@openeudi/openid4vp 0.3.0 → 0.4.0

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/errors.ts","../src/parsers/sd-jwt.parser.ts","../src/crypto/cose-sign1.ts","../src/crypto/digest.ts","../src/crypto/mso.ts","../src/parsers/mdoc.parser.ts","../src/authorization.ts","../src/presentation.ts","../src/index.ts"],"names":["encoder","splitSdJwt","decodeProtectedHeader","importX509","jwtVerify","importJWK","decodeSdJwt","getClaims","CborEncoder","Tag","decoder","bytesEqual","DEFAULT_ALLOWED_ALGORITHMS","derToPem","uuidv4"],"mappings":";;;;;;;;;;AAAO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EAC7C,WAAA,CAAY,UAAU,wCAAA,EAA0C;AAC5D,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AACZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,GAAA,CAAA,MAAA,CAAW,SAAS,CAAA;AAAA,EACpD;AACJ;AAEO,IAAM,sBAAA,GAAN,cAAqC,KAAA,CAAM;AAAA,EAC9C,WAAA,CAAY,UAAU,wBAAA,EAA0B;AAC5C,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,wBAAA;AACZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,GAAA,CAAA,MAAA,CAAW,SAAS,CAAA;AAAA,EACpD;AACJ;AAEO,IAAM,sBAAA,GAAN,cAAqC,KAAA,CAAM;AAAA,EAC9C,YAAY,MAAA,EAAgB;AACxB,IAAA,KAAA,CAAM,CAAA,+BAAA,EAAkC,MAAM,CAAA,CAAE,CAAA;AAChD,IAAA,IAAA,CAAK,IAAA,GAAO,wBAAA;AACZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,GAAA,CAAA,MAAA,CAAW,SAAS,CAAA;AAAA,EACpD;AACJ;AAEO,IAAM,wBAAA,GAAN,cAAuC,KAAA,CAAM;AAAA,EAChD,WAAA,CAAY,UAAU,mCAAA,EAAqC;AACvD,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,0BAAA;AACZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,GAAA,CAAA,MAAA,CAAW,SAAS,CAAA;AAAA,EACpD;AACJ;AAEO,IAAM,oBAAA,GAAN,cAAmC,KAAA,CAAM;AAAA,EAC5C,WAAA,CAAY,UAAU,qCAAA,EAAuC;AACzD,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,sBAAA;AACZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,GAAA,CAAA,MAAA,CAAW,SAAS,CAAA;AAAA,EACpD;AACJ;;;ACvBA,IAAM,0BAAA,GAA6B,CAAC,OAAA,EAAS,OAAA,EAAS,OAAO,CAAA;AAM7D,IAAM,YAAA,GAA4B,OAAO,IAAA,EAA4B,IAAA,KAAsC;AACvG,EAAA,MAAMA,QAAAA,GAAU,IAAI,WAAA,EAAY;AAChC,EAAA,MAAM,QAAQ,OAAO,IAAA,KAAS,WAAWA,QAAAA,CAAQ,MAAA,CAAO,IAAI,CAAA,GAAI,IAAA;AAChE,EAAA,MAAM,aAAa,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,WAAW,KAAK,CAAA;AAC9D,EAAA,OAAO,IAAI,WAAW,UAAU,CAAA;AACpC,CAAA;AAGA,IAAM,YAAA,GAAe,kEAAA;AAMrB,SAAS,cAAc,MAAA,EAAyC;AAC5D,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AACxC,EAAA,MAAM,aAAa,IAAA,CAAK,KAAA,CAAO,OAAA,CAAQ,MAAA,GAAS,IAAK,CAAC,CAAA;AACtD,EAAA,MAAM,MAAA,GAAS,IAAI,WAAA,CAAY,UAAU,CAAA;AACzC,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,MAAM,CAAA;AAEnC,EAAA,IAAI,SAAA,GAAY,CAAA;AAChB,EAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,OAAA,CAAQ,MAAA,EAAQ,KAAK,CAAA,EAAG;AACxC,IAAA,MAAM,CAAA,GAAI,YAAA,CAAa,OAAA,CAAQ,OAAA,CAAQ,CAAC,CAAC,CAAA;AACzC,IAAA,MAAM,CAAA,GAAI,CAAA,GAAI,CAAA,GAAI,OAAA,CAAQ,MAAA,GAAS,YAAA,CAAa,OAAA,CAAQ,OAAA,CAAQ,CAAA,GAAI,CAAC,CAAC,CAAA,GAAI,CAAA;AAC1E,IAAA,MAAM,CAAA,GAAI,CAAA,GAAI,CAAA,GAAI,OAAA,CAAQ,MAAA,GAAS,YAAA,CAAa,OAAA,CAAQ,OAAA,CAAQ,CAAA,GAAI,CAAC,CAAC,CAAA,GAAI,CAAA;AAC1E,IAAA,MAAM,CAAA,GAAI,CAAA,GAAI,CAAA,GAAI,OAAA,CAAQ,MAAA,GAAS,YAAA,CAAa,OAAA,CAAQ,OAAA,CAAQ,CAAA,GAAI,CAAC,CAAC,CAAA,GAAI,CAAA;AAE1E,IAAA,KAAA,CAAM,SAAA,EAAW,CAAA,GAAK,CAAA,IAAK,CAAA,GAAM,CAAA,IAAK,CAAA;AACtC,IAAA,IAAI,SAAA,GAAY,YAAY,KAAA,CAAM,SAAA,EAAW,KAAM,CAAA,GAAI,EAAA,KAAS,IAAM,CAAA,IAAK,CAAA;AAC3E,IAAA,IAAI,YAAY,UAAA,EAAY,KAAA,CAAM,WAAW,CAAA,GAAA,CAAM,CAAA,GAAI,MAAS,CAAA,GAAK,CAAA;AAAA,EACzE;AAEA,EAAA,OAAO,KAAA;AACX;AAKA,SAAS,UAAA,CAAW,GAAe,CAAA,EAAwB;AACvD,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,CAAE,MAAA,EAAQ,OAAO,KAAA;AAClC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,QAAQ,CAAA,EAAA,EAAK;AAC/B,IAAA,IAAI,EAAE,CAAC,CAAA,KAAM,CAAA,CAAE,CAAC,GAAG,OAAO,KAAA;AAAA,EAC9B;AACA,EAAA,OAAO,IAAA;AACX;AAKA,SAAS,SAAS,SAAA,EAA2B;AACzC,EAAA,MAAM,KAAA,GAAQ,SAAA,CAAU,KAAA,CAAM,UAAU,KAAK,EAAC;AAC9C,EAAA,OAAO,CAAA;AAAA,EAAgC,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC;AAAA,yBAAA,CAAA;AAC3D;AAMA,SAAS,iBAAiB,KAAA,EAA2B;AACjD,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACtB,IAAA,MAAA,IAAU,MAAA,CAAO,aAAa,IAAI,CAAA;AAAA,EACtC;AACA,EAAA,OAAO,UAAA,CAAW,IAAA,CAAK,MAAM,CAAA,CAAE,QAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC5F;AAMA,SAAS,sBAAsB,GAAA,EAAgD;AAC3E,EAAA,MAAM,SAA2B,EAAC;AAElC,EAAA,IAAI,OAAO,GAAA,CAAI,aAAa,CAAA,KAAM,SAAA,EAAW;AACzC,IAAA,MAAA,CAAO,WAAA,GAAc,IAAI,aAAa,CAAA;AAAA,EAC1C;AACA,EAAA,IAAI,OAAO,GAAA,CAAI,aAAa,CAAA,KAAM,SAAA,EAAW;AACzC,IAAA,MAAA,CAAO,WAAA,GAAc,IAAI,aAAa,CAAA;AAAA,EAC1C;AACA,EAAA,IAAI,OAAO,GAAA,CAAI,kBAAkB,CAAA,KAAM,QAAA,EAAU;AAC7C,IAAA,MAAA,CAAO,gBAAA,GAAmB,IAAI,kBAAkB,CAAA;AAAA,EACpD;AACA,EAAA,IAAI,OAAO,GAAA,CAAI,aAAa,CAAA,KAAM,QAAA,EAAU;AACxC,IAAA,MAAA,CAAO,WAAA,GAAc,IAAI,aAAa,CAAA;AAAA,EAC1C;AACA,EAAA,IAAI,OAAO,GAAA,CAAI,mBAAmB,CAAA,KAAM,QAAA,EAAU;AAC9C,IAAA,MAAA,CAAO,iBAAA,GAAoB,IAAI,mBAAmB,CAAA;AAAA,EACtD;AAEA,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAA,EAAG;AAC5C,IAAA,IACI,EAAE,GAAA,IAAO,MAAA,CAAA,IACT,CAAC,GAAA,CAAI,WAAW,KAAK,CAAA,IACrB,GAAA,KAAQ,KAAA,IACR,QAAQ,KAAA,IACR,GAAA,KAAQ,SACR,GAAA,KAAQ,KAAA,IACR,QAAQ,KAAA,EACV;AACE,MAAA,MAAA,CAAO,GAAG,CAAA,GAAI,KAAA;AAAA,IAClB;AAAA,EACJ;AAEA,EAAA,OAAO,MAAA;AACX;AAKA,SAAS,mBAAmB,MAAA,EAAwB;AAChD,EAAA,IAAI;AACA,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,MAAM,CAAA;AAC1B,IAAA,MAAM,GAAA,GAAM,IAAI,QAAA,CAAS,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,IAAO,WAAA,EAAY;AACvD,IAAA,IAAI,GAAA,IAAO,GAAA,CAAI,MAAA,KAAW,CAAA,EAAG;AACzB,MAAA,OAAO,GAAA;AAAA,IACX;AAAA,EACJ,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,OAAO,EAAA;AACX;AAYO,IAAM,cAAN,MAA+C;AAAA,EACzC,MAAA,GAA2B,WAAA;AAAA,EAEpC,SAAS,OAAA,EAA2B;AAChC,IAAA,OAAO,OAAO,OAAA,KAAY,QAAA,IAAY,OAAA,CAAQ,SAAS,GAAG,CAAA;AAAA,EAC9D;AAAA,EAEA,MAAM,KAAA,CAAM,OAAA,EAAkB,OAAA,EAAoD;AAC9E,IAAA,IAAI,OAAO,YAAY,QAAA,EAAU;AAC7B,MAAA,MAAM,IAAI,yBAAyB,2BAA2B,CAAA;AAAA,IAClE;AAEA,IAAA,MAAM,iBAAA,GAAoB,QAAQ,iBAAA,IAAqB,0BAAA;AAEvD,IAAA,MAAM,aAAA,GAAgB,CAAC,KAAA,MAAuC;AAAA,MAC1D,KAAA,EAAO,KAAA;AAAA,MACP,QAAQ,IAAA,CAAK,MAAA;AAAA,MACb,QAAQ,EAAC;AAAA,MACT,QAAQ,EAAE,WAAA,EAAa,IAAI,UAAA,EAAW,EAAG,SAAS,EAAA,EAAG;AAAA,MACrD;AAAA,KACJ,CAAA;AAGA,IAAA,IAAI,KAAA;AACJ,IAAA,IAAI;AACA,MAAA,KAAA,GAAQC,kBAAW,OAAO,CAAA;AAAA,IAC9B,CAAA,CAAA,MAAQ;AACJ,MAAA,MAAM,IAAI,yBAAyB,kCAAkC,CAAA;AAAA,IACzE;AAGA,IAAA,IAAI,MAAA;AACJ,IAAA,IAAI;AACA,MAAA,MAAA,GAASC,0BAAA,CAAsB,MAAM,GAAG,CAAA;AAAA,IAC5C,CAAA,CAAA,MAAQ;AACJ,MAAA,MAAM,IAAI,yBAAyB,2CAA2C,CAAA;AAAA,IAClF;AAGA,IAAA,MAAM,MAAM,MAAA,CAAO,GAAA;AACnB,IAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,CAAC,iBAAA,CAAkB,QAAA,CAAS,GAAG,CAAA,EAAG;AAC7D,MAAA,OAAO,aAAA,CAAc,CAAA,uBAAA,EAA0B,GAAG,CAAA,CAAE,CAAA;AAAA,IACxD;AAGA,IAAA,MAAM,WAAW,MAAA,CAAO,GAAA;AACxB,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,QAAQ,CAAA,IAAK,QAAA,CAAS,MAAA,KAAW,CAAA,IAAK,OAAO,QAAA,CAAS,CAAC,CAAA,KAAM,QAAA,EAAU;AACtF,MAAA,MAAM,IAAI,yBAAyB,sCAAsC,CAAA;AAAA,IAC7E;AAEA,IAAA,IAAI,SAAA;AACJ,IAAA,IAAI,eAAA;AACJ,IAAA,IAAI;AACA,MAAA,SAAA,GAAY,MAAMC,eAAA,CAAW,QAAA,CAAS,SAAS,CAAC,CAAC,GAAG,GAAG,CAAA;AACvD,MAAA,eAAA,GAAkB,aAAA,CAAc,QAAA,CAAS,CAAC,CAAC,CAAA;AAAA,IAC/C,SAAS,GAAA,EAAK;AACV,MAAA,IAAI,GAAA,YAAe,0BAA0B,MAAM,GAAA;AACnD,MAAA,MAAM,IAAI,yBAAyB,qCAAqC,CAAA;AAAA,IAC5E;AAGA,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACA,MAAA,MAAM,MAAA,GAAS,MAAMC,cAAA,CAAU,KAAA,CAAM,KAAK,SAAA,EAAW,EAAE,UAAA,EAAY,iBAAA,EAAmB,CAAA;AACtF,MAAA,OAAA,GAAU,MAAA,CAAO,OAAA;AAAA,IACrB,CAAA,CAAA,MAAQ;AACJ,MAAA,OAAO,cAAc,0CAA0C,CAAA;AAAA,IACnE;AAIA,IAAA,MAAM,YAAA,GAAe,OAAO,OAAA,CAAQ,KAAK,MAAM,QAAA,GAAW,OAAA,CAAQ,KAAK,CAAA,GAAI,EAAA;AAC3E,IAAA,MAAM,UAAA,GAAyB;AAAA,MAC3B,WAAA,EAAa,eAAA;AAAA,MACb,OAAA,EAAS,mBAAmB,YAAY;AAAA,KAC5C;AAEA,IAAA,IAAI,OAAA,CAAQ,mBAAA,CAAoB,MAAA,KAAW,CAAA,EAAG;AAC1C,MAAA,IAAI,OAAA,CAAQ,mBAAmB,IAAA,EAAM;AACjC,QAAA,MAAM,IAAI,wBAAA;AAAA,UACN;AAAA,SACJ;AAAA,MACJ;AAAA,IACJ,CAAA,MAAO;AACH,MAAA,MAAM,SAAA,GAAY,QAAQ,mBAAA,CAAoB,IAAA,CAAK,CAAC,OAAA,KAAY,UAAA,CAAW,OAAA,EAAS,eAAe,CAAC,CAAA;AACpG,MAAA,IAAI,CAAC,SAAA,EAAW;AACZ,QAAA,OAAO,cAAc,mCAAmC,CAAA;AAAA,MAC5D;AAAA,IACJ;AAGA,IAAA,MAAM,OAAA,GAAU,QAAQ,KAAK,CAAA;AAC7B,IAAA,IAAI,KAAA,CAAM,WAAA,CAAY,MAAA,GAAS,CAAA,EAAG;AAC9B,MAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,IAAK,OAAA,CAAQ,WAAW,CAAA,EAAG;AACjD,QAAA,OAAO,cAAc,oDAAoD,CAAA;AAAA,MAC7E;AACA,MAAA,KAAA,MAAW,UAAA,IAAc,MAAM,WAAA,EAAa;AACxC,QAAA,MAAM,SAAA,GAAY,MAAM,YAAA,CAAa,UAAqB,CAAA;AAC1D,QAAA,MAAM,UAAA,GAAa,iBAAiB,SAAS,CAAA;AAC7C,QAAA,IAAI,CAAC,OAAA,CAAQ,QAAA,CAAS,UAAU,CAAA,EAAG;AAC/B,UAAA,OAAO,cAAc,0BAA0B,CAAA;AAAA,QACnD;AAAA,MACJ;AAAA,IACJ;AAGA,IAAA,IAAI,MAAM,KAAA,EAAO;AAEb,MAAA,MAAM,GAAA,GAAM,QAAQ,KAAK,CAAA;AACzB,MAAA,IAAI,CAAC,OAAO,OAAO,GAAA,KAAQ,YAAY,CAAC,GAAA,CAAI,KAAK,CAAA,EAAG;AAChD,QAAA,MAAM,IAAI,yBAAyB,+CAA+C,CAAA;AAAA,MACtF;AAEA,MAAA,IAAI,SAAA;AACJ,MAAA,IAAI;AACA,QAAA,MAAM,QAAA,GAAWF,0BAAA,CAAsB,KAAA,CAAM,KAAK,CAAA;AAClD,QAAA,MAAM,QAAQ,QAAA,CAAS,GAAA;AACvB,QAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,iBAAA,CAAkB,QAAA,CAAS,KAAK,CAAA,EAAG;AACjE,UAAA,OAAO,aAAA,CAAc,CAAA,8BAAA,EAAiC,KAAK,CAAA,CAAE,CAAA;AAAA,QACjE;AACA,QAAA,SAAA,GAAY,MAAMG,cAAA,CAAU,GAAA,CAAI,KAAK,GAA8B,KAAK,CAAA;AAAA,MAC5E,SAAS,GAAA,EAAK;AACV,QAAA,IAAI,GAAA,YAAe,0BAA0B,MAAM,GAAA;AACnD,QAAA,MAAM,IAAI,yBAAyB,0CAA0C,CAAA;AAAA,MACjF;AAGA,MAAA,IAAI,SAAA;AACJ,MAAA,IAAI;AACA,QAAA,MAAM,QAAA,GAAW,MAAMD,cAAA,CAAU,KAAA,CAAM,OAAO,SAAA,EAAW;AAAA,UACrD,UAAA,EAAY,iBAAA;AAAA,UACZ,GAAI,QAAQ,QAAA,GAAW,EAAE,UAAU,OAAA,CAAQ,QAAA,KAAa;AAAC,SAC5D,CAAA;AACD,QAAA,SAAA,GAAY,QAAA,CAAS,OAAA;AAAA,MACzB,CAAA,CAAA,MAAQ;AACJ,QAAA,OAAO,cAAc,+CAA+C,CAAA;AAAA,MACxE;AAGA,MAAA,IAAI,SAAA,CAAU,OAAO,CAAA,KAAM,OAAA,CAAQ,KAAA,EAAO;AACtC,QAAA,OAAO,cAAc,sCAAsC,CAAA;AAAA,MAC/D;AAGA,MAAA,MAAM,cAAA,GAAiB,KAAA,CAAM,WAAA,CAAY,MAAA,GAAS,CAAA,GAAI,MAAM,WAAA,CAAY,IAAA,CAAK,GAAG,CAAA,GAAI,GAAA,GAAM,EAAA;AAC1F,MAAA,MAAM,YAAA,GAAe,KAAA,CAAM,GAAA,GAAM,GAAA,GAAM,cAAA;AACvC,MAAA,MAAM,WAAA,GAAc,MAAM,YAAA,CAAa,YAAuB,CAAA;AAC9D,MAAA,MAAM,cAAA,GAAiB,iBAAiB,WAAW,CAAA;AACnD,MAAA,IAAI,SAAA,CAAU,SAAS,CAAA,KAAM,cAAA,EAAgB;AACzC,QAAA,OAAO,cAAc,wCAAwC,CAAA;AAAA,MACjE;AAAA,IACJ;AAGA,IAAA,IAAI,cAAA;AACJ,IAAA,IAAI;AACA,MAAA,MAAM,OAAA,GAAU,MAAME,kBAAA,CAAY,OAAA,EAAS,YAAY,CAAA;AACvD,MAAA,cAAA,GAAiB,MAAMC,gBAAA;AAAA,QACnB,QAAQ,GAAA,CAAI,OAAA;AAAA,QACZ,OAAA,CAAQ,WAAA;AAAA,QACR;AAAA,OACJ;AAAA,IACJ,CAAA,CAAA,MAAQ;AACJ,MAAA,MAAM,IAAI,yBAAyB,qCAAqC,CAAA;AAAA,IAC5E;AAEA,IAAA,OAAO;AAAA,MACH,KAAA,EAAO,IAAA;AAAA,MACP,QAAQ,IAAA,CAAK,MAAA;AAAA,MACb,MAAA,EAAQ,sBAAsB,cAAc,CAAA;AAAA,MAC5C,MAAA,EAAQ;AAAA,KACZ;AAAA,EACJ;AACJ;ACjUA,IAAM,OAAA,GAAU,IAAIC,aAAA,CAAY,EAAE,eAAe,KAAA,EAAO,UAAA,EAAY,OAAO,CAAA;AAK3E,IAAM,UAAA,GAAa,CAAA;AAKnB,IAAM,cAAA,GAAiB,EAAA;AAEvB,IAAM,gBAAA,GAA2C;AAAA,EAC7C,CAAC,EAAE,GAAG,OAAA;AAAA,EACN,CAAC,GAAG,GAAG,OAAA;AAAA,EACP,CAAC,GAAG,GAAG;AACX,CAAA;AAYO,SAAS,gBAAgB,KAAA,EAA8B;AAC1D,EAAA,IAAI,KAAA,GAAiB,OAAA,CAAQ,MAAA,CAAO,KAAK,CAAA;AACzC,EAAA,IAAI,KAAA,YAAiBC,SAAA,IAAO,KAAA,CAAM,GAAA,KAAQ,EAAA,EAAI;AAE1C,IAAA,MAAM,WAAW,KAAA,CAAM,KAAA;AACvB,IAAA,KAAA,GAAQ,QAAA,YAAoB,UAAA,GAAa,OAAA,CAAQ,MAAA,CAAO,QAAQ,CAAA,GAAI,QAAA;AAAA,EACxE;AACA,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,IAAK,KAAA,CAAM,WAAW,CAAA,EAAG;AAC7C,IAAA,MAAM,IAAI,yBAAyB,6CAA6C,CAAA;AAAA,EACpF;AACA,EAAA,MAAM,CAAC,oBAAA,EAAsB,iBAAA,EAAmB,UAAA,EAAY,SAAS,CAAA,GAAI,KAAA;AACzE,EAAA,IAAI,EAAE,gCAAgC,UAAA,CAAA,EAAa;AAC/C,IAAA,MAAM,IAAI,yBAAyB,4CAA4C,CAAA;AAAA,EACnF;AACA,EAAA,IAAI,EAAE,6BAA6B,GAAA,CAAA,EAAM;AACrC,IAAA,MAAM,IAAI,yBAAyB,6CAA6C,CAAA;AAAA,EACpF;AACA,EAAA,IAAI,EAAE,qBAAqB,UAAA,CAAA,EAAa;AACpC,IAAA,MAAM,IAAI,yBAAyB,qCAAqC,CAAA;AAAA,EAC5E;AAEA,EAAA,IAAI,eAAA;AACJ,EAAA,IAAI;AACA,IAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,MAAA,CAAO,oBAAoB,CAAA;AACnD,IAAA,IAAI,EAAE,mBAAmB,GAAA,CAAA,EAAM;AAC3B,MAAA,MAAM,IAAI,MAAM,4BAA4B,CAAA;AAAA,IAChD;AACA,IAAA,eAAA,GAAkB,OAAA;AAAA,EACtB,CAAA,CAAA,MAAQ;AACJ,IAAA,MAAM,IAAI,yBAAyB,mDAAmD,CAAA;AAAA,EAC1F;AAEA,EAAA,MAAM,QAAA,GAAW,eAAA,CAAgB,GAAA,CAAI,UAAU,CAAA;AAC/C,EAAA,MAAM,MAAM,OAAO,QAAA,KAAa,QAAA,GAAW,gBAAA,CAAiB,QAAQ,CAAA,GAAI,MAAA;AACxE,EAAA,IAAI,CAAC,GAAA,EAAK;AACN,IAAA,MAAM,IAAI,wBAAA,CAAyB,CAAA,mCAAA,EAAsC,MAAA,CAAO,QAAQ,CAAC,CAAA,CAAE,CAAA;AAAA,EAC/F;AAGA,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI,sBAAsB,UAAA,EAAY;AAClC,IAAA,OAAA,GAAU,UAAA;AAAA,EACd,CAAA,MAAA,IAAW,sBAAsBA,SAAA,IAAO,UAAA,CAAW,QAAQ,EAAA,IAAM,UAAA,CAAW,iBAAiB,UAAA,EAAY;AACrG,IAAA,OAAA,GAAU,UAAA,CAAW,KAAA;AAAA,EACzB,CAAA,MAAO;AACH,IAAA,MAAM,IAAI,yBAAyB,0CAA0C,CAAA;AAAA,EACjF;AAGA,EAAA,MAAM,KAAA,GAAQ,iBAAA,CAAkB,GAAA,CAAI,cAAc,CAAA;AAClD,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI,UAAU,MAAA,EAAW;AACrB,IAAA,MAAM,IAAI,yBAAyB,6DAA6D,CAAA;AAAA,EACpG;AACA,EAAA,IAAI,iBAAiB,UAAA,EAAY;AAC7B,IAAA,OAAA,GAAU,CAAC,KAAK,CAAA;AAAA,EACpB,CAAA,MAAA,IAAW,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,IAAK,KAAA,CAAM,KAAA,CAAM,CAAC,CAAA,KAAM,CAAA,YAAa,UAAU,CAAA,EAAG;AAC5E,IAAA,OAAA,GAAU,KAAA;AAAA,EACd,CAAA,MAAO;AACH,IAAA,MAAM,IAAI,yBAAyB,oDAAoD,CAAA;AAAA,EAC3F;AAEA,EAAA,OAAO;AAAA,IACH,oBAAA;AAAA,IACA,eAAA;AAAA,IACA,iBAAA;AAAA,IACA,OAAA;AAAA,IACA,SAAA;AAAA,IACA,OAAA;AAAA,IACA;AAAA,GACJ;AACJ;AAEA,IAAM,WAAA,GAAsC;AAAA,EACxC,KAAA,EAAO,SAAA;AAAA,EACP,KAAA,EAAO,SAAA;AAAA,EACP,KAAA,EAAO;AACX,CAAA;AAMA,eAAsB,eAAA,CAClB,SAAA,EACA,SAAA,EACA,iBAAA,EACa;AACb,EAAA,IAAI,CAAC,iBAAA,CAAkB,QAAA,CAAS,SAAA,CAAU,GAAG,CAAA,EAAG;AAC5C,IAAA,MAAM,IAAI,wBAAA,CAAyB,CAAA,qBAAA,EAAwB,SAAA,CAAU,GAAG,CAAA,iBAAA,CAAmB,CAAA;AAAA,EAC/F;AACA,EAAA,MAAM,OAAA,GAAU,WAAA,CAAY,SAAA,CAAU,GAAG,CAAA;AACzC,EAAA,IAAI,CAAC,OAAA,EAAS;AACV,IAAA,MAAM,IAAI,wBAAA,CAAyB,CAAA,wBAAA,EAA2B,SAAA,CAAU,GAAG,CAAA,CAAE,CAAA;AAAA,EACjF;AAKA,EAAA,MAAM,YAAA,GAAe,CAAC,YAAA,EAAc,SAAA,CAAU,oBAAA,EAAsB,IAAI,UAAA,CAAW,CAAC,CAAA,EAAG,SAAA,CAAU,OAAO,CAAA;AACxG,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,MAAA,CAAO,YAAY,CAAA;AAG5C,EAAA,MAAM,EAAA,GAAK,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA;AAAA,IAC3B,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,OAAA,EAAQ;AAAA,IAC/B,SAAA;AAAA,IACA,IAAI,UAAA,CAAW,SAAA,CAAU,SAAS,CAAA;AAAA,IAClC;AAAA,GACJ;AACA,EAAA,IAAI,CAAC,EAAA,EAAI;AACL,IAAA,MAAM,IAAI,yBAAyB,0CAA0C,CAAA;AAAA,EACjF;AACJ;AC1IA,IAAMC,QAAAA,GAAU,IAAIF,aAAAA,CAAY,EAAE,eAAe,KAAA,EAAO,UAAA,EAAY,OAAO,CAAA;AAE3E,IAAM,oCAAoB,IAAI,GAAA,CAAI,CAAC,SAAA,EAAW,SAAA,EAAW,SAAS,CAAC,CAAA;AAEnE,eAAsB,iBAAA,CAAkB,WAAuB,eAAA,EAA8C;AACzG,EAAA,IAAI,CAAC,iBAAA,CAAkB,GAAA,CAAI,eAAe,CAAA,EAAG;AACzC,IAAA,MAAM,IAAI,wBAAA,CAAyB,CAAA,0BAAA,EAA6B,eAAe,CAAA,CAAE,CAAA;AAAA,EACrF;AAEA,EAAA,MAAM,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,OAAO,eAAA,EAAiB,IAAI,UAAA,CAAW,SAAS,CAAC,CAAA;AACjF,EAAA,OAAO,IAAI,WAAW,GAAG,CAAA;AAC7B;AAEA,SAASG,WAAAA,CAAW,GAAe,CAAA,EAAwB;AACvD,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,CAAE,MAAA,EAAQ,OAAO,KAAA;AAClC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,QAAQ,CAAA,EAAA,EAAK;AAC/B,IAAA,IAAI,EAAE,CAAC,CAAA,KAAM,CAAA,CAAE,CAAC,GAAG,OAAO,KAAA;AAAA,EAC9B;AACA,EAAA,OAAO,IAAA;AACX;AAWA,SAAS,cAAc,SAAA,EAA6C;AAChE,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI;AACA,IAAA,OAAA,GAAUD,QAAAA,CAAQ,OAAO,SAAS,CAAA;AAAA,EACtC,CAAA,CAAA,MAAQ;AACJ,IAAA,MAAM,IAAI,yBAAyB,wCAAwC,CAAA;AAAA,EAC/E;AAEA,EAAA,IAAI,KAAA;AACJ,EAAA,IAAI,mBAAmBD,SAAAA,IAAO,OAAA,CAAQ,QAAQ,EAAA,IAAM,OAAA,CAAQ,iBAAiB,UAAA,EAAY;AAErF,IAAA,KAAA,GAAQC,QAAAA,CAAQ,MAAA,CAAO,OAAA,CAAQ,KAAmB,CAAA;AAAA,EACtD,WACI,OAAA,KAAY,IAAA,IACZ,OAAO,OAAA,KAAY,QAAA,IACnB,EAAE,OAAA,YAAmBD,SAAAA,CAAAA,IACrB,EAAE,OAAA,YAAmB,GAAA,CAAA,IACrB,EAAE,OAAA,YAAmB,UAAA,CAAA,IACrB,WAAY,OAAA,IACX,OAAA,CAA+B,iBAAiB,UAAA,EACnD;AAEE,IAAA,KAAA,GAAQC,QAAAA,CAAQ,MAAA,CAAQ,OAAA,CAAkC,KAAK,CAAA;AAAA,EACnE,CAAA,MAAA,IAAW,mBAAmB,GAAA,EAAK;AAE/B,IAAA,KAAA,GAAQ,OAAA;AAAA,EACZ,CAAA,MAAO;AACH,IAAA,MAAM,IAAI,yBAAyB,oDAAoD,CAAA;AAAA,EAC3F;AAEA,EAAA,IAAI,EAAE,iBAAiB,GAAA,CAAA,EAAM;AACzB,IAAA,MAAM,IAAI,yBAAyB,uCAAuC,CAAA;AAAA,EAC9E;AACA,EAAA,OAAO,KAAA;AACX;AAUA,eAAsB,gBAAA,CAClB,YACA,GAAA,EACa;AACb,EAAA,KAAA,MAAW,CAAC,EAAA,EAAI,KAAK,CAAA,IAAK,UAAA,EAAY;AAClC,IAAA,MAAM,QAAA,GAAW,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,EAAE,CAAA;AACxC,IAAA,IAAI,CAAC,QAAA,EAAU;AACX,MAAA,MAAM,IAAI,wBAAA,CAAyB,CAAA,UAAA,EAAa,EAAE,CAAA,iCAAA,CAAmC,CAAA;AAAA,IACzF;AACA,IAAA,KAAA,MAAW,aAAa,KAAA,EAAO;AAE3B,MAAA,MAAM,IAAA,GAAO,MAAM,iBAAA,CAAkB,SAAA,EAAW,IAAI,eAAe,CAAA;AAGnE,MAAA,MAAM,IAAA,GAAO,cAAc,SAAS,CAAA;AACpC,MAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,CAAI,UAAU,CAAA;AACpC,MAAA,IAAI,OAAO,aAAa,QAAA,EAAU;AAC9B,QAAA,MAAM,IAAI,yBAAyB,mCAAmC,CAAA;AAAA,MAC1E;AAEA,MAAA,MAAM,cAAA,GAAiB,QAAA,CAAS,GAAA,CAAI,QAAQ,CAAA;AAC5C,MAAA,IAAI,CAAC,cAAA,EAAgB;AACjB,QAAA,MAAM,IAAI,wBAAA,CAAyB,CAAA,SAAA,EAAY,QAAQ,CAAA,+BAAA,EAAkC,EAAE,CAAA,CAAA,CAAG,CAAA;AAAA,MAClG;AACA,MAAA,IAAI,CAACC,WAAAA,CAAW,IAAA,EAAM,cAAc,CAAA,EAAG;AACnC,QAAA,MAAM,IAAI,wBAAA,CAAyB,CAAA,uBAAA,EAA0B,EAAE,CAAA,UAAA,EAAa,QAAQ,CAAA,CAAE,CAAA;AAAA,MAC1F;AAAA,IACJ;AAAA,EACJ;AACJ;ACzGA,IAAMD,QAAAA,GAAU,IAAIF,aAAAA,CAAY,EAAE,eAAe,KAAA,EAAO,UAAA,EAAY,OAAO,CAAA;AAe3E,SAAS,eAAe,KAAA,EAAsB;AAC1C,EAAA,IAAI,KAAA,YAAiB,MAAM,OAAO,KAAA;AAClC,EAAA,IAAI,iBAAiBC,SAAAA,EAAK;AAEtB,IAAA,IAAI,MAAM,GAAA,KAAQ,CAAA,IAAK,OAAO,KAAA,CAAM,UAAU,QAAA,EAAU;AACpD,MAAA,OAAO,IAAI,IAAA,CAAK,KAAA,CAAM,KAAK,CAAA;AAAA,IAC/B;AACA,IAAA,IAAI,MAAM,GAAA,KAAQ,CAAA,IAAK,OAAO,KAAA,CAAM,UAAU,QAAA,EAAU;AACpD,MAAA,OAAO,IAAI,IAAA,CAAK,KAAA,CAAM,KAAA,GAAQ,GAAI,CAAA;AAAA,IACtC;AACA,IAAA,IAAI,MAAM,GAAA,KAAQ,IAAA,IAAQ,OAAO,KAAA,CAAM,UAAU,QAAA,EAAU;AACvD,MAAA,OAAO,IAAI,IAAA,CAAK,KAAA,CAAM,KAAK,CAAA;AAAA,IAC/B;AAAA,EACJ;AACA,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC3B,IAAA,OAAO,IAAI,KAAK,KAAK,CAAA;AAAA,EACzB;AACA,EAAA,MAAM,IAAI,wBAAA,CAAyB,CAAA,kCAAA,EAAqC,OAAO,KAAK,CAAA,CAAE,CAAA;AAC1F;AAEO,SAAS,UAAU,OAAA,EAA2C;AACjE,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACA,IAAA,GAAA,GAAMC,QAAAA,CAAQ,OAAO,OAAO,CAAA;AAI5B,IAAA,IAAI,eAAeD,SAAAA,IAAO,GAAA,CAAI,QAAQ,EAAA,IAAM,GAAA,CAAI,iBAAiB,UAAA,EAAY;AACzE,MAAA,GAAA,GAAMC,QAAAA,CAAQ,MAAA,CAAO,GAAA,CAAI,KAAK,CAAA;AAAA,IAClC,WACI,GAAA,KAAQ,IAAA,IACR,OAAO,GAAA,KAAQ,QAAA,IACf,EAAE,GAAA,YAAeD,SAAAA,CAAAA,IACjB,EAAE,GAAA,YAAe,GAAA,CAAA,IACjB,EAAE,GAAA,YAAe,UAAA,CAAA,IACjB,WAAY,GAAA,IACX,GAAA,CAA2B,iBAAiB,UAAA,EAC/C;AAME,MAAA,GAAA,GAAMC,QAAAA,CAAQ,MAAA,CAAQ,GAAA,CAA8B,KAAK,CAAA;AAAA,IAC7D;AAAA,EACJ,SAAS,GAAA,EAAK;AACV,IAAA,IAAI,GAAA,YAAe,0BAA0B,MAAM,GAAA;AACnD,IAAA,MAAM,IAAI,yBAAyB,mCAAmC,CAAA;AAAA,EAC1E;AACA,EAAA,IAAI,EAAE,eAAe,GAAA,CAAA,EAAM;AACvB,IAAA,MAAM,IAAI,yBAAyB,wBAAwB,CAAA;AAAA,EAC/D;AACA,EAAA,MAAM,CAAA,GAAI,GAAA;AAEV,EAAA,MAAM,OAAA,GAAU,CAAA,CAAE,GAAA,CAAI,SAAS,CAAA;AAC/B,EAAA,IAAI,OAAO,YAAY,QAAA,EAAU;AAC7B,IAAA,MAAM,IAAI,yBAAyB,8BAA8B,CAAA;AAAA,EACrE;AACA,EAAA,MAAM,eAAA,GAAkB,CAAA,CAAE,GAAA,CAAI,iBAAiB,CAAA;AAC/C,EAAA,IAAI,OAAO,oBAAoB,QAAA,EAAU;AACrC,IAAA,MAAM,IAAI,yBAAyB,sCAAsC,CAAA;AAAA,EAC7E;AACA,EAAA,MAAM,OAAA,GAAU,CAAA,CAAE,GAAA,CAAI,SAAS,CAAA;AAC/B,EAAA,IAAI,OAAO,YAAY,QAAA,EAAU;AAC7B,IAAA,MAAM,IAAI,yBAAyB,8BAA8B,CAAA;AAAA,EACrE;AAEA,EAAA,MAAM,KAAA,GAAQ,CAAA,CAAE,GAAA,CAAI,cAAc,CAAA;AAClC,EAAA,IAAI,EAAE,iBAAiB,GAAA,CAAA,EAAM;AACzB,IAAA,MAAM,IAAI,yBAAyB,gCAAgC,CAAA;AAAA,EACvE;AACA,EAAA,MAAM,YAAA,uBAAmB,GAAA,EAAqC;AAC9D,EAAA,KAAA,MAAW,CAAC,EAAA,EAAI,KAAK,CAAA,IAAK,KAAA,CAAM,SAAQ,EAAG;AACvC,IAAA,IAAI,OAAO,EAAA,KAAO,QAAA,IAAY,EAAE,iBAAiB,GAAA,CAAA,EAAM;AACnD,MAAA,MAAM,IAAI,yBAAyB,kCAAkC,CAAA;AAAA,IACzE;AACA,IAAA,MAAM,KAAA,uBAAY,GAAA,EAAwB;AAC1C,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,MAAM,CAAA,IAAM,KAAA,CAAgC,SAAQ,EAAG;AACnE,MAAA,IAAI,OAAO,EAAA,KAAO,QAAA,IAAY,EAAE,kBAAkB,UAAA,CAAA,EAAa;AAC3D,QAAA,MAAM,IAAI,yBAAyB,4CAAuC,CAAA;AAAA,MAC9E;AACA,MAAA,KAAA,CAAM,GAAA,CAAI,IAAI,MAAM,CAAA;AAAA,IACxB;AACA,IAAA,YAAA,CAAa,GAAA,CAAI,IAAI,KAAK,CAAA;AAAA,EAC9B;AAEA,EAAA,MAAM,KAAA,GAAQ,CAAA,CAAE,GAAA,CAAI,cAAc,CAAA;AAClC,EAAA,IAAI,EAAE,iBAAiB,GAAA,CAAA,EAAM;AACzB,IAAA,MAAM,IAAI,yBAAyB,gCAAgC,CAAA;AAAA,EACvE;AACA,EAAA,MAAM,EAAA,GAAK,KAAA;AACX,EAAA,MAAM,YAAA,GAAqD;AAAA,IACvD,MAAA,EAAQ,cAAA,CAAe,EAAA,CAAG,GAAA,CAAI,QAAQ,CAAC,CAAA;AAAA,IACvC,SAAA,EAAW,cAAA,CAAe,EAAA,CAAG,GAAA,CAAI,WAAW,CAAC,CAAA;AAAA,IAC7C,UAAA,EAAY,cAAA,CAAe,EAAA,CAAG,GAAA,CAAI,YAAY,CAAC;AAAA,GACnD;AACA,EAAA,IAAI,EAAA,CAAG,GAAA,CAAI,gBAAgB,CAAA,EAAG;AAC1B,IAAA,YAAA,CAAa,cAAA,GAAiB,cAAA,CAAe,EAAA,CAAG,GAAA,CAAI,gBAAgB,CAAC,CAAA;AAAA,EACzE;AAEA,EAAA,OAAO,EAAE,OAAA,EAAS,eAAA,EAAiB,YAAA,EAAc,SAAS,YAAA,EAAa;AAC3E;AAWO,SAAS,mBAAA,CAAoB,KAA2B,GAAA,EAAiB;AAC5E,EAAA,MAAM,EAAE,MAAA,EAAQ,SAAA,EAAW,UAAA,KAAe,GAAA,CAAI,YAAA;AAC9C,EAAA,IAAI,MAAA,CAAO,OAAA,EAAQ,GAAI,GAAA,CAAI,SAAQ,EAAG;AAClC,IAAA,MAAM,IAAI,wBAAA,CAAyB,CAAA,WAAA,EAAc,MAAA,CAAO,WAAA,EAAa,CAAA,iBAAA,CAAmB,CAAA;AAAA,EAC5F;AACA,EAAA,IAAI,SAAA,CAAU,OAAA,EAAQ,GAAI,GAAA,CAAI,SAAQ,EAAG;AACrC,IAAA,MAAM,IAAI,wBAAA,CAAyB,CAAA,cAAA,EAAiB,SAAA,CAAU,WAAA,EAAa,CAAA,iBAAA,CAAmB,CAAA;AAAA,EAClG;AACA,EAAA,IAAI,SAAA,CAAU,OAAA,EAAQ,GAAI,UAAA,CAAW,SAAQ,EAAG;AAC5C,IAAA,MAAM,IAAI,yBAAyB,mCAAmC,CAAA;AAAA,EAC1E;AACA,EAAA,IAAI,MAAA,CAAO,OAAA,EAAQ,GAAI,SAAA,CAAU,OAAA,EAAQ,IAAK,MAAA,CAAO,OAAA,EAAQ,GAAI,UAAA,CAAW,OAAA,EAAQ,EAAG;AACnF,IAAA,MAAM,IAAI,yBAAyB,2CAA2C,CAAA;AAAA,EAClF;AACA,EAAA,IAAI,UAAA,CAAW,OAAA,EAAQ,GAAI,GAAA,CAAI,SAAQ,EAAG;AACtC,IAAA,MAAM,IAAI,sBAAA,CAAuB,CAAA,eAAA,EAAkB,UAAA,CAAW,WAAA,