,CAAa,OAAO,CAAA,GAAK,MAAA,CAAO,OAAO,CAAA,GAAgB,OAAA;AAEvE,IAAA,IAAI,OAAA,IAAW,OAAO,OAAA,KAAY,QAAA,EAAU;AACxC,MAAA,MAAM,GAAA,GAAM,OAAA;AACZ,MAAA,MAAM,YAAA,GAAe,IAAI,cAAc,CAAA;AACvC,MAAA,IAAI,YAAA,EAAc;AACd,QAAA,OAAO;AAAA,UACH,WACI,YAAA,CAAa,WAAW,aAAa,IAAA,GAC/B,YAAA,CAAa,WAAW,CAAA,GACxB,OAAO,YAAA,CAAa,WAAW,MAAM,QAAA,GACnC,IAAI,KAAK,YAAA,CAAa,WAAW,CAAC,CAAA,GAClC,KAAA,CAAA;AAAA,UACZ,YACI,YAAA,CAAa,YAAY,aAAa,IAAA,GAChC,YAAA,CAAa,YAAY,CAAA,GACzB,OAAO,YAAA,CAAa,YAAY,MAAM,QAAA,GACpC,IAAI,KAAK,YAAA,CAAa,YAAY,CAAC,CAAA,GACnC,KAAA;AAAA,SAChB;AAAA,MACJ;AAAA,IACJ;AAAA,EACJ,CAAA,CAAA,MAAQ;AAAA,EAER;AAEA,EAAA,OAAO,EAAC;AACZ;AAaO,IAAM,aAAN,MAA8C;AAAA,EACxC,MAAA,GAA2B,MAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMpC,SAAS,OAAA,EAA2B;AAChC,IAAA,OAAO,aAAa,OAAO,CAAA;AAAA,EAC/B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,KAAA,CAAM,OAAA,EAAkB,OAAA,EAAoD;AAC9E,IAAA,IAAI,CAAC,YAAA,CAAa,OAAO,CAAA,EAAG;AACxB,MAAA,MAAM,IAAI,yBAAyB,yCAAyC,CAAA;AAAA,IAChF;AAEA,IAAA,MAAM,aAAA,GAAgB,CAAC,KAAA,MAAuC;AAAA,MAC1D,KAAA,EAAO,KAAA;AAAA,MACP,QAAQ,IAAA,CAAK,MAAA;AAAA,MACb,QAAQ,EAAC;AAAA,MACT,QAAQ,EAAE,WAAA,EAAa,IAAI,UAAA,EAAW,EAAG,SAAS,EAAA,EAAG;AAAA,MACrD;AAAA,KACJ,CAAA;AAGA,IAAA,IAAI,cAAA;AACJ,IAAA,IAAI;AACA,MAAA,cAAA,GAAiB,OAAO,OAAO,CAAA;AAAA,IACnC,CAAA,CAAA,MAAQ;AACJ,MAAA,MAAM,IAAI,yBAAyB,sCAAsC,CAAA;AAAA,IAC7E;AAGA,IAAA,IACI,CAAC,cAAA,IACD,OAAO,cAAA,KAAmB,YAC1B,CAAC,KAAA,CAAM,OAAA,CAAQ,cAAA,CAAe,SAAS,CAAA,IACvC,cAAA,CAAe,SAAA,CAAU,WAAW,CAAA,EACtC;AACE,MAAA,MAAM,IAAI,yBAAyB,oEAAoE,CAAA;AAAA,IAC3G;AAEA,IAAA,MAAM,QAAA,GAAW,cAAA,CAAe,SAAA,CAAU,CAAC,CAAA;AAC3C,IAAA,IAAI,CAAC,QAAA,CAAS,YAAA,IAAgB,CAAC,QAAA,CAAS,aAAa,UAAA,IAAc,CAAC,QAAA,CAAS,YAAA,CAAa,UAAA,EAAY;AAClG,MAAA,MAAM,IAAI,yBAAyB,kDAAkD,CAAA;AAAA,IACzF;AAGA,IAAA,MAAM,UAAA,GAAa,SAAS,YAAA,CAAa,UAAA;AACzC,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,UAAU,CAAA,IAAK,UAAA,CAAW,SAAS,CAAA,EAAG;AACrD,MAAA,MAAM,IAAI,yBAAyB,+DAA+D,CAAA;AAAA,IACtG;AAEA,IAAA,MAAM,eAAA,GAAkB,iCAAiC,UAAU,CAAA;AACnE,IAAA,MAAM,UAAA,GAAyB;AAAA,MAC3B,WAAA,EAAa,eAAA;AAAA,MACb,OAAA,EAAS;AAAA,KACb;AAGA,IAAA,IAAI,OAAA,CAAQ,mBAAA,CAAoB,MAAA,GAAS,CAAA,EAAG;AACxC,MAAA,MAAM,SAAA,GAAY,QAAQ,mBAAA,CAAoB,IAAA,CAAK,CAAC,OAAA,KAAYD,WAAAA,CAAW,OAAA,EAAS,eAAe,CAAC,CAAA;AACpG,MAAA,IAAI,CAAC,SAAA,EAAW;AACZ,QAAA,OAAO,cAAc,mCAAmC,CAAA;AAAA,MAC5D;AAAA,IACJ,CAAA,MAAA,IAAW,eAAA,CAAgB,MAAA,KAAW,CAAA,EAAG;AACrC,MAAA,OAAO,cAAc,oEAAoE,CAAA;AAAA,IAC7F;AAGA,IAAA,MAAM,EAAE,UAAA,EAAW,GAAI,qBAAA,CAAsB,UAAU,CAAA;AACvD,IAAA,IAAI,UAAA,EAAY;AACZ,MAAA,MAAM,GAAA,uBAAU,IAAA,EAAK;AACrB,MAAA,IAAI,aAAa,GAAA,EAAK;AAClB,QAAA,OAAO,cAAc,wBAAwB,CAAA;AAAA,MACjD;AAAA,IACJ;AAIA,IAAA,MAAM,YAAA,GAAe,yBAAA;AACrB,IAAA,MAAM,UAAA,GAAa,SAAS,YAAA,CAAa,UAAA;AACzC,IAAA,MAAM,KAAA,GACF,UAAA,CAAW,YAAY,CAAA,IAAK,WAAW,QAAA,CAAS,OAAO,CAAA,IAAK,MAAA,CAAO,MAAA,CAAO,UAAU,CAAA,CAAE,CAAC,KAAK,EAAC;AAEjG,IAAA,MAAM,MAAA,GAASC,uBAAsB,KAAK,CAAA;AAG1C,IAAA,IAAI,MAAA,CAAO,gBAAA,IAAoB,OAAO,MAAA,CAAO,qBAAqB,QAAA,EAAU;AACxE,MAAA,UAAA,CAAW,UAAU,MAAA,CAAO,gBAAA;AAAA,IAChC;AAEA,IAAA,OAAO;AAAA,MACH,KAAA,EAAO,IAAA;AAAA,MACP,QAAQ,IAAA,CAAK,MAAA;AAAA,MACb,MAAA;AAAA,MACA,MAAA,EAAQ;AAAA,KACZ;AAAA,EACJ;AACJ;ACjTO,SAAS,2BAA2B,KAAA,EAAwD;AAC/F,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,IAASC,EAAA,EAAO;AAEpC,EAAA,MAAM,sBAAA,GAAyB;AAAA,IAC3B,IAAIA,EAAA,EAAO;AAAA,IACX,mBAAmB,KAAA,CAAM,mBAAA,CAAoB,GAAA,CAAI,CAAC,MAAM,KAAA,MAAW;AAAA,MAC/D,EAAA,EAAI,cAAc,KAAK,CAAA,CAAA;AAAA,MACvB,QAAQ,MAAA,CAAO,WAAA;AAAA,QACX,KAAA,CAAM,eAAA,CAAgB,GAAA,CAAI,CAAC,GAAA,KAAQ;AAC/B,UAAA,IAAI,GAAA,KAAQ,WAAA,EAAa,OAAO,CAAC,WAAA,EAAa,EAAE,mBAAA,EAAqB,CAAC,OAAO,CAAA,EAAG,CAAA;AAChF,UAAA,OAAO,CAAC,UAAA,EAAY,EAAE,KAAK,CAAC,OAAO,GAAG,CAAA;AAAA,QAC1C,CAAC;AAAA,OACL;AAAA,MACA,WAAA,EAAa;AAAA,QACT,MAAA,EAAQ;AAAA,UACJ;AAAA,YACI,MAAM,CAAC,CAAA,EAAA,EAAK,IAAI,CAAA,CAAA,EAAI,CAAA,GAAA,EAAM,IAAI,CAAA,EAAA,CAAI,CAAA;AAAA,YAClC,MAAA,EAAQ,EAAE,IAAA,EAAM,IAAA,CAAK,WAAW,UAAU,CAAA,GAAI,YAAY,QAAA;AAAS;AACvE;AACJ;AACJ,KACJ,CAAE;AAAA,GACN;AAEA,EAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB;AAAA,IAC/B,aAAA,EAAe,UAAA;AAAA,IACf,aAAA,EAAe,aAAA;AAAA,IACf,cAAc,KAAA,CAAM,WAAA;AAAA,IACpB,WAAW,KAAA,CAAM,QAAA;AAAA,IACjB,OAAO,KAAA,CAAM,KAAA;AAAA,IACb,KAAA;AAAA,IACA,uBAAA,EAAyB,IAAA,CAAK,SAAA,CAAU,sBAAsB;AAAA,GACjE,CAAA;AAED,EAAA,OAAO;AAAA,IACH,GAAA,EAAK,CAAA,sBAAA,EAAyB,MAAA,CAAO,QAAA,EAAU,CAAA,CAAA;AAAA,IAC/C,sBAAA;AAAA,IACA,OAAO,KAAA,CAAM,KAAA;AAAA,IACb;AAAA,GACJ;AACJ;;;ACvCA,IAAM,UAA+B,CAAC,IAAI,aAAY,EAAG,IAAI,YAAY,CAAA;AAEzE,eAAsB,iBAAA,CAAkB,SAAkB,OAAA,EAAoD;AAC1G,EAAA,KAAA,MAAW,UAAU,OAAA,EAAS;AAC1B,IAAA,IAAI,MAAA,CAAO,QAAA,CAAS,OAAO,CAAA,EAAG;AAC1B,MAAA,OAAO,MAAA,CAAO,KAAA,CAAM,OAAA,EAAS,OAAO,CAAA;AAAA,IACxC;AAAA,EACJ;AAEA,EAAA,OAAO;AAAA,IACH,KAAA,EAAO,KAAA;AAAA,IACP,MAAA,EAAQ,WAAA;AAAA,IACR,QAAQ,EAAC;AAAA,IACT,QAAQ,EAAE,WAAA,EAAa,IAAI,UAAA,EAAW,EAAG,SAAS,EAAA,EAAG;AAAA,IACrD,KAAA,EAAO;AAAA,GACX;AACJ;;;ACrBO,IAAM,OAAA,GAAU","file":"index.js","sourcesContent":["export class InvalidSignatureError extends Error {\n    constructor(message = 'Credential signature validation failed') {\n        super(message);\n        this.name = 'InvalidSignatureError';\n        Object.setPrototypeOf(this, new.target.prototype);\n    }\n}\n\nexport class ExpiredCredentialError extends Error {\n    constructor(message = 'Credential has expired') {\n        super(message);\n        this.name = 'ExpiredCredentialError';\n        Object.setPrototypeOf(this, new.target.prototype);\n    }\n}\n\nexport class UnsupportedFormatError extends Error {\n    constructor(format: string) {\n        super(`Unsupported credential format: ${format}`);\n        this.name = 'UnsupportedFormatError';\n        Object.setPrototypeOf(this, new.target.prototype);\n    }\n}\n\nexport class MalformedCredentialError extends Error {\n    constructor(message = 'Credential structure is malformed') {\n        super(message);\n        this.name = 'MalformedCredentialError';\n        Object.setPrototypeOf(this, new.target.prototype);\n    }\n}\n\nexport class NonceValidationError extends Error {\n    constructor(message = 'Nonce does not match expected value') {\n        super(message);\n        this.name = 'NonceValidationError';\n        Object.setPrototypeOf(this, new.target.prototype);\n    }\n}\n","import { splitSdJwt, decodeJwt, decodeSdJwt, getClaims } from '@sd-jwt/decode';\n\nimport { MalformedCredentialError } from '../errors.js';\nimport type { IssuerInfo } from '../types/issuer.js';\nimport type { CredentialFormat, CredentialClaims, PresentationResult } from '../types/presentation.js';\n\nimport type { ICredentialParser, ParseOptions } from './parser.interface.js';\n\n/**\n * Hasher function signature expected by @sd-jwt/decode.\n * Inlined here to avoid a direct dependency on @sd-jwt/types.\n */\ntype SdJwtHasher = (data: string | ArrayBuffer, alg: string) => Promise<Uint8Array>;\n\n/**\n * SHA-256 hasher implementation using the Web Crypto API.\n * Compatible with the @sd-jwt/decode Hasher signature.\n */\nconst sha256Hasher: SdJwtHasher = async (data: string | ArrayBuffer, _alg: string): Promise<Uint8Array> => {\n    const encoder = new TextEncoder();\n    const input = typeof data === 'string' ? encoder.encode(data) : data;\n    const hashBuffer = await crypto.subtle.digest('SHA-256', input);\n    return new Uint8Array(hashBuffer);\n};\n\n// Standard base64 alphabet for decoding x5c certificate entries\nconst BASE64_CHARS = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';\n\n/**\n * Decodes a standard base64-encoded string into raw bytes.\n * Does not depend on Node.js Buffer or browser atob.\n */\nfunction base64ToBytes(base64: string): Uint8Array<ArrayBuffer> {\n    // Strip any padding characters\n    const cleaned = base64.replace(/=+$/, '');\n    const byteLength = Math.floor((cleaned.length * 3) / 4);\n    const buffer = new ArrayBuffer(byteLength);\n    const bytes = new Uint8Array(buffer);\n\n    let byteIndex = 0;\n    for (let i = 0; i < cleaned.length; i += 4) {\n        const a = BASE64_CHARS.indexOf(cleaned[i]);\n        const b = i + 1 < cleaned.length ? BASE64_CHARS.indexOf(cleaned[i + 1]) : 0;\n        const c = i + 2 < cleaned.length ? BASE64_CHARS.indexOf(cleaned[i + 2]) : 0;\n        const d = i + 3 < cleaned.length ? BASE64_CHARS.indexOf(cleaned[i + 3]) : 0;\n\n        bytes[byteIndex++] = (a << 2) | (b >> 4);\n        if (byteIndex < byteLength) bytes[byteIndex++] = ((b & 0x0f) << 4) | (c >> 2);\n        if (byteIndex < byteLength) bytes[byteIndex++] = ((c & 0x03) << 6) | d;\n    }\n\n    return bytes;\n}\n\n/**\n * Extracts the DER-encoded certificate bytes from a base64-encoded X.509 certificate\n * found in the JWT header's x5c field.\n */\nfunction extractCertificateFromX5c(x5cEntry: string): Uint8Array<ArrayBuffer> {\n    return base64ToBytes(x5cEntry);\n}\n\n/**\n * Checks whether two Uint8Array instances contain identical bytes.\n */\nfunction bytesEqual(a: Uint8Array, b: Uint8Array): boolean {\n    if (a.length !== b.length) return false;\n    for (let i = 0; i < a.length; i++) {\n        if (a[i] !== b[i]) return false;\n    }\n    return true;\n}\n\n/**\n * Maps raw decoded claims to the CredentialClaims structure,\n * picking known age/residency fields and preserving any extra keys.\n */\nfunction mapToCredentialClaims(raw: Record<string, unknown>): CredentialClaims {\n    const claims: CredentialClaims = {};\n\n    if (typeof raw['age_over_18'] === 'boolean') {\n        claims.age_over_18 = raw['age_over_18'];\n    }\n    if (typeof raw['age_over_21'] === 'boolean') {\n        claims.age_over_21 = raw['age_over_21'];\n    }\n    if (typeof raw['resident_country'] === 'string') {\n        claims.resident_country = raw['resident_country'];\n    }\n    if (typeof raw['nationality'] === 'string') {\n        claims.nationality = raw['nationality'];\n    }\n    if (typeof raw['family_name_birth'] === 'string') {\n        claims.family_name_birth = raw['family_name_birth'];\n    }\n\n    // Preserve any additional claim keys not already mapped\n    for (const [key, value] of Object.entries(raw)) {\n        if (\n            !(key in claims) &&\n            !key.startsWith('_sd') &&\n            key !== 'iss' &&\n            key !== 'exp' &&\n            key !== 'iat' &&\n            key !== 'cnf' &&\n            key !== 'vct'\n        ) {\n            claims[key] = value;\n        }\n    }\n\n    return claims;\n}\n\n/**\n * SD-JWT VC credential parser.\n *\n * Decodes and validates SD-JWT Verifiable Credentials as specified in\n * the EUDI Wallet ecosystem. Performs:\n *   - Structure validation (JWT~disclosure~kb format)\n *   - Issuer certificate trust chain verification\n *   - Expiry checking\n *   - Nonce validation against the key binding JWT\n *   - Selective disclosure claim extraction\n */\nexport class SdJwtParser implements ICredentialParser {\n    readonly format: CredentialFormat = 'sd-jwt-vc';\n\n    /**\n     * Returns true when the token looks like an SD-JWT:\n     * it must be a string containing the `~` disclosure separator.\n     */\n    canParse(vpToken: unknown): boolean {\n        return typeof vpToken === 'string' && vpToken.includes('~');\n    }\n\n    /**\n     * Parses and validates an SD-JWT VC token.\n     *\n     * @throws {MalformedCredentialError} when the token structure cannot be decoded\n     */\n    async parse(vpToken: unknown, options: ParseOptions): Promise<PresentationResult> {\n        if (typeof vpToken !