EAAa,CAAA,eAAA,CAAiB,CAAA;AAAA,EAChG;AACJ;AAMO,SAAS,kBAAA,CAAmB,KAA2B,eAAA,EAA+B;AACzF,EAAA,IAAI,GAAA,CAAI,YAAY,eAAA,EAAiB;AACjC,IAAA,MAAM,IAAI,wBAAA,CAAyB,CAAA,YAAA,EAAe,IAAI,OAAO,CAAA,yBAAA,EAA4B,eAAe,CAAA,CAAE,CAAA;AAAA,EAC9G;AACJ;;;AClJA,IAAMA,QAAAA,GAAU,IAAIF,aAAAA,CAAY,EAAE,eAAe,KAAA,EAAO,UAAA,EAAY,OAAO,CAAA;AAC3E,IAAM,OAAA,GAAU,IAAIA,aAAAA,CAAY,EAAE,eAAe,KAAA,EAAO,UAAA,EAAY,OAAO,CAAA;AAE3E,IAAMI,2BAAAA,GAA6B,CAAC,OAAA,EAAS,OAAA,EAAS,OAAO,CAAA;AAE7D,SAASD,WAAAA,CAAW,GAAe,CAAA,EAAwB;AACvD,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,CAAE,MAAA,EAAQ,OAAO,KAAA;AAClC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,QAAQ,CAAA,EAAA,EAAK;AAC/B,IAAA,IAAI,EAAE,CAAC,CAAA,KAAM,CAAA,CAAE,CAAC,GAAG,OAAO,KAAA;AAAA,EAC9B;AACA,EAAA,OAAO,IAAA;AACX;AAEA,SAASE,UAAS,GAAA,EAAyB;AACvC,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,KAAA,MAAW,CAAA,IAAK,GAAA,EAAK,MAAA,IAAU,MAAA,CAAO,aAAa,CAAC,CAAA;AACpD,EAAA,MAAM,GAAA,GAAM,UAAA,CAAW,IAAA,CAAK,MAAM,CAAA;AAClC,EAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,KAAA,CAAM,UAAU,KAAK,EAAC;AACxC,EAAA,OAAO,CAAA;AAAA,EAAgC,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC;AAAA,yBAAA,CAAA;AAC3D;AAEA,SAAS,2BAA2B,QAAA,EAA8B;AAE9D,EAAA,OAAO,EAAA;AACX;AAgBA,SAAS,oBAAoB,IAAA,EAA2B;AACpD,EAAA,IAAI,gBAAgBJ,SAAAA,IAAO,IAAA,CAAK,QAAQ,EAAA,IAAM,IAAA,CAAK,iBAAiB,UAAA,EAAY;AAC5E,IAAA,OAAO,IAAA,CAAK,KAAA;AAAA,EAChB;AACA,EAAA,IAAI,gBAAgB,UAAA,EAAY;AAC5B,IAAA,OAAO,IAAA;AAAA,EACX;AACA,EAAA,IACI,IAAA,KAAS,IAAA,IACT,OAAO,IAAA,KAAS,YAChB,EAAE,IAAA,YAAgBA,SAAAA,CAAAA,IAClB,EAAE,gBAAgB,GAAA,CAAA,IAClB,OAAA,IAAY,IAAA,IACX,IAAA,CAA4B,iBAAiB,UAAA,EAChD;AACE,IAAA,OAAQ,IAAA,CAA+B,KAAA;AAAA,EAC3C;AACA,EAAA,MAAM,IAAI,yBAAyB,+CAA+C,CAAA;AACtF;AAOA,SAAS,eAAe,UAAA,EAAyD;AAC7E,EAAA,MAAM,MAAwB,EAAC;AAC/B,EAAA,KAAA,MAAW,KAAA,IAAS,UAAA,CAAW,MAAA,EAAO,EAAG;AACrC,IAAA,KAAA,MAAW,aAAa,KAAA,EAAO;AAC3B,MAAA,IAAI,OAAA;AACJ,MAAA,IAAI;AACA,QAAA,OAAA,GAAUC,QAAAA,CAAQ,OAAO,SAAS,CAAA;AAAA,MACtC,CAAA,CAAA,MAAQ;AACJ,QAAA;AAAA,MACJ;AAGA,MAAA,IAAI,KAAA;AACJ,MAAA,IAAI,mBAAmBD,SAAAA,IAAO,OAAA,CAAQ,QAAQ,EAAA,IAAM,OAAA,CAAQ,iBAAiB,UAAA,EAAY;AAErF,QAAA,KAAA,GAAQC,QAAAA,CAAQ,MAAA,CAAO,OAAA,CAAQ,KAAmB,CAAA;AAAA,MACtD,WACI,OAAA,KAAY,IAAA,IACZ,OAAO,OAAA,KAAY,QAAA,IACnB,EAAE,OAAA,YAAmBD,SAAAA,CAAAA,IACrB,EAAE,OAAA,YAAmB,GAAA,CAAA,IACrB,EAAE,OAAA,YAAmB,UAAA,CAAA,IACrB,WAAY,OAAA,IACX,OAAA,CAA+B,iBAAiB,UAAA,EACnD;AAEE,QAAA,KAAA,GAAQC,QAAAA,CAAQ,MAAA,CAAQ,OAAA,CAAkC,KAAK,CAAA;AAAA,MACnE,CAAA,MAAA,IAAW,mBAAmB,GAAA,EAAK;AAE/B,QAAA,KAAA,GAAQ,OAAA;AAAA,MACZ,CAAA,MAAO;AACH,QAAA;AAAA,MACJ;AAEA,MAAA,IAAI,iBAAiB,GAAA,EAAK;AACtB,QAAA,MAAM,EAAA,GAAM,KAAA,CAA+B,GAAA,CAAI,mBAAmB,CAAA;AAClE,QAAA,MAAM,GAAA,GAAO,KAAA,CAA+B,GAAA,CAAI,cAAc,CAAA;AAC9D,QAAA,IAAI,OAAO,OAAO,QAAA,EAAU;AACxB,UAAC,GAAA,CAAgC,EAAE,CAAA,GAAI,GAAA;AAAA,QAC3C;AAAA,MACJ;AAAA,IACJ;AAAA,EACJ;AACA,EAAA,OAAO,GAAA;AACX;AAaO,IAAM,aAAN,MAA8C;AAAA,EACxC,MAAA,GAA2B,MAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOpC,SAAS,OAAA,EAA2B;AAChC,IAAA,OAAO,OAAA,YAAmB,UAAA;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,KAAA,CAAM,OAAA,EAAkB,OAAA,EAAoD;AAC9E,IAAA,IAAI,EAAE,mBAAmB,UAAA,CAAA,EAAa;AAClC,MAAA,MAAM,IAAI,yBAAyB,mCAAmC,CAAA;AAAA,IAC1E;AACA,IAAA,MAAM,iBAAA,GAAoB,QAAQ,iBAAA,IAAqBE,2BAAAA;AAGvD,IAAA,IAAI,cAAA;AACJ,IAAA,IAAI;AACA,MAAA,MAAM,OAAA,GAAUF,QAAAA,CAAQ,MAAA,CAAO,OAAO,CAAA;AACtC,MAAA,IAAI,EAAE,OAAA,YAAmB,GAAA,CAAA,EAAM,MAAM,IAAI,KAAA,EAAM;AAC/C,MAAA,cAAA,GAAiB,OAAA;AAAA,IACrB,CAAA,CAAA,MAAQ;AACJ,MAAA,MAAM,IAAI,yBAAyB,0CAA0C,CAAA;AAAA,IACjF;AAGA,IAAA,MAAM,IAAA,GAAO,cAAA,CAAe,GAAA,CAAI,WAAW,CAAA;AAC3C,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,IAAK,IAAA,CAAK,WAAW,CAAA,EAAG;AAC3C,MAAA,MAAM,IAAI,yBAAyB,iCAAiC,CAAA;AAAA,IACxE;AACA,IAAA,MAAM,QAAA,GAAW,KAAK,CAAC,CAAA;AACvB,IAAA,IAAI,EAAE,oBAAoB,GAAA,CAAA,EAAM;AAC5B,MAAA,MAAM,IAAI,yBAAyB,wBAAwB,CAAA;AAAA,IAC/D;AACA,IAAA,MAAM,YAAA,GAAe,QAAA,CAAS,GAAA,CAAI,cAAc,CAAA;AAChD,IAAA,IAAI,EAAE,wBAAwB,GAAA,CAAA,EAAM;AAChC,MAAA,MAAM,IAAI,yBAAyB,qCAAqC,CAAA;AAAA,IAC5E;AACA,IAAA,MAAM,UAAA,GAAa,YAAA,CAAa,GAAA,CAAI,YAAY,CAAA;AAChD,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,UAAU,CAAA,EAAG;AAC5B,MAAA,MAAM,IAAI,yBAAyB,uCAAuC,CAAA;AAAA,IAC9E;AAGA,IAAA,MAAM,eAAA,GAAkB,OAAA,CAAQ,MAAA,CAAO,UAAU,CAAA;AAGjD,IAAA,MAAM,IAAA,GAAO,gBAAgB,eAAe,CAAA;AAC5C,IAAA,IAAI,CAAC,iBAAA,CAAkB,QAAA,CAAS,IAAA,CAAK,GAAG,CAAA,EAAG;AACvC,MAAA,OAAO;AAAA,QACH,KAAA,EAAO,KAAA;AAAA,QACP,QAAQ,IAAA,CAAK,MAAA;AAAA,QACb,QAAQ,EAAC;AAAA,QACT,QAAQ,EAAE,WAAA,EAAa,IAAI,UAAA,EAAW,EAAG,SAAS,EAAA,EAAG;AAAA,QACrD,KAAA,EAAO,CAAA,uBAAA,EAA0B,IAAA,CAAK,GAAG,CAAA;AAAA,OAC7C;AAAA,IACJ;AAGA,IAAA,MAAM,eAAA,GAAkB,IAAA,CAAK,OAAA,CAAQ,CAAC,CAAA;AACtC,IAAA,IAAI,CAAC,eAAA,EAAiB;AAClB,MAAA,MAAM,IAAI,yBAAyB,uCAAuC,CAAA;AAAA,IAC9E;AACA,IAAA,IAAI,OAAA,CAAQ,mBAAA,CAAoB,MAAA,KAAW,CAAA,EAAG;AAC1C,MAAA,IAAI,OAAA,CAAQ,mBAAmB,IAAA,EAAM;AACjC,QAAA,MAAM,IAAI,wBAAA;AAAA,UACN;AAAA,SACJ;AAAA,MACJ;AAAA,IACJ,CAAA,MAAO;AACH,MAAA,MAAM,OAAA,GAAU,QAAQ,mBAAA,CAAoB,IAAA,CAAK,CAAC,CAAA,KAAMC,WAAAA,CAAW,CAAA,EAAG,eAAe,CAAC,CAAA;AACtF,MAAA,IAAI,CAAC,OAAA,EAAS;AACV,QAAA,OAAO;AAAA,UACH,KAAA,EAAO,KAAA;AAAA,UACP,QAAQ,IAAA,CAAK,MAAA;AAAA,UACb,QAAQ,EAAC;AAAA,UACT,MAAA,EAAQ,EAAE,WAAA,EAAa,eAAA,EAAiB,SAAS,EAAA,EAAG;AAAA,UACpD,KAAA,EAAO;AAAA,SACX;AAAA,MACJ;AAAA,IACJ;AAGA,IAAA,MAAM,YAAY,MAAMR,eAAAA,CAAWU,UAAS,eAAe,CAAA,EAAG,KAAK,GAAG,CAAA;AACtE,IAAA,IAAI;AACA,MAAA,MAAM,eAAA,CAAgB,IAAA,EAAM,SAAA,EAAW,iBAAiB,CAAA;AAAA,IAC5D,SAAS,GAAA,EAAK;AACV,MAAA,IAAI,eAAe,wBAAA,EAA0B;AACzC,QAAA,OAAO;AAAA,UACH,KAAA,EAAO,KAAA;AAAA,UACP,QAAQ,IAAA,CAAK,MAAA;AAAA,UACb,QAAQ,EAAC;AAAA,UACT,MAAA,EAAQ,EAAE,WAAA,EAAa,eAAA,EAAiB,SAAS,EAAA,EAAG;AAAA,UACpD,OAAO,GAAA,CAAI;AAAA,SACf;AAAA,MACJ;AACA,MAAA,MAAM,GAAA;AAAA,IACV;AAGA,IAAA,MAAM,GAAA,GAAM,SAAA,CAAU,IAAA,CAAK,OAAO,CAAA;AAClC,IAAA,IAAI;AACA,MAAA,mBAAA,CAAoB,GAAA,kBAAK,IAAI,IAAA,EAAM,CAAA;AAAA,IACvC,SAAS,GAAA,EAAK;AACV,MAAA,IAAI,eAAe,sBAAA,EAAwB;AACvC,QAAA,OAAO;AAAA,UACH,KAAA,EAAO,KAAA;AAAA,UACP,QAAQ,IAAA,CAAK,MAAA;AAAA,UACb,QAAQ,EAAC;AAAA,UACT,MAAA,EAAQ,EAAE,WAAA,EAAa,eAAA,EAAiB,SAAS,EAAA,EAAG;AAAA,UACpD,KAAA,EAAO;AAAA,SACX;AAAA,MACJ;AACA,MAAA,MAAM,GAAA;AAAA,IACV;AAEA,IAAA,IAAI,OAAA,CAAQ,oBAAoB,MAAA,EAAW;AACvC,MAAA,IAAI;AACA,QAAA,kBAAA,CAAmB,GAAA,EAAK,QAAQ,eAAe,CAAA;AAAA,MACnD,SAAS,GAAA,EAAK;AACV,QAAA,IAAI,eAAe,wBAAA,EAA0B;AACzC,UAAA,OAAO;AAAA,YACH,KAAA,EAAO,KAAA;AAAA,YACP,QAAQ,IAAA,CAAK,MAAA;AAAA,YACb,QAAQ,EAAC;AAAA,YACT,MAAA,EAAQ,EAAE,WAAA,EAAa,eAAA,EAAiB,SAAS,EAAA,EAAG;AAAA,YACpD,OAAO,GAAA,CAAI;AAAA,WACf;AAAA,QACJ;AACA,QAAA,MAAM,GAAA;AAAA,MACV;AAAA,IACJ;AAGA,IAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,GAAA,CAAI,YAAY,CAAA;AAC3C,IAAA,IAAI,EAAE,iBAAiB,GAAA,CAAA,EAAM;AACzB,MAAA,MAAM,IAAI,yBAAyB,uCAAuC,CAAA;AAAA,IAC9E;AACA,IAAA,MAAM,UAAA,uBAAiB,GAAA,EAA0B;AACjD,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,KAAK,CAAA,IAAM,KAAA,CAAgC,SAAQ,EAAG;AAClE,MAAA,IAAI,OAAO,EAAA,KAAO,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACjD,QAAA,MAAM,IAAI,yBAAyB,4BAA4B,CAAA;AAAA,MACnE;AACA,MAAA,UAAA,CAAW,GAAA,CAAI,EAAA,EAAI,KAAA,CAAM,GAAA,CAAI,mBAAmB,CAAC,CAAA;AAAA,IACrD;AACA,IAAA,MAAM,gBAAA,CAAiB,YAAY,GAAG,CAAA;AAGtC,IAAA,MAAM,MAAA,GAAS,eAAe,UAAU,CAAA;AAExC,IAAA,MAAM,MAAA,GAAqB;AAAA,MACvB,WAAA,EAAa,eAAA;AAAA,MACb,OAAA,EAAS,2BAA0C;AAAA,KACvD;AACA,IAAA,OAAO,EAAE,KAAA,EAAO,IAAA,EAAM,QAAQ,IAAA,CAAK,MAAA,EAAQ,QAAQ,MAAA,EAAO;AAAA,EAC9D;AACJ;ACxSO,SAAS,2BAA2B,KAAA,EAAwD;AAC/F,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,IAASC,OAAA,EAAO;AAEpC,EAAA,MAAM,sBAAA,GAAyB;AAAA,IAC3B,IAAIA,OAAA,EAAO;AAAA,IACX,mBAAmB,KAAA,CAAM,mBAAA,CAAoB,GAAA,CAAI,CAAC,MAAM,KAAA,MAAW;AAAA,MAC/D,EAAA,EAAI,cAAc,KAAK,CAAA,CAAA;AAAA,MACvB,QAAQ,MAAA,CAAO,WAAA;AAAA,QACX,KAAA,CAAM,eAAA,CAAgB,GAAA,CAAI,CAAC,GAAA,KAAQ;AAC/B,UAAA,IAAI,GAAA,KAAQ,WAAA,EAAa,OAAO,CAAC,WAAA,EAAa,EAAE,mBAAA,EAAqB,CAAC,OAAO,CAAA,EAAG,CAAA;AAChF,UAAA,OAAO,CAAC,UAAA,EAAY,EAAE,KAAK,CAAC,OAAO,GAAG,CAAA;AAAA,QAC1C,CAAC;AAAA,OACL;AAAA,MACA,WAAA,EAAa;AAAA,QACT,MAAA,EAAQ;AAAA,UACJ;AAAA,YACI,MAAM,CAAC,CAAA,EAAA,EAAK,IAAI,CAAA,CAAA,EAAI,CAAA,GAAA,EAAM,IAAI,CAAA,EAAA,CAAI,CAAA;AAAA,YAClC,MAAA,EAAQ,EAAE,IAAA,EAAM,IAAA,CAAK,WAAW,UAAU,CAAA,GAAI,YAAY,QAAA;AAAS;AACvE;AACJ;AACJ,KACJ,CAAE;AAAA,GACN;AAEA,EAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB;AAAA,IAC/B,aAAA,EAAe,UAAA;AAAA,IACf,aAAA,EAAe,aAAA;AAAA,IACf,cAAc,KAAA,CAAM,WAAA;AAAA,IACpB,WAAW,KAAA,CAAM,QAAA;AAAA,IACjB,OAAO,KAAA,CAAM,KAAA;AAAA,IACb,KAAA;AAAA,IACA,uBAAA,EAAyB,IAAA,CAAK,SAAA,CAAU,sBAAsB;AAAA,GACjE,CAAA;AAED,EAAA,OAAO;AAAA,IACH,GAAA,EAAK,CAAA,sBAAA,EAAyB,MAAA,CAAO,QAAA,EAAU,CAAA,CAAA;AAAA,IAC/C,sBAAA;AAAA,IACA,OAAO,KAAA,CAAM,KAAA;AAAA,IACb;AAAA,GACJ;AACJ;;;ACvCA,IAAM,UAA+B,CAAC,IAAI,aAAY,EAAG,IAAI,YAAY,CAAA;AAEzE,eAAsB,iBAAA,CAAkB,SAAkB,OAAA,EAAoD;AAC1G,EAAA,KAAA,MAAW,UAAU,OAAA,EAAS;AAC1B,IAAA,IAAI,MAAA,CAAO,QAAA,CAAS,OAAO,CAAA,EAAG;AAC1B,MAAA,OAAO,MAAA,CAAO,KAAA,CAAM,OAAA,EAAS,OAAO,CAAA;AAAA,IACxC;AAAA,EACJ;AAEA,EAAA,OAAO;AAAA,IACH,KAAA,EAAO,KAAA;AAAA,IACP,MAAA,EAAQ,WAAA;AAAA,IACR,QAAQ,EAAC;AAAA,IACT,QAAQ,EAAE,WAAA,EAAa,IAAI,UAAA,EAAW,EAAG,SAAS,EAAA,EAAG;AAAA,IACrD,KAAA,EAAO;AAAA,GACX;AACJ;;;ACrBO,IAAM,OAAA,GAAU","file":"index.cjs","sourcesContent":["export class InvalidSignatureError extends Error {\n    constructor(message = 'Credential signature validation failed') {\n        super(message);\n        this.name = 'InvalidSignatureError';\n        Object.setPrototypeOf(this, new.target.prototype);\n    }\n}\n\nexport class ExpiredCredentialError extends Error {\n    constructor(message = 'Credential has expired') {\n        super(message);\n        this.name = 'ExpiredCredentialError';\n        Object.setPrototypeOf(this, new.target.prototype);\n    }\n}\n\nexport class UnsupportedFormatError extends Error {\n    constructor(format: string) {\n        super(`Unsupported credential format: ${format}`);\n        this.name = 'UnsupportedFormatError';\n        Object.setPrototypeOf(this, new.target.prototype);\n    }\n}\n\nexport class MalformedCredentialError extends Error {\n    constructor(message = 'Credential structure is malformed') {\n        super(message);\n        this.name = 'MalformedCredentialError';\n        Object.setPrototypeOf(this, new.target.prototype);\n    }\n}\n\nexport class NonceValidationError extends Error {\n    constructor(message = 'Nonce does not match expected value') {\n        super(message);\n        this.name = 'NonceValidationError';\n        Object.setPrototypeOf(this, new.target.prototype);\n    }\n}\n","import { splitSdJwt, decodeSdJwt, getClaims } from '@sd-jwt/decode';\nimport { decodeProtectedHeader, jwtVerify, importX509, importJWK } from 'jose';\n\nimport { MalformedCredentialError } from '../errors.js';\nimport type { IssuerInfo } from '../types/issuer.js';\nimport type { CredentialFormat, CredentialClaims, PresentationResult } from '../types/presentation.js';\n\nimport type { ICredentialParser, ParseOptions } from './parser.interface.js';\n\n/**\n * Hasher function signature expected by @sd-jwt/decode.