== 'string') {\n            throw new MalformedCredentialError('VP token must be a string');\n        }\n\n        const invalidResult = (error: string): PresentationResult => ({\n            valid: false,\n            format: this.format,\n            claims: {},\n            issuer: { certificate: new Uint8Array(), country: '' },\n            error,\n        });\n\n        // Step 1: Split the SD-JWT into its components\n        let parts: ReturnType<typeof splitSdJwt>;\n        try {\n            parts = splitSdJwt(vpToken);\n        } catch {\n            throw new MalformedCredentialError('Failed to split SD-JWT structure');\n        }\n\n        // Step 2: Decode the issuer JWT header and payload\n        let header: Record<string, unknown>;\n        let payload: Record<string, unknown>;\n        try {\n            const jwt = decodeJwt(parts.jwt);\n            header = jwt.header;\n            payload = jwt.payload;\n        } catch {\n            throw new MalformedCredentialError('Failed to decode SD-JWT issuer JWT');\n        }\n\n        // Step 3: Extract issuer certificate from x5c header\n        const x5cArray = header['x5c'];\n        let issuerCertBytes = new Uint8Array();\n        let issuerInfo: IssuerInfo = { certificate: new Uint8Array(), country: '' };\n\n        if (Array.isArray(x5cArray) && x5cArray.length > 0 && typeof x5cArray[0] === 'string') {\n            try {\n                issuerCertBytes = extractCertificateFromX5c(x5cArray[0]);\n                // Attempt to derive the country from the certificate's issuer string\n                // In production, this would parse the X.509 subject, but for now we\n                // fall back to payload-level hints.\n                const issuerString = typeof payload['iss'] === 'string' ? payload['iss'] : '';\n                issuerInfo = {\n                    certificate: issuerCertBytes,\n                    country: extractCountryHint(issuerString),\n                };\n            } catch {\n                return invalidResult('Failed to extract issuer certificate from x5c');\n            }\n        }\n\n        // Step 4: Verify trust — certificate must be in the trusted set\n        if (options.trustedCertificates.length > 0) {\n            const isTrusted = options.trustedCertificates.some((trusted) => bytesEqual(trusted, issuerCertBytes));\n            if (!isTrusted) {\n                return invalidResult('Issuer certificate is not trusted');\n            }\n        } else if (issuerCertBytes.length === 0) {\n            return invalidResult('No issuer certificate found and no trusted certificates configured');\n        }\n\n        // Step 5: Check expiry\n        const exp = payload['exp'];\n        if (typeof exp === 'number') {\n            const nowSeconds = Math.floor(Date.now() / 1000);\n            if (exp < nowSeconds) {\n                return invalidResult('Credential has expired');\n            }\n        }\n\n        // Step 6: Validate nonce in key binding JWT\n        if (parts.kbJwt) {\n            try {\n                const kbDecoded = decodeJwt(parts.kbJwt);\n                const kbPayload = kbDecoded.payload as Record<string, unknown>;\n                const kbNonce = kbPayload['nonce'];\n                if (typeof kbNonce === 'string' && kbNonce !== options.nonce) {\n                    return invalidResult('Key binding JWT nonce does not match');\n                }\n            } catch {\n                return invalidResult('Failed to decode key binding JWT');\n            }\n        }\n\n        // Step 7: Decode disclosures and extract claims\n        let resolvedClaims: Record<string, unknown>;\n        try {\n            const decoded = await decodeSdJwt(vpToken, sha256Hasher);\n            resolvedClaims = await getClaims<Record<string, unknown>>(\n                decoded.jwt.payload,\n                decoded.disclosures,\n                sha256Hasher\n            );\n        } catch {\n            // If SD-JWT decoding fails (e.g., no _sd_alg), fall back to raw payload\n            resolvedClaims = payload;\n        }\n\n        const claims = mapToCredentialClaims(resolvedClaims);\n\n        return {\n            valid: true,\n            format: this.format,\n            claims,\n            issuer: issuerInfo,\n        };\n    }\n}\n\n/**\n * Best-effort extraction of a country code hint from an issuer URL or string.