\n * Inlined here to avoid a direct dependency on @sd-jwt/types.\n */\ntype SdJwtHasher = (data: string | ArrayBuffer, alg: string) => Promise<Uint8Array>;\n\nconst DEFAULT_ALLOWED_ALGORITHMS = ['ES256', 'ES384', 'ES512'];\n\n/**\n * SHA-256 hasher implementation using the Web Crypto API.\n * Compatible with the @sd-jwt/decode Hasher signature.\n */\nconst sha256Hasher: SdJwtHasher = async (data: string | ArrayBuffer, _alg: string): Promise<Uint8Array> => {\n    const encoder = new TextEncoder();\n    const input = typeof data === 'string' ? encoder.encode(data) : data;\n    const hashBuffer = await crypto.subtle.digest('SHA-256', input);\n    return new Uint8Array(hashBuffer);\n};\n\n// Standard base64 alphabet for decoding x5c certificate entries\nconst BASE64_CHARS = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';\n\n/**\n * Decodes a standard base64-encoded string into raw bytes.\n * Does not depend on Node.js Buffer or browser atob.\n */\nfunction base64ToBytes(base64: string): Uint8Array<ArrayBuffer> {\n    const cleaned = base64.replace(/=+$/, '');\n    const byteLength = Math.floor((cleaned.length * 3) / 4);\n    const buffer = new ArrayBuffer(byteLength);\n    const bytes = new Uint8Array(buffer);\n\n    let byteIndex = 0;\n    for (let i = 0; i < cleaned.length; i += 4) {\n        const a = BASE64_CHARS.indexOf(cleaned[i]);\n        const b = i + 1 < cleaned.length ? BASE64_CHARS.indexOf(cleaned[i + 1]) : 0;\n        const c = i + 2 < cleaned.length ? BASE64_CHARS.indexOf(cleaned[i + 2]) : 0;\n        const d = i + 3 < cleaned.length ? BASE64_CHARS.indexOf(cleaned[i + 3]) : 0;\n\n        bytes[byteIndex++] = (a << 2) | (b >> 4);\n        if (byteIndex < byteLength) bytes[byteIndex++] = ((b & 0x0f) << 4) | (c >> 2);\n        if (byteIndex < byteLength) bytes[byteIndex++] = ((c & 0x03) << 6) | d;\n    }\n\n    return bytes;\n}\n\n/**\n * Checks whether two Uint8Array instances contain identical bytes.\n */\nfunction bytesEqual(a: Uint8Array, b: Uint8Array): boolean {\n    if (a.length !== b.length) return false;\n    for (let i = 0; i < a.length; i++) {\n        if (a[i] !== b[i]) return false;\n    }\n    return true;\n}\n\n/**\n * Converts a base64-encoded DER certificate to PEM format for jose.importX509.\n */\nfunction derToPem(base64Der: string): string {\n    const lines = base64Der.match(/.{1,64}/g) || [];\n    return `-----BEGIN CERTIFICATE-----\\n${lines.join('\\n')}\\n-----END CERTIFICATE-----`;\n}\n\n/**\n * Encodes a Uint8Array to base64url (no padding).\n * Used by disclosure hash verification (Task 5) and KB-JWT verification (Task 6).\n */\nfunction bytesToBase64url(bytes: Uint8Array): string {\n    let binary = '';\n    for (const byte of bytes) {\n        binary += String.fromCharCode(byte);\n    }\n    return globalThis.btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n}\n\n/**\n * Maps raw decoded claims to the CredentialClaims structure,\n * picking known age/residency fields and preserving any extra keys.\n */\nfunction mapToCredentialClaims(raw: Record<string, unknown>): CredentialClaims {\n    const claims: CredentialClaims = {};\n\n    if (typeof raw['age_over_18'] === 'boolean') {\n        claims.age_over_18 = raw['age_over_18'];\n    }\n    if (typeof raw['age_over_21'] === 'boolean') {\n        claims.age_over_21 = raw['age_over_21'];\n    }\n    if (typeof raw['resident_country'] === 'string') {\n        claims.resident_country = raw['resident_country'];\n    }\n    if (typeof raw['nationality'] === 'string') {\n        claims.nationality = raw['nationality'];\n    }\n    if (typeof raw['family_name_birth'] === 'string') {\n        claims.family_name_birth = raw['family_name_birth'];\n    }\n\n    for (const [key, value] of Object.entries(raw)) {\n        if (\n            !(key in claims) &&\n            !key.startsWith('_sd') &&\n            key !== 'iss' &&\n            key !== 'exp' &&\n            key !== 'iat' &&\n            key !== 'cnf' &&\n            key !== 'vct'\n        ) {\n            claims[key] = value;\n        }\n    }\n\n    return claims;\n}\n\n/**\n * Best-effort extraction of a country code hint from an issuer URL or string.\n */\nfunction extractCountryHint(issuer: string): string {\n    try {\n        const url = new URL(issuer);\n        const tld = url.hostname.split('.').pop()?.toUpperCase();\n        if (tld && tld.length === 2) {\n            return tld;\n        }\n    } catch {\n        // Not a valid URL\n    }\n    return '';\n}\n\n/**\n * SD-JWT VC credential parser.\n *\n * Decodes and cryptographically validates SD-JWT Verifiable Credentials:\n *   - JWT signature verification via x5c public key (jose)\n *   - Issuer certificate trust chain verification\n *   - Disclosure hash integrity verification\n *   - Key binding JWT signature and sd_hash verification\n *   - Selective disclosure claim extraction\n */\nexport class SdJwtParser implements ICredentialParser {\n    readonly format: CredentialFormat = 'sd-jwt-vc';\n\n    canParse(vpToken: unknown): boolean {\n        return typeof vpToken === 'string' && vpToken.includes('~');\n    }\n\n    async parse(vpToken: unknown, options: ParseOptions): Promise<PresentationResult> {\n        if (typeof vpToken !== 'string') {\n            throw new MalformedCredentialError('VP token must be a string');\n        }\n\n        const allowedAlgorithms = options.allowedAlgorithms ?? DEFAULT_ALLOWED_ALGORITHMS;\n\n        const invalidResult = (error: string): PresentationResult => ({\n            valid: false,\n            format: this.format,\n            claims: {},\n            issuer: { certificate: new Uint8Array(), country: '' },\n            error,\n        });\n\n        // Step 1: Split the SD-JWT into components\n        let parts: ReturnType<typeof splitSdJwt>;\n        try {\n            parts = splitSdJwt(vpToken);\n        } catch {\n            throw new MalformedCredentialError('Failed to split SD-JWT structure');\n        }\n\n        // Step 2: Peek at issuer JWT header (need alg and x5c before verification)\n        let header: ReturnType<typeof decodeProtectedHeader>;\n        try {\n            header = decodeProtectedHeader(parts.jwt);\n        } catch {\n            throw new MalformedCredentialError('Failed to decode SD-JWT issuer JWT header');\n        }\n\n        // Step 3: Check algorithm against allowlist\n        const alg = header.alg;\n        if (typeof alg !== 'string' || !allowedAlgorithms.includes(alg)) {\n            return invalidResult(`Unsupported algorithm: ${alg}`);\n        }\n\n        // Step 4: Extract public key from x5c certificate\n        const x5cArray = header.x5c;\n        if (!Array.isArray(x5cArray) || x5cArray.length === 0 || typeof x5cArray[0] !== 'string') {\n            throw new MalformedCredentialError('Missing or invalid x5c in JWT header');\n        }\n\n        let issuerKey: Awaited<ReturnType<typeof importX509>>;\n        let issuerCertBytes: Uint8Array;\n        try {\n            issuerKey = await importX509(derToPem(x5cArray[0]), alg);\n            issuerCertBytes = base64ToBytes(x5cArray[0]);\n        } catch (err) {\n            if (err instanceof MalformedCredentialError) throw err;\n            throw new MalformedCredentialError('Failed to import issuer certificate');\n        }\n\n        // Step 5: Verify issuer JWT signature (also validates exp, iat via jose)\n        let payload: Record<string, unknown>;\n        try {\n            const result = await jwtVerify(parts.jwt, issuerKey, { algorithms: allowedAlgorithms });\n            payload = result.payload as unknown as Record<string, unknown>;\n        } catch {\n            return invalidResult('Issuer JWT signature verification failed');\n        }\n\n        // Step 6: Trust check — certificate must be in the trusted set\n        // unless the caller explicitly opts out via skipTrustCheck.\n        const issuerString = typeof payload['iss'] === 'string' ? payload['iss'] : '';\n        const issuerInfo: IssuerInfo = {\n            certificate: issuerCertBytes,\n            country: extractCountryHint(issuerString),\n        };\n\n        if (options.trustedCertificates.length === 0) {\n            if (options.skipTrustCheck !== true) {\n                throw new MalformedCredentialError(\n                    'trustedCertificates must not be empty unless skipTrustCheck is true'\n                );\n            }\n        } else {\n            const isTrusted = options.trustedCertificates.some((trusted) => bytesEqual(trusted, issuerCertBytes));\n            if (!isTrusted) {\n                return invalidResult('Issuer certificate is not trusted');\n            }\n        }\n\n        // Step 7: Verify disclosure hashes against _sd array\n        const sdArray = payload['_sd'];\n        if (parts.disclosures.length > 0) {\n            if (!Array.isArray(sdArray) || sdArray.length === 0) {\n                return invalidResult('Disclosures present but no _sd array in issuer JWT');\n            }\n            for (const disclosure of parts.disclosures) {\n                const hashBytes = await sha256Hasher(disclosure, 'sha-256');\n                const hashB64url = bytesToBase64url(hashBytes);\n                if (!sdArray.includes(hashB64url)) {\n                    return invalidResult('Disclosure hash mismatch');\n                }\n            }\n        }\n\n        // Step 8: Verify key binding JWT (if present)\n        if (parts.kbJwt) {\n            // Extract holder public key from cnf claim\n            const cnf = payload['cnf'] as Record<string, unknown> | undefined;\n            if (!cnf || typeof cnf !== 'object' || !cnf['jwk']) {\n                throw new MalformedCredentialError('Missing cnf.jwk in issuer JWT for key binding');\n            }\n\n            let holderKey: Awaited<ReturnType<typeof importJWK>>;\n            try {\n                const kbHeader = decodeProtectedHeader(parts.kbJwt);\n                const kbAlg = kbHeader.alg;\n                if (typeof kbAlg !== 'string' || !allowedAlgorithms.includes(kbAlg)) {\n                    return invalidResult(`Unsupported KB-JWT algorithm: ${kbAlg}`);\n                }\n                holderKey = await importJWK(cnf['jwk'] as Record<string, unknown>, kbAlg);\n            } catch (err) {\n                if (err instanceof MalformedCredentialError) throw err;\n                throw new MalformedCredentialError('Failed to import holder key from cnf.jwk');\n            }\n\n            // Verify KB-JWT signature\n            let kbPayload: Record<string, unknown>;\n            try {\n                const kbResult = await jwtVerify(parts.kbJwt, holderKey, {\n                    algorithms: allowedAlgorithms,\n                    ...(options.audience ? { audience: options.audience } : {}),\n                });\n                kbPayload = kbResult.payload as unknown as Record<string, unknown>;\n            } catch {\n                return invalidResult('Key binding JWT signature verification failed');\n            }\n\n            // Validate nonce — must be present and match when KB-JWT is used\n            if (kbPayload['nonce'] !== options.nonce) {\n                return invalidResult('Key binding JWT nonce does not match');\n            }\n\n            // Verify sd_hash — hash of the SD-JWT content before the KB-JWT\n            const disclosurePart = parts.disclosures.length > 0 ? parts.disclosures.join('~') + '~' : '';\n            const sdJwtForHash = parts.jwt + '~' + disclosurePart;\n            const sdHashBytes = await sha256Hasher(sdJwtForHash, 'sha-256');\n            const expectedSdHash = bytesToBase64url(sdHashBytes);\n            if (kbPayload['sd_hash'] !== expectedSdHash) {\n                return invalidResult('Key binding JWT sd_hash does not match');\n            }\n        }\n\n        // Step 9: Decode disclosures and extract claims\n        let resolvedClaims: Record<string, unknown>;\n        try {\n            const decoded = await decodeSdJwt(vpToken, sha256Hasher);\n            resolvedClaims = await getClaims<Record<string, unknown>>(\n                decoded.jwt.payload,\n                decoded.disclosures,\n                sha256Hasher\n            );\n        } catch {\n            throw new MalformedCredentialError('Failed to decode SD-JWT disclosures');\n        }\n\n        return {\n            valid: true,\n            format: this.format,\n            claims: mapToCredentialClaims(resolvedClaims),\n            issuer: issuerInfo,\n        };\n    }\n}\n","import { Encoder as CborEncoder, Tag } from 'cbor-x';\n\nimport { MalformedCredentialError } from '../errors.js';\n\n// Decoder that preserves CBOR maps as JS Maps (cbor-x default converts them to objects).\nconst decoder = new CborEncoder({ mapsAsObjects: false, useRecords: false });\n\n/**\n * COSE label for the `alg` header parameter.\n */\nconst HEADER_ALG = 1;\n\n/**\n * COSE label for the `x5chain` header parameter (RFC 9360).\n */\nconst HEADER_X5CHAIN = 33;\n\nconst COSE_ALG_TO_NAME: Record<number, string> = {\n    [-7]: 'ES256',\n    [-35]: 'ES384',\n    [-36]: 'ES512',\n};\n\nexport interface CoseSign1 {\n    protectedHeaderBytes: Uint8Array;\n    protectedHeader: Map<number, unknown>;\n    unprotectedHeader: Map<number, unknown>;\n    payload: Uint8Array;\n    signature: Uint8Array;\n    x5chain: Uint8Array[];\n    alg: 'ES256' | 'ES384' | 'ES512';\n}\n\nexport function decodeCoseSign1(bytes: Uint8Array): CoseSign1 {\n    let outer: unknown = decoder.decode(bytes);\n    if (outer instanceof Tag && outer.tag === 18) {\n        // tag-18 value may be the raw bytes of the COSE_Sign1 structure — decode again\n        const tagValue = outer.value;\n        outer = tagValue instanceof Uint8Array ? decoder.decode(tagValue) : tagValue;\n    }\n    if (!Array.isArray(outer) || outer.length !== 4) {\n        throw new MalformedCredentialError('COSE_Sign1 must be a CBOR array of length 4');\n    }\n    const [protectedHeaderBytes, unprotectedHeader, payloadRaw, signature] = outer;\n    if (!(protectedHeaderBytes instanceof Uint8Array)) {\n        throw new MalformedCredentialError('COSE_Sign1 protected header must be a bstr');\n    }\n    if (!(unprotectedHeader instanceof Map)) {\n        throw new MalformedCredentialError('COSE_Sign1 unprotected header must be a Map');\n    }\n    if (!(signature instanceof Uint8Array)) {\n        throw new MalformedCredentialError('COSE_Sign1 signature must be a bstr');\n    }\n\n    let protectedHeader: Map<number, unknown>;\n    try {\n        const decoded = decoder.decode(protectedHeaderBytes);\n        if (!(decoded instanceof Map)) {\n            throw new Error('protected header not a Map');\n        }\n        protectedHeader = decoded as Map<number, unknown>;\n    } catch {\n        throw new MalformedCredentialError('COSE_Sign1 protected header is not decodable CBOR');\n    }\n\n    const algLabel = protectedHeader.get(HEADER_ALG);\n    const alg = typeof algLabel === 'number' ? COSE_ALG_TO_NAME[algLabel] : undefined;\n    if (!alg) {\n        throw new MalformedCredentialError(`COSE_Sign1 uses unknown alg label: ${String(algLabel)}`);\n    }\n\n    // Payload may be a bstr, tag-24 bstr (embedded CBOR), or absent (detached — not supported here)\n    let payload: Uint8Array;\n    if (payloadRaw instanceof Uint8Array) {\n        payload = payloadRaw;\n    } else if (payloadRaw instanceof Tag && payloadRaw.tag === 24 && payloadRaw.value instanceof Uint8Array) {\n        payload = payloadRaw.value;\n    } else {\n        throw new MalformedCredentialError('COSE_Sign1 payload must be a byte string');\n    }\n\n    // x5chain may be a single cert bstr or an array of bstrs\n    const x5raw = unprotectedHeader.get(HEADER_X5CHAIN);\n    let x5chain: Uint8Array[];\n    if (x5raw === undefined) {\n        throw new MalformedCredentialError('COSE_Sign1 missing x5chain in unprotected header (label 33)');\n    }\n    if (x5raw instanceof Uint8Array) {\n        x5chain = [x5raw];\n    } else if (Array.isArray(x5raw) && x5raw.every((v) => v instanceof Uint8Array)) {\n        x5chain = x5raw as Uint8Array[];\n    } else {\n        throw new MalformedCredentialError('COSE_Sign1 x5chain must be a bstr or array of bstr');\n    }\n\n    return {\n        protectedHeaderBytes,\n        protectedHeader,\n        unprotectedHeader: unprotectedHeader as Map<number, unknown>,\n        payload,\n        signature,\n        x5chain,\n        alg: alg as 'ES256' | 'ES384' | 'ES512',\n    };\n}\n\nconst ALG_TO_HASH: Record<string, string> = {\n    ES256: 'SHA-256',\n    ES384: 'SHA-384',\n    ES512: 'SHA-512',\n};\n\n/**\n * Verifies the COSE_Sign1 signature using the provided public key.\n * Throws when the algorithm is not in the allowlist or the signature is invalid.\n */\nexport async function verifyCoseSign1(\n    coseSign1: CoseSign1,\n    publicKey: CryptoKey,\n    allowedAlgorithms: string[]\n): Promise<void> {\n    if (!allowedAlgorithms.includes(coseSign1.alg)) {\n        throw new MalformedCredentialError(`COSE_Sign1 algorithm ${coseSign1.alg} not in allowlist`);\n    }\n    const hashAlg = ALG_TO_HASH[coseSign1.alg];\n    if (!hashAlg) {\n        throw new MalformedCredentialError(`no hash mapping for alg ${coseSign1.alg}`);\n    }\n\n    // Sig_structure1 = [\"Signature1\", protected_header_bytes, external_aad (empty bstr), payload]\n    // coseSign1.payload is the raw bstr from the COSE array — it already contains the tag-24\n    // encoded MSO bytes as stored by the signer, so we use it directly without re-wrapping.\n    const sigStructure = ['Signature1', coseSign1.protectedHeaderBytes, new Uint8Array(0), coseSign1.payload];\n    const sigInput = decoder.encode(sigStructure);\n\n    // Copy into a plain Uint8Array<ArrayBuffer> so TS's BufferSource constraint is satisfied.\n    const ok = await crypto.subtle.verify(\n        { name: 'ECDSA', hash: hashAlg },\n        publicKey,\n        new Uint8Array(coseSign1.signature),\n        sigInput\n    );\n    if (!ok) {\n        throw new MalformedCredentialError('COSE_Sign1 signature verification failed');\n    }\n}\n","import { Encoder as CborEncoder, Tag } from 'cbor-x';\n\nimport { MalformedCredentialError } from '../errors.js';\n\nimport type { MobileSecurityObject } from './mso.js';\n\n// Decoder that preserves CBOR maps as JS Maps (cbor-x default converts them to objects).\nconst decoder = new CborEncoder({ mapsAsObjects: false, useRecords: false });\n\nconst ALLOWED_HASH_ALGS = new Set(['SHA-256', 'SHA-384', 'SHA-512']);\n\nexport async function computeItemDigest(itemBytes: Uint8Array, digestAlgorithm: string): Promise<Uint8Array> {\n    if (!ALLOWED_HASH_ALGS.has(digestAlgorithm)) {\n        throw new MalformedCredentialError(`Unknown digest algorithm: ${digestAlgorithm}`);\n    }\n    // Copy into a plain Uint8Array<ArrayBuffer> to satisfy TypeScript's BufferSource constraint.\n    const buf = await crypto.subtle.digest(digestAlgorithm, new Uint8Array(itemBytes));\n    return new Uint8Array(buf);\n}\n\nfunction bytesEqual(a: Uint8Array, b: Uint8Array): boolean {\n    if (a.length !== b.length) return false;\n    for (let i = 0; i < a.length; i++) {\n        if (a[i] !== b[i]) return false;\n    }\n    return true;\n}\n\n/**\n * Unwrap an IssuerSignedItem from its tag-24 encoding and return the inner Map.\n *\n * Three shapes arise depending on test vs. production paths:\n *   A) Tag(24, Uint8Array)    — production cbor-x path (no addExtension)\n *   B) EmbeddedCbor-like obj  — test-fixture path (addExtension in mdoc-helpers.ts registers a\n *                               custom class whose instances have `.value: Uint8Array`)\n *   C) Plain Map              — if cbor-x auto-unwraps deeper than expected\n */\nfunction unwrapItemMap(itemBytes: Uint8Array): Map<string, unknown> {\n    let decoded: unknown;\n    try {\n        decoded = decoder.decode(itemBytes);\n    } catch {\n        throw new MalformedCredentialError('IssuerSignedItem is not decodable CBOR');\n    }\n\n    let inner: unknown;\n    if (decoded instanceof Tag && decoded.tag === 24 && decoded.value instanceof Uint8Array) {\n        // Path A: tag-24 Tag object\n        inner = decoder.decode(decoded.value as Uint8Array);\n    } else if (\n        decoded !