\n * For example, \"https://issuer.de/...\" would yield \"DE\".\n */\nfunction extractCountryHint(issuer: string): string {\n    try {\n        const url = new URL(issuer);\n        const tld = url.hostname.split('.').pop()?.toUpperCase();\n        if (tld && tld.length === 2) {\n            return tld;\n        }\n    } catch {\n        // Not a valid URL — ignore\n    }\n    return '';\n}\n","import { decode } from 'cbor-x';\n\nimport { MalformedCredentialError } from '../errors.js';\nimport type { IssuerInfo } from '../types/issuer.js';\nimport type { CredentialFormat, CredentialClaims, PresentationResult } from '../types/presentation.js';\n\nimport type { ICredentialParser, ParseOptions } from './parser.interface.js';\n\n/**\n * Runtime check for binary data. Returns true for Uint8Array and Node.js Buffer\n * without referencing the Buffer type (which is unavailable in DOM-only tsconfig).\n * Buffer extends Uint8Array, so `instanceof Uint8Array` catches both.\n */\nfunction isBinaryData(value: unknown): value is Uint8Array {\n    return value instanceof Uint8Array;\n}\n\n/**\n * Checks whether two Uint8Array instances contain identical bytes.\n */\nfunction bytesEqual(a: Uint8Array, b: Uint8Array): boolean {\n    if (a.length !== b.length) return false;\n    for (let i = 0; i < a.length; i++) {\n        if (a[i] !== b[i]) return false;\n    }\n    return true;\n}\n\n/**\n * Represents a single IssuerSignedItem element from an mDOC nameSpace.\n * ISO 18013-5 Section 8.3.2.1.2.\n */\ninterface IssuerSignedItem {\n    digestID: number;\n    random: Uint8Array | unknown;\n    elementIdentifier: string;\n    elementValue: unknown;\n}\n\n/**\n * Simplified DeviceResponse structure from ISO 18013-5.\n * Only the fields required for claim extraction and trust validation.\n */\ninterface MdocDocument {\n    docType: string;\n    issuerSigned: {\n        nameSpaces: Record<string, IssuerSignedItem[]>;\n        issuerAuth: unknown[];\n    };\n}\n\ninterface DeviceResponse {\n    version: string;\n    documents: MdocDocument[];\n    status: number;\n}\n\n/**\n * Extracts the issuer certificate bytes from a COSE_Sign1 issuerAuth structure.\n *\n * The issuerAuth is a COSE_Sign1 array: [protected, unprotected, payload, signature].\n * The protected header (index 0) is CBOR-encoded and may contain the x5chain (label 33)\n * with the issuer certificate. The unprotected header (index 1) may also carry it.\n *\n * If neither header contains a certificate, the raw protected bytes are returned\n * as a fallback for trust matching (test/simplified scenarios).\n */\nfunction extractCertificateFromIssuerAuth(issuerAuth: unknown[]): Uint8Array {\n    // Try unprotected header first (index 1) -- it's already decoded as a Map or object\n    const unprotected = issuerAuth[1];\n    if (unprotected && typeof unprotected === 'object') {\n        // x5chain is COSE header label 33\n        const certFromUnprotected = extractX5Chain(unprotected);\n        if (certFromUnprotected) return certFromUnprotected;\n    }\n\n    // Try protected header (index 0) -- CBOR-encoded bytes\n    const protectedHeader = issuerAuth[0];\n    if (isBinaryData(protectedHeader)) {\n        try {\n            const decoded = decode(protectedHeader) as unknown;\n            if (decoded && typeof decoded === 'object') {\n                const certFromProtected = extractX5Chain(decoded);\n                if (certFromProtected) return certFromProtected;\n            }\n        } catch {\n            // Protected header could not be decoded -- fall through\n        }\n        // Return raw protected bytes as fallback identifier\n        return new Uint8Array(protectedHeader);\n    }\n\n    return new Uint8Array();\n}\n\n/**\n * Extracts certificate bytes from an x5chain (label 33) in a COSE header.\n * The header can be a plain object or a Map.\n */\nfunction extractX5Chain(header: unknown): Uint8Array | null {\n    if (header instanceof Map) {\n        const cert = header.get(33) as unknown;\n        if (isBinaryData(cert)) {\n            return new Uint8Array(cert);\n        }\n    } else if (typeof header === 'object' && header !== null) {\n        const rec = header as Record<string | number, unknown>;\n        const cert = rec[33] ?? rec['x5chain'] ?? rec['33'];\n        if (isBinaryData(cert)) {\n            return new Uint8Array(cert);\n        }\n    }\n    return null;\n}\n\n/**\n * Maps raw mDOC IssuerSignedItem elements to the CredentialClaims structure,\n * picking known age/residency fields and preserving any additional identifiers.\n */\nfunction mapToCredentialClaims(items: IssuerSignedItem[]): CredentialClaims {\n    const claims: CredentialClaims = {};\n\n    for (const item of items) {\n        const key = item.elementIdentifier;\n        const value = item.elementValue;\n\n        switch (key) {\n            case 'age_over_18':\n                if (typeof value === 'boolean') claims.age_over_18 = value;\n                break;\n            case 'age_over_21':\n                if (typeof value === 'boolean') claims.age_over_21 = value;\n                break;\n            case 'resident_country':\n                if (typeof value === 'string') claims.resident_country = value;\n                break;\n            case 'nationality':\n                if (typeof value === 'string') claims.nationality = value;\n                break;\n            case 'family_name_birth':\n                if (typeof value === 'string') claims.family_name_birth = value;\n                break;\n            default:\n                claims[key] = value;\n                break;\n        }\n    }\n\n    return claims;\n}\n\n/**\n * Extracts validity period from the issuerAuth payload.\n *\n * The payload (index 2) of the COSE_Sign1 is CBOR-encoded and should\n * contain a MobileSecurityObject with a validityInfo field carrying\n * `validFrom` and `validUntil` dates.\n */\nfunction extractValidityPeriod(issuerAuth: unknown[]): { validFrom?: Date; validUntil?: Date } {\n    const payload = issuerAuth[2];\n    if (!payload) return {};\n\n    try {\n        // payload can be raw CBOR bytes or already decoded\n        const decoded = isBinaryData(payload) ? (decode(payload) as unknown) : payload;\n\n        if (decoded && typeof decoded === 'object') {\n            const obj = decoded as Record<string, unknown>;\n            const validityInfo = obj['validityInfo'] as Record<string, unknown> | undefined;\n            if (validityInfo) {\n                return {\n                    validFrom:\n                        validityInfo['validFrom'] instanceof Date\n                            ? validityInfo['validFrom']\n                            : typeof validityInfo['validFrom'] === 'string'\n                              ? new Date(validityInfo['validFrom'])\n                              : undefined,\n                    validUntil:\n                        validityInfo['validUntil'] instanceof Date\n                            ? validityInfo['validUntil']\n                            : typeof validityInfo['validUntil'] === 'string'\n                              ? new Date(validityInfo['validUntil'])\n                              : undefined,\n                };\n            }\n        }\n    } catch {\n        // Could not decode payload -- validity check will be skipped\n    }\n\n    return {};\n}\n\n/**\n * mDOC / mDL credential parser.\n *\n * Decodes and validates mDOC (Mobile Document) credentials as specified in\n * ISO 18013-5 and the EUDI Wallet ecosystem. Processes CBOR-encoded\n * DeviceResponse structures containing:\n *   - Document type validation (eu.europa.ec.eudi.pid.1)\n *   - Issuer certificate trust chain verification via COSE_Sign1 issuerAuth\n *   - Validity period checking\n *   - Claim extraction from IssuerSignedItem nameSpace elements\n */\nexport class MdocParser implements ICredentialParser {\n    readonly format: CredentialFormat = 'mdoc';\n\n    /**\n     * Returns true when the token is binary data (Uint8Array or Buffer),\n     * indicating a CBOR-encoded mDOC DeviceResponse.\n     */\n    canParse(vpToken: unknown): boolean {\n        return isBinaryData(vpToken);\n    }\n\n    /**\n     * Parses and validates an mDOC DeviceResponse token.\n     *\n     * @throws {MalformedCredentialError} when the CBOR structure cannot be decoded\n     *   or does not match the expected DeviceResponse format\n     */\n    async parse(vpToken: unknown, options: ParseOptions): Promise<PresentationResult> {\n        if (!isBinaryData(vpToken)) {\n            throw new MalformedCredentialError('VP token must be a Uint8Array or Buffer');\n        }\n\n        const invalidResult = (error: string): PresentationResult => ({\n            valid: false,\n            format: this.format,\n            claims: {},\n            issuer: { certificate: new Uint8Array(), country: '' },\n            error,\n        });\n\n        // Step 1: Decode the CBOR DeviceResponse\n        let deviceResponse: DeviceResponse;\n        try {\n            deviceResponse = decode(vpToken) as DeviceResponse;\n        } catch {\n            throw new MalformedCredentialError('Failed to decode CBOR DeviceResponse');\n        }\n\n        // Step 2: Validate basic DeviceResponse structure\n        if (\n            !deviceResponse ||\n            typeof deviceResponse !== 'object' ||\n            !Array.isArray(deviceResponse.documents) ||\n            deviceResponse.documents.length === 0\n        ) {\n            throw new MalformedCredentialError('Invalid DeviceResponse structure: missing or empty documents array');\n        }\n\n        const document = deviceResponse.documents[0];\n        if (!document.issuerSigned || !document.issuerSigned.nameSpaces || !document.issuerSigned.issuerAuth) {\n            throw new MalformedCredentialError('Invalid mDOC document: missing issuerSigned data');\n        }\n\n        // Step 3: Extract issuer certificate from COSE_Sign1 issuerAuth\n        const issuerAuth = document.issuerSigned.issuerAuth;\n        if (!Array.isArray(issuerAuth) || issuerAuth.length < 4) {\n            throw new MalformedCredentialError('Invalid issuerAuth: expected COSE_Sign1 array with 4 elements');\n        }\n\n        const issuerCertBytes = extractCertificateFromIssuerAuth(issuerAuth);\n        const issuerInfo: IssuerInfo = {\n            certificate: issuerCertBytes,\n            country: '',\n        };\n\n        // Step 4: Verify trust -- certificate must be in the trusted set\n        if (options.trustedCertificates.length > 0) {\n            const isTrusted = options.trustedCertificates.some((trusted) => bytesEqual(trusted, issuerCertBytes));\n            if (!isTrusted) {\n                return invalidResult('Issuer certificate is not trusted');\n            }\n        } else if (issuerCertBytes.length === 0) {\n            return invalidResult('No issuer certificate found and no trusted certificates configured');\n        }\n\n        // Step 5: Check validity period\n        const { validUntil } = extractValidityPeriod(issuerAuth);\n        if (validUntil) {\n            const now = new Date();\n            if (validUntil < now) {\n                return invalidResult('Credential has expired');\n            }\n        }\n\n        // Step 6: Extract claims from nameSpaces\n        // Prefer the EUDI PID namespace, fall back to the first available namespace\n        const pidNamespace = 'eu.europa.ec.eudi.pid.1';\n        const nameSpaces = document.issuerSigned.nameSpaces;\n        const items: IssuerSignedItem[] =\n            nameSpaces[pidNamespace] ?? nameSpaces[document.docType] ?? Object.values(nameSpaces)[0] ?? [];\n\n        const claims = mapToCredentialClaims(items);\n\n        // Try to derive country from resident_country claim\n        if (claims.resident_country && typeof claims.resident_country === 'string') {\n            issuerInfo.country = claims.resident_country;\n        }\n\n        return {\n            valid: true,\n            format: this.format,\n            claims,\n            issuer: issuerInfo,\n        };\n    }\n}\n","import { v4 as uuidv4 } from 'uuid';\n\nimport type { AuthorizationRequestInput, AuthorizationRequest } from './types/authorization.js';\n\nexport function createAuthorizationRequest(input: AuthorizationRequestInput): AuthorizationRequest {\n    const state = input.state ?? uuidv4();\n\n    const presentationDefinition = {\n        id: uuidv4(),\n        input_descriptors: input.requestedAttributes.map((attr, index) => ({\n            id: `descriptor_${index}`,\n            format: Object.fromEntries(\n                input.acceptedFormats.map((fmt) => {\n                    if (fmt === 'sd-jwt-vc') return ['vc+sd-jwt', { 'sd-jwt_alg_values': ['ES256'] }];\n                    return ['mso_mdoc', { alg: ['ES256'] }];\n                })\n            ),\n            constraints: {\n                fields: [\n                    {\n                        path: [`$.${attr}`, `$['${attr}']`],\n                        filter: { type: attr.startsWith('age_over') ? 'boolean' : 'string' },\n                    },\n                ],\n            },\n        })),\n    };\n\n    const params = new URLSearchParams({\n        response_type: 'vp_token',\n        response_mode: 'direct_post',\n        response_uri: input.responseUri,\n        client_id: input.clientId,\n        nonce: input.nonce,\n        state,\n        presentation_definition: JSON.stringify(presentationDefinition),\n    });\n\n    return {\n        uri: `openid4vp://authorize?${params.toString()}`,\n        presentationDefinition,\n        nonce: input.nonce,\n        state,\n    };\n}\n","import { MdocParser } from './parsers/mdoc.parser.js';\nimport type { ParseOptions, ICredentialParser } from './parsers/parser.interface.js';\nimport { SdJwtParser } from './parsers/sd-jwt.parser.js';\nimport type { PresentationResult } from './types/presentation.js';\n\nconst parsers: ICredentialParser[] = [new SdJwtParser(), new MdocParser()];\n\nexport async function parsePresentation(vpToken: unknown, options: ParseOptions): Promise<PresentationResult> {\n    for (const parser of parsers) {\n        if (parser.canParse(vpToken)) {\n            return parser.parse(vpToken, options);\n        }\n    }\n\n    return {\n        valid: false,\n        format: 'sd-jwt-vc',\n        claims: {},\n        issuer: { certificate: new Uint8Array(), country: '' },\n        error: 'Unsupported credential format',\n    };\n}\n\nexport type { ParseOptions } from './parsers/parser.interface.js';\n","export const VERSION = '0.1.0';\n\nexport type {\n    CredentialFormat,\n    CredentialClaims,\n    PresentationResult,\n    IssuerInfo,\n    AuthorizationRequestInput,\n    AuthorizationRequest,\n} from './types/index.js';\n\nexport type { ICredentialParser, ParseOptions } from './parsers/parser.interface.js';\n\nexport { SdJwtParser } from './parsers/sd-jwt.parser.js';\nexport { MdocParser } from './parsers/mdoc.parser.js';\n\nexport {\n    InvalidSignatureError,\n    ExpiredCredentialError,\n    UnsupportedFormatError,\n    MalformedCredentialError,\n    NonceValidationError,\n} from './errors.js';\n\nexport { createAuthorizationRequest } from './authorization.js';\n\nexport { parsePresentation } from './presentation.js';\n"]}