== null &&\n        typeof decoded === 'object' &&\n        !(decoded instanceof Tag) &&\n        !(decoded instanceof Map) &&\n        !(decoded instanceof Uint8Array) &&\n        'value' in (decoded as object) &&\n        (decoded as { value: unknown }).value instanceof Uint8Array\n    ) {\n        // Path B: EmbeddedCbor-like object from test fixture's addExtension\n        inner = decoder.decode((decoded as { value: Uint8Array }).value);\n    } else if (decoded instanceof Map) {\n        // Path C: already a Map\n        inner = decoded;\n    } else {\n        throw new MalformedCredentialError('IssuerSignedItem must be a tag-24 wrapped CBOR Map');\n    }\n\n    if (!(inner instanceof Map)) {\n        throw new MalformedCredentialError('IssuerSignedItem must decode to a Map');\n    }\n    return inner as Map<string, unknown>;\n}\n\n/**\n * Verifies every IssuerSignedItem across every namespace against the MSO's valueDigests.\n * All items must match — no partial acceptance.\n *\n * @param nameSpaces  Per-namespace arrays of tag-24-wrapped IssuerSignedItem bytes\n *                    (exactly the bytes used as digest input during issuance).\n * @param mso         Decoded MobileSecurityObject carrying the expected valueDigests.\n */\nexport async function verifyAllDigests(\n    nameSpaces: Map<string, Uint8Array[]>,\n    mso: MobileSecurityObject\n): Promise<void> {\n    for (const [ns, items] of nameSpaces) {\n        const expected = mso.valueDigests.get(ns);\n        if (!expected) {\n            throw new MalformedCredentialError(`namespace ${ns} has no valueDigests entry in MSO`);\n        }\n        for (const itemBytes of items) {\n            // Hash the raw tag-24 bytes — this is what the issuer hashed during issuance.\n            const hash = await computeItemDigest(itemBytes, mso.digestAlgorithm);\n\n            // Decode to extract digestID for lookup.\n            const item = unwrapItemMap(itemBytes);\n            const digestID = item.get('digestID');\n            if (typeof digestID !== 'number') {\n                throw new MalformedCredentialError('IssuerSignedItem missing digestID');\n            }\n\n            const expectedDigest = expected.get(digestID);\n            if (!expectedDigest) {\n                throw new MalformedCredentialError(`digestID ${digestID} missing from MSO valueDigests[${ns}]`);\n            }\n            if (!bytesEqual(hash, expectedDigest)) {\n                throw new MalformedCredentialError(`digest mismatch for ns=${ns} digestID=${digestID}`);\n            }\n        }\n    }\n}\n","import { Encoder as CborEncoder, Tag } from 'cbor-x';\n\nimport { MalformedCredentialError, ExpiredCredentialError } from '../errors.js';\n\n// Decoder that preserves CBOR maps as JS Maps (cbor-x default converts them to objects).\nconst decoder = new CborEncoder({ mapsAsObjects: false, useRecords: false });\n\nexport interface MobileSecurityObject {\n    version: string;\n    digestAlgorithm: string;\n    valueDigests: Map<string, Map<number, Uint8Array>>;\n    docType: string;\n    validityInfo: {\n        signed: Date;\n        validFrom: Date;\n        validUntil: Date;\n        expectedUpdate?: Date;\n    };\n}\n\nfunction decodeDateLike(value: unknown): Date {\n    if (value instanceof Date) return value;\n    if (value instanceof Tag) {\n        // Tag 0 = RFC 3339 string; Tag 1 = epoch seconds; Tag 1004 = full-date (YYYY-MM-DD)\n        if (value.tag === 0 && typeof value.value === 'string') {\n            return new Date(value.value);\n        }\n        if (value.tag === 1 && typeof value.value === 'number') {\n            return new Date(value.value * 1000);\n        }\n        if (value.tag === 1004 && typeof value.value === 'string') {\n            return new Date(value.value);\n        }\n    }\n    if (typeof value === 'string') {\n        return new Date(value);\n    }\n    throw new MalformedCredentialError(`unsupported date encoding in MSO: ${typeof value}`);\n}\n\nexport function decodeMso(payload: Uint8Array): MobileSecurityObject {\n    let raw: unknown;\n    try {\n        raw = decoder.decode(payload);\n        // Unwrap tag-24 (embedded CBOR): COSE payload may be tag-24 wrapped MSO bytes.\n        // In production cbor-x decodes tag-24 as Tag(24, bytes); in test fixtures that register\n        // a custom addExtension for tag-24 it decodes to an EmbeddedCbor-like object with .value.\n        if (raw instanceof Tag && raw.tag === 24 && raw.value instanceof Uint8Array) {\n            raw = decoder.decode(raw.value);\n        } else if (\n            raw !== null &&\n            typeof raw === 'object' &&\n            !(raw instanceof Tag) &&\n            !(raw instanceof Map) &&\n            !(raw instanceof Uint8Array) &&\n            'value' in (raw as object) &&\n            (raw as { value: unknown }).value instanceof Uint8Array\n        ) {\n            // TEST-FIXTURE COMPATIBILITY: tests/fixtures/mdoc-helpers.ts registers a custom\n            // tag-24 addExtension globally, so cbor-x returns an EmbeddedCbor-like object\n            // (with `.value: Uint8Array`) instead of Tag(24, bytes) during tests. The `!(raw\n            // instanceof Tag)` guard ensures we don't misinterpret arbitrary Tag(N, bytes)\n            // values as embedded CBOR in production.\n            raw = decoder.decode((raw as { value: Uint8Array }).value);\n        }\n    } catch (err) {\n        if (err instanceof MalformedCredentialError) throw err;\n        throw new MalformedCredentialError('MSO payload is not decodable CBOR');\n    }\n    if (!(raw instanceof Map)) {\n        throw new MalformedCredentialError('MSO must be a CBOR Map');\n    }\n    const m = raw as Map<string, unknown>;\n\n    const version = m.get('version');\n    if (typeof version !== 'string') {\n        throw new MalformedCredentialError('MSO.version must be a string');\n    }\n    const digestAlgorithm = m.get('digestAlgorithm');\n    if (typeof digestAlgorithm !== 'string') {\n        throw new MalformedCredentialError('MSO.digestAlgorithm must be a string');\n    }\n    const docType = m.get('docType');\n    if (typeof docType !== 'string') {\n        throw new MalformedCredentialError('MSO.docType must be a string');\n    }\n\n    const vdRaw = m.get('valueDigests');\n    if (!(vdRaw instanceof Map)) {\n        throw new MalformedCredentialError('MSO.valueDigests must be a Map');\n    }\n    const valueDigests = new Map<string, Map<number, Uint8Array>>();\n    for (const [ns, inner] of vdRaw.entries()) {\n        if (typeof ns !== 'string' || !(inner instanceof Map)) {\n            throw new MalformedCredentialError('MSO.valueDigests entry malformed');\n        }\n        const perNs = new Map<number, Uint8Array>();\n        for (const [id, digest] of (inner as Map<unknown, unknown>).entries()) {\n            if (typeof id !== 'number' || !(digest instanceof Uint8Array)) {\n                throw new MalformedCredentialError('MSO digest entry must map number→bstr');\n            }\n            perNs.set(id, digest);\n        }\n        valueDigests.set(ns, perNs);\n    }\n\n    const viRaw = m.get('validityInfo');\n    if (!(viRaw instanceof Map)) {\n        throw new MalformedCredentialError('MSO.validityInfo must be a Map');\n    }\n    const vi = viRaw as Map<string, unknown>;\n    const validityInfo: MobileSecurityObject['validityInfo'] = {\n        signed: decodeDateLike(vi.get('signed')),\n        validFrom: decodeDateLike(vi.get('validFrom')),\n        validUntil: decodeDateLike(vi.get('validUntil')),\n    };\n    if (vi.has('expectedUpdate')) {\n        validityInfo.expectedUpdate = decodeDateLike(vi.get('expectedUpdate'));\n    }\n\n    return { version, digestAlgorithm, valueDigests, docType, validityInfo };\n}\n\n/**\n * Validates the MSO's validityInfo block against a reference time.\n * Enforces strict ISO 18013-5 rules:\n *   - signed <= now\n *   - validFrom <= now\n *   - validFrom <= validUntil\n *   - signed within [validFrom, validUntil]\n *   - validUntil >= now (else ExpiredCredentialError)\n */\nexport function validateMsoValidity(mso: MobileSecurityObject, now: Date): void {\n    const { signed, validFrom, validUntil } = mso.validityInfo;\n    if (signed.getTime() > now.getTime()) {\n        throw new MalformedCredentialError(`MSO signed=${signed.toISOString()} is in the future`);\n    }\n    if (validFrom.getTime() > now.getTime()) {\n        throw new MalformedCredentialError(`MSO validFrom=${validFrom.toISOString()} is in the future`);\n    }\n    if (validFrom.getTime() > validUntil.getTime()) {\n        throw new MalformedCredentialError('MSO validFrom is after validUntil');\n    }\n    if (signed.getTime() < validFrom.getTime() || signed.getTime() > validUntil.getTime()) {\n        throw new MalformedCredentialError('MSO signed is outside the validity window');\n    }\n    if (validUntil.getTime() < now.getTime()) {\n        throw new ExpiredCredentialError(`MSO validUntil=${validUntil.toISOString()} is in the past`);\n    }\n}\n\n/**\n * Validates that the MSO's docType matches the expected one.\n * Used by callers who want to lock the accepted credential type.\n */\nexport function validateMsoDocType(mso: MobileSecurityObject, expectedDocType: string): void {\n    if (mso.docType !== expectedDocType) {\n        throw new MalformedCredentialError(`MSO docType=${mso.docType} does not match expected ${expectedDocType}`);\n    }\n}\n","import { Encoder as CborEncoder, Tag } from 'cbor-x';\nimport { importX509 } from 'jose';\n\nimport { decodeCoseSign1, verifyCoseSign1 } from '../crypto/cose-sign1.js';\nimport { verifyAllDigests } from '../crypto/digest.js';\nimport { decodeMso, validateMsoValidity, validateMsoDocType } from '../crypto/mso.js';\nimport { MalformedCredentialError, ExpiredCredentialError } from '../errors.js';\nimport type { IssuerInfo } from '../types/issuer.js';\nimport type { CredentialFormat, CredentialClaims, PresentationResult } from '../types/presentation.js';\n\nimport type { ICredentialParser, ParseOptions } from './parser.interface.js';\n\n// Decoder that preserves CBOR maps as JS Maps (cbor-x default converts them to objects).\nconst decoder = new CborEncoder({ mapsAsObjects: false, useRecords: false });\nconst encoder = new CborEncoder({ mapsAsObjects: false, useRecords: false });\n\nconst DEFAULT_ALLOWED_ALGORITHMS = ['ES256', 'ES384', 'ES512'];\n\nfunction bytesEqual(a: Uint8Array, b: Uint8Array): boolean {\n    if (a.length !== b.length) return false;\n    for (let i = 0; i < a.length; i++) {\n        if (a[i] !== b[i]) return false;\n    }\n    return true;\n}\n\nfunction derToPem(der: Uint8Array): string {\n    let binary = '';\n    for (const b of der) binary += String.fromCharCode(b);\n    const b64 = globalThis.btoa(binary);\n    const lines = b64.match(/.{1,64}/g) || [];\n    return `-----BEGIN CERTIFICATE-----\\n${lines.join('\\n')}\\n-----END CERTIFICATE-----`;\n}\n\nfunction extractCountryHintFromCert(_certDer: Uint8Array): string {\n    // Placeholder — full X.509 subject parsing is workstream 3.\n    return '';\n}\n\n/**\n * Extracts raw tag-24 bytes from an IssuerSignedItem.\n *\n * Each IssuerSignedItem in the DeviceResponse is stored as EmbeddedCbor(itemTag24),\n * which on the wire is tag-24 wrapping the already-tag-24-wrapped item bytes.\n * cbor-x decoding unwraps one layer, so `item.value` (or the Tag(24).value) is\n * exactly `itemTag24` — the bytes the issuer hashed. Return those directly.\n *\n * Three shapes arise depending on test vs. production paths:\n *   A) Tag(24, Uint8Array)    — production cbor-x path (no addExtension)\n *   B) EmbeddedCbor-like obj  — test-fixture path (addExtension in mdoc-helpers.ts registers a\n *                               custom class whose instances have `.value: Uint8Array`)\n *   C) Plain Uint8Array       — already encoded tag-24 bytes\n */\nfunction extractRawItemBytes(item: unknown): Uint8Array {\n    if (item instanceof Tag && item.tag === 24 && item.value instanceof Uint8Array) {\n        return item.value;\n    }\n    if (item instanceof Uint8Array) {\n        return item;\n    }\n    if (\n        item !== null &&\n        typeof item === 'object' &&\n        !(item instanceof Tag) &&\n        !(item instanceof Map) &&\n        'value' in (item as object) &&\n        (item as { value: unknown }).value instanceof Uint8Array\n    ) {\n        return (item as { value: Uint8Array }).value;\n    }\n    throw new MalformedCredentialError('IssuerSignedItem must be a tag-24 byte string');\n}\n\n/**\n * Maps raw IssuerSignedItem bytes (from all namespaces) to CredentialClaims.\n *\n * Handles all three tag-24 shapes (Tag(24,bytes), EmbeddedCbor-like object, plain bytes).\n */\nfunction mapRawToClaims(nameSpaces: Map<string, Uint8Array[]>): CredentialClaims {\n    const out: CredentialClaims = {};\n    for (const items of nameSpaces.values()) {\n        for (const itemBytes of items) {\n            let decoded: unknown;\n            try {\n                decoded = decoder.decode(itemBytes);\n            } catch {\n                continue;\n            }\n\n            // Unwrap all three tag-24 shapes to get the inner CBOR bytes\n            let inner: unknown;\n            if (decoded instanceof Tag && decoded.tag === 24 && decoded.value instanceof Uint8Array) {\n                // Path A: Tag(24, bytes)\n                inner = decoder.decode(decoded.value as Uint8Array);\n            } else if (\n                decoded !== null &&\n                typeof decoded === 'object' &&\n                !(decoded instanceof Tag) &&\n                !(decoded instanceof Map) &&\n                !(decoded instanceof Uint8Array) &&\n                'value' in (decoded as object) &&\n                (decoded as { value: unknown }).value instanceof Uint8Array\n            ) {\n                // Path B: EmbeddedCbor-like object from test fixture's addExtension\n                inner = decoder.decode((decoded as { value: Uint8Array }).value);\n            } else if (decoded instanceof Map) {\n                // Path C: already a Map\n                inner = decoded;\n            } else {\n                continue;\n            }\n\n            if (inner instanceof Map) {\n                const id = (inner as Map<string, unknown>).get('elementIdentifier');\n                const val = (inner as Map<string, unknown>).get('elementValue');\n                if (typeof id === 'string') {\n                    (out as Record<string, unknown>)[id] = val;\n                }\n            }\n        }\n    }\n    return out;\n}\n\n/**\n * mDOC / mDL credential parser.\n *\n * Decodes and validates mDOC (Mobile Document) credentials as specified in\n * ISO 18013-5 and the EUDI Wallet ecosystem. Composes the crypto modules\n * to perform full verification:\n *   - COSE_Sign1 decode + signature verification\n *   - MSO decode + validity + docType validation\n *   - Digest verification for all IssuerSignedItems\n *   - Issuer certificate trust chain check\n */\nexport class MdocParser implements ICredentialParser {\n    readonly format: CredentialFormat = 'mdoc';\n\n    /**\n     * Returns true when the token is binary data (Uint8Array or Buffer),\n     * indicating a CBOR-encoded mDOC DeviceResponse.\n     * Buffer extends Uint8Array, so `instanceof Uint8Array` catches both.\n     */\n    canParse(vpToken: unknown): boolean {\n        return vpToken instanceof Uint8Array;\n    }\n\n    /**\n     * Parses and validates an mDOC DeviceResponse token.\n     *\n     * @throws {MalformedCredentialError} when the CBOR structure cannot be decoded\n     *   or does not match the expected DeviceResponse format\n     */\n    async parse(vpToken: unknown, options: ParseOptions): Promise<PresentationResult> {\n        if (!(vpToken instanceof Uint8Array)) {\n            throw new MalformedCredentialError('mDOC vpToken must be a Uint8Array');\n        }\n        const allowedAlgorithms = options.allowedAlgorithms ?? DEFAULT_ALLOWED_ALGORITHMS;\n\n        // Step 1: Decode DeviceResponse\n        let deviceResponse: Map<unknown, unknown>;\n        try {\n            const decoded = decoder.decode(vpToken);\n            if (!(decoded instanceof Map)) throw new Error();\n            deviceResponse = decoded as Map<unknown, unknown>;\n        } catch {\n            throw new MalformedCredentialError('vpToken is not a CBOR DeviceResponse Map');\n        }\n\n        // Step 2: Extract first document\n        const docs = deviceResponse.get('documents');\n        if (!Array.isArray(docs) || docs.length === 0) {\n            throw new MalformedCredentialError('DeviceResponse has no documents');\n        }\n        const document = docs[0];\n        if (!(document instanceof Map)) {\n            throw new MalformedCredentialError('document must be a Map');\n        }\n        const issuerSigned = document.get('issuerSigned');\n        if (!(issuerSigned instanceof Map)) {\n            throw new MalformedCredentialError('document.issuerSigned must be a Map');\n        }\n        const issuerAuth = issuerSigned.get('issuerAuth');\n        if (!Array.isArray(issuerAuth)) {\n            throw new MalformedCredentialError('issuerAuth must be a COSE_Sign1 array');\n        }\n\n        // Re-encode issuerAuth as bytes so we can pass to decodeCoseSign1\n        const issuerAuthBytes = encoder.encode(issuerAuth);\n\n        // Step 3: Decode COSE_Sign1 + algorithm check\n        const cose = decodeCoseSign1(issuerAuthBytes);\n        if (!allowedAlgorithms.includes(cose.alg)) {\n            return {\n                valid: false,\n                format: this.format,\n                claims: {},\n                issuer: { certificate: new Uint8Array(), country: '' },\n                error: `Unsupported algorithm: ${cose.alg}`,\n            };\n        }\n\n        // Step 4: Trust check (reuse 0.2.1 skipTrustCheck semantics)\n        const issuerCertBytes = cose.x5chain[0];\n        if (!issuerCertBytes) {\n            throw new MalformedCredentialError('Missing issuer certificate in x5chain');\n        }\n        if (options.trustedCertificates.length === 0) {\n            if (options.skipTrustCheck !== true) {\n                throw new MalformedCredentialError(\n                    'trustedCertificates must not be empty unless skipTrustCheck is true'\n                );\n            }\n        } else {\n            const trusted = options.trustedCertificates.some((t) => bytesEqual(t, issuerCertBytes));\n            if (!trusted) {\n                return {\n                    valid: false,\n                    format: this.format,\n                    claims: {},\n                    issuer: { certificate: issuerCertBytes, country: '' },\n                    error: 'Issuer certificate is not trusted',\n                };\n            }\n        }\n\n        // Step 5: Import public key + verify signature\n        const publicKey = await importX509(derToPem(issuerCertBytes), cose.alg);\n        try {\n            await verifyCoseSign1(cose, publicKey, allowedAlgorithms);\n        } catch (err) {\n            if (err instanceof MalformedCredentialError) {\n                return {\n                    valid: false,\n                    format: this.format,\n                    claims: {},\n                    issuer: { certificate: issuerCertBytes, country: '' },\n                    error: err.message,\n                };\n            }\n            throw err;\n        }\n\n        // Step 6: Decode + validate MSO\n        const mso = decodeMso(cose.payload);\n        try {\n            validateMsoValidity(mso, new Date());\n        } catch (err) {\n            if (err instanceof ExpiredCredentialError) {\n                return {\n                    valid: false,\n                    format: this.format,\n                    claims: {},\n                    issuer: { certificate: issuerCertBytes, country: '' },\n                    error: 'Credential expired',\n                };\n            }\n            throw err;\n        }\n\n        if (options.expectedDocType !== undefined) {\n            try {\n                validateMsoDocType(mso, options.expectedDocType);\n            } catch (err) {\n                if (err instanceof MalformedCredentialError) {\n                    return {\n                        valid: false,\n                        format: this.format,\n                        claims: {},\n                        issuer: { certificate: issuerCertBytes, country: '' },\n                        error: err.message,\n                    };\n                }\n                throw err;\n            }\n        }\n\n        // Step 7: Extract items from nameSpaces, verify all digests\n        const nsRaw = issuerSigned.get('nameSpaces');\n        if (!(nsRaw instanceof Map)) {\n            throw new MalformedCredentialError('issuerSigned.nameSpaces must be a Map');\n        }\n        const nameSpaces = new Map<string, Uint8Array[]>();\n        for (const [ns, items] of (nsRaw as Map<unknown, unknown>).entries()) {\n            if (typeof ns !== 'string' || !Array.isArray(items)) {\n                throw new MalformedCredentialError('nameSpaces entry malformed');\n            }\n            nameSpaces.set(ns, items.map(extractRawItemBytes));\n        }\n        await verifyAllDigests(nameSpaces, mso);\n\n        // Step 8: Map to claims\n        const claims = mapRawToClaims(nameSpaces);\n\n        const issuer: IssuerInfo = {\n            certificate: issuerCertBytes,\n            country: extractCountryHintFromCert(issuerCertBytes),\n        };\n        return { valid: true, format: this.format, claims, issuer };\n    }\n}\n","import { v4 as uuidv4 } from 'uuid';\n\nimport type { AuthorizationRequestInput, AuthorizationRequest } from './types/authorization.js';\n\nexport function createAuthorizationRequest(input: AuthorizationRequestInput): AuthorizationRequest {\n    const state = input.state ?? uuidv4();\n\n    const presentationDefinition = {\n        id: uuidv4(),\n        input_descriptors: input.requestedAttributes.map((attr, index) => ({\n            id: `descriptor_${index}`,\n            format: Object.fromEntries(\n                input.acceptedFormats.map((fmt) => {\n                    if (fmt === 'sd-jwt-vc') return ['vc+sd-jwt', { 'sd-jwt_alg_values': ['ES256'] }];\n                    return ['mso_mdoc', { alg: ['ES256'] }];\n                })\n            ),\n            constraints: {\n                fields: [\n                    {\n                        path: [`$.${attr}`, `$['${attr}']`],\n                        filter: { type: attr.startsWith('age_over') ? 'boolean' : 'string' },\n                    },\n                ],\n            },\n        })),\n    };\n\n    const params = new URLSearchParams({\n        response_type: 'vp_token',\n        response_mode: 'direct_post',\n        response_uri: input.responseUri,\n        client_id: input.clientId,\n        nonce: input.nonce,\n        state,\n        presentation_definition: JSON.stringify(presentationDefinition),\n    });\n\n    return {\n        uri: `openid4vp://authorize?${params.toString()}`,\n        presentationDefinition,\n        nonce: input.nonce,\n        state,\n    };\n}\n","import { MdocParser } from './parsers/mdoc.parser.js';\nimport type { ParseOptions, ICredentialParser } from './parsers/parser.interface.js';\nimport { SdJwtParser } from './parsers/sd-jwt.parser.js';\nimport type { PresentationResult } from './types/presentation.js';\n\nconst parsers: ICredentialParser[] = [new SdJwtParser(), new MdocParser()];\n\nexport async function parsePresentation(vpToken: unknown, options: ParseOptions): Promise<PresentationResult> {\n    for (const parser of parsers) {\n        if (parser.canParse(vpToken)) {\n            return parser.parse(vpToken, options);\n        }\n    }\n\n    return {\n        valid: false,\n        format: 'sd-jwt-vc',\n        claims: {},\n        issuer: { certificate: new Uint8Array(), country: '' },\n        error: 'Unsupported credential format',\n    };\n}\n\nexport type { ParseOptions } from './parsers/parser.interface.js';\n","export const VERSION = '0.3.0';\n\nexport type {\n    CredentialFormat,\n    CredentialClaims,\n    PresentationResult,\n    IssuerInfo,\n    AuthorizationRequestInput,\n    AuthorizationRequest,\n} from './types/index.js';\n\nexport type { ICredentialParser, ParseOptions } from './parsers/parser.interface.js';\n\nexport { SdJwtParser } from './parsers/sd-jwt.parser.js';\nexport { MdocParser } from './parsers/mdoc.parser.js';\n\nexport {\n    InvalidSignatureError,\n    ExpiredCredentialError,\n    UnsupportedFormatError,\n    MalformedCredentialError,\n    NonceValidationError,\n} from './errors.js';\n\nexport { createAuthorizationRequest } from './authorization.js';\n\nexport { parsePresentation } from './presentation.js';\n"]}
+{"version":3,"sources":["../src/authorization.ts","../src/errors.ts","../src/haip.ts","../src/crypto/cose-sign1.ts","../src/crypto/digest.ts","../src/crypto/mso.ts","../src/parsers/mdoc.parser.ts","../src/parsers/sd-jwt.parser.ts","../src/presentation.ts","../src/verify.ts","../src/index.ts"],"names":["uuidv4","CborEncoder","Tag","decoder","bytesEqual","importX509","DEFAULT_ALLOWED_ALGORITHMS","encoder","derToPem","splitSdJwt","decodeProtectedHeader","jwtVerify","importJWK","decodeSdJwt","getClaims","matchQuery","buildSubmission"],"mappings":";;;;;;;;;AAKO,SAAS,0BAAA,CACZ,OACA,KAAA,EACoB;AACpB,EAAA,IAAI,CAAC,KAAA,CAAM,QAAA,EAAU,MAAM,IAAI,UAAU,sBAAsB,CAAA;AAC/D,EAAA,IAAI,CAAC,KAAA,CAAM,KAAA,EAAO,MAAM,IAAI,UAAU,mBAAmB,CAAA;AACzD,EAAA,IAAI,CAAC,KAAA,CAAM,WAAA,EAAa,MAAM,IAAI,UAAU,yBAAyB,CAAA;AAErE,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,IAASA,OAAA,EAAO;AACpC,EAAA,MAAM,YAAA,GAAe,MAAM,YAAA,IAAgB,aAAA;AAE3C,EAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB;AAAA,IAC/B,aAAA,EAAe,UAAA;AAAA,IACf,aAAA,EAAe,YAAA;AAAA,IACf,cAAc,KAAA,CAAM,WAAA;AAAA,IACpB,WAAW,KAAA,CAAM,QAAA;AAAA,IACjB,OAAO,KAAA,CAAM,KAAA;AAAA,IACb,KAAA;AAAA,IACA,UAAA,EAAY,IAAA,CAAK,SAAA,CAAU,KAAK;AAAA,GACnC,CAAA;AAED,EAAA,OAAO;AAAA,IACH,GAAA,EAAK,CAAA,sBAAA,EAAyB,MAAA,CAAO,QAAA,EAAU,CAAA,CAAA;AAAA,IAC/C,SAAA,EAAW,KAAA;AAAA,IACX,OAAO,KAAA,CAAM,KAAA;AAAA,IACb;AAAA,GACJ;AACJ;;;AChCO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EAC7C,WAAA,CAAY,UAAU,wCAAA,EAA0C;AAC5D,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AACZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,GAAA,CAAA,MAAA,CAAW,SAAS,CAAA;AAAA,EACpD;AACJ;AAEO,IAAM,sBAAA,GAAN,cAAqC,KAAA,CAAM;AAAA,EAC9C,WAAA,CAAY,UAAU,wBAAA,EAA0B;AAC5C,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,wBAAA;AACZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,GAAA,CAAA,MAAA,CAAW,SAAS,CAAA;AAAA,EACpD;AACJ;AAEO,IAAM,sBAAA,GAAN,cAAqC,KAAA,CAAM;AAAA,EAC9C,YAAY,MAAA,EAAgB;AACxB,IAAA,KAAA,CAAM,CAAA,+BAAA,EAAkC,MAAM,CAAA,CAAE,CAAA;AAChD,IAAA,IAAA,CAAK,IAAA,GAAO,wBAAA;AACZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,GAAA,CAAA,MAAA,CAAW,SAAS,CAAA;AAAA,EACpD;AACJ;AAEO,IAAM,wBAAA,GAAN,cAAuC,KAAA,CAAM;AAAA,EAChD,WAAA,CAAY,UAAU,mCAAA,EAAqC;AACvD,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,0BAAA;AACZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,GAAA,CAAA,MAAA,CAAW,SAAS,CAAA;AAAA,EACpD;AACJ;AAEO,IAAM,oBAAA,GAAN,cAAmC,KAAA,CAAM;AAAA,EAC5C,WAAA,CAAY,UAAU,qCAAA,EAAuC;AACzD,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,sBAAA;AACZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,GAAA,CAAA,MAAA,CAAW,SAAS,CAAA;AAAA,EACpD;AACJ;AAWO,IAAM,mBAAA,GAAN,cAAkC,KAAA,CAAM;AAAA,EAClC,IAAA;AAAA,EACA,YAAA;AAAA,EAET,WAAA,CAAY,IAAA,EAA0B,OAAA,EAAiB,YAAA,EAAuB;AAC1E,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,qBAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,YAAA,GAAe,YAAA;AACpB,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,GAAA,CAAA,MAAA,CAAW,SAAS,CAAA;AAAA,EACpD;AACJ;;;ACxDO,IAAM,uBAAA,GAAkD;AAAA,EAC3D,uBAAA,EAAyB,mBAAA;AAAA,EACzB,yBAAA,EAA2B;AAC/B;AAEO,SAAS,eAAe,KAAA,EAAkC;AAC7D,EAAA,IAAI,KAAA,CAAM,MAAA,CAAO,MAAA,KAAW,CAAA,EAAG;AAC3B,IAAA,MAAM,IAAI,mBAAA;AAAA,MACN,WAAA;AAAA,MACA,CAAA,YAAA,EAAe,MAAM,YAAY,CAAA,iCAAA,CAAA;AAAA,MACjC,KAAA,CAAM;AAAA,KACV;AAAA,EACJ;AAEA,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI,MAAA;AAEJ,EAAA,IAAI,KAAA,CAAM,WAAW,WAAA,EAAa;AAC9B,IAAA,IAAI,CAAC,KAAA,CAAM,SAAA,IAAa,KAAA,CAAM,SAAA,CAAU,WAAW,CAAA,EAAG;AAClD,MAAA,MAAM,IAAI,mBAAA;AAAA,QACN,oBAAA;AAAA,QACA,CAAA,YAAA,EAAe,MAAM,YAAY,CAAA,0DAAA,CAAA;AAAA,QACjC,KAAA,CAAM;AAAA,OACV;AAAA,IACJ;AACA,IAAA,IAAA,GAAO,EAAE,UAAA,EAAY,KAAA,CAAM,SAAA,EAAU;AACrC,IAAA,MAAA,GAAS,KAAA,CAAM,MAAA,CAAO,GAAA,CAAI,CAAC,CAAA,MAAO,EAAE,IAAA,EAAM,CAAC,CAAC,CAAA,EAAE,CAAE,CAAA;AAAA,EACpD,CAAA,MAAO;AACH,IAAA,IAAI,CAAC,MAAM,YAAA,EAAc;AACrB,MAAA,MAAM,IAAI,mBAAA;AAAA,QACN,mBAAA;AAAA,QACA,CAAA,YAAA,EAAe,MAAM,YAAY,CAAA,kDAAA,CAAA;AAAA,QACjC,KAAA,CAAM;AAAA,OACV;AAAA,IACJ;AACA,IAAA,IAAA,GAAO,EAAE,aAAA,EAAe,KAAA,CAAM,YAAA,EAAa;AAC3C,IAAA,MAAM,SAAA,GAAY,uBAAA,CAAwB,KAAA,CAAM,YAAY,KAAK,KAAA,CAAM,YAAA;AACvE,IAAA,MAAA,GAAS,KAAA,CAAM,MAAA,CAAO,GAAA,CAAI,CAAC,CAAA,MAAO,EAAE,IAAA,EAAM,CAAC,SAAA,EAAW,CAAC,CAAA,EAAE,CAAE,CAAA;AAAA,EAC/D;AAEA,EAAA,MAAM,UAAA,GAA8B;AAAA,IAChC,IAAI,KAAA,CAAM,YAAA;AAAA,IACV,QAAQ,KAAA,CAAM,MAAA;AAAA,IACd,IAAA;AAAA,IACA;AAAA,GACJ;AAEA,EAAA,IAAI,KAAA,CAAM,kBAAA,IAAsB,KAAA,CAAM,kBAAA,CAAmB,SAAS,CAAA,EAAG;AACjE,IAAA,UAAA,CAAW,sBAAsB,KAAA,CAAM,kBAAA;AAAA,EAC3C;AAEA,EAAA,OAAO,EAAE,WAAA,EAAa,CAAC,UAAU,CAAA,EAAE;AACvC;AAEA,IAAM,+BAAe,IAAI,GAAA,CAAY,CAAC,WAAA,EAAa,UAAU,CAAC,CAAA;AAEvD,SAAS,kBAAkB,KAAA,EAAwB;AACtD,EAAA,IAAI,CAAC,KAAA,CAAM,WAAA,IAAe,KAAA,CAAM,WAAA,CAAY,WAAW,CAAA,EAAG;AACtD,IAAA,MAAM,IAAI,mBAAA;AAAA,MACN,aAAA;AAAA,MACA;AAAA,KACJ;AAAA,EACJ;AAEA,EAAA,IAAI,KAAA,CAAM,oBAAoB,MAAA,EAAW;AACrC,IAAA,MAAM,IAAI,mBAAA;AAAA,MACN,4BAAA;AAAA,MACA;AAAA,KACJ;AAAA,EACJ;AAEA,EAAA,KAAA,MAAW,UAAA,IAAc,MAAM,WAAA,EAAa;AACxC,IAAA,IAAI,CAAC,YAAA,CAAa,GAAA,CAAI,UAAA,CAAW,MAAM,CAAA,EAAG;AACtC,MAAA,MAAM,IAAI,mBAAA;AAAA,QACN,oBAAA;AAAA,QACA,CAAA,YAAA,EAAe,UAAA,CAAW,EAAE,CAAA,2BAAA,EAA8B,WAAW,MAAM,CAAA,gCAAA,CAAA;AAAA,QAC3E,UAAA,CAAW;AAAA,OACf;AAAA,IACJ;AAEA,IAAA,IAAI,UAAA,CAAW,WAAW,WAAA,EAAa;AACnC,MAAA,MAAM,SAAA,GAAY,WAAW,IAAA,EAAM,UAAA;AACnC,MAAA,IAAI,CAAC,SAAA,IAAa,SAAA,CAAU,MAAA,KAAW,CAAA,EAAG;AACtC,QAAA,MAAM,IAAI,mBAAA;AAAA,UACN,oBAAA;AAAA,UACA,CAAA,YAAA,EAAe,WAAW,EAAE,CAAA,kDAAA,CAAA;AAAA,UAC5B,UAAA,CAAW;AAAA,SACf;AAAA,MACJ;AAAA,IACJ;AAEA,IAAA,IAAI,UAAA,CAAW,WAAW,UAAA,EAAY;AAClC,MAAA,IAAI,OAAO,UAAA,CAAW,IAAA,EAAM,aAAA,KAAkB,QAAA,EAAU;AACpD,QAAA,MAAM,IAAI,mBAAA;AAAA,UACN,mBAAA;AAAA,UACA,CAAA,YAAA,EAAe,WAAW,EAAE,CAAA,oDAAA,CAAA;AAAA,UAC5B,UAAA,CAAW;AAAA,SACf;AAAA,MACJ;AAAA,IACJ;AAEA,IAAA,IAAI,CAAC,UAAA,CAAW,MAAA,IAAU,UAAA,CAAW,MAAA,CAAO,WAAW,CAAA,EAAG;AACtD,MAAA,MAAM,IAAI,mBAAA;AAAA,QACN,WAAA;AAAA,QACA,CAAA,YAAA,EAAe,WAAW,EAAE,CAAA,iCAAA,CAAA;AAAA,QAC5B,UAAA,CAAW;AAAA,OACf;AAAA,IACJ;AAEA,IAAA,IAAI,UAAA,CAAW,eAAe,MAAA,EAAW;AACrC,MAAA,MAAM,IAAI,mBAAA;AAAA,QACN,uBAAA;AAAA,QACA,CAAA,YAAA,EAAe,WAAW,EAAE,CAAA,gDAAA,CAAA;AAAA,QAC5B,UAAA,CAAW;AAAA,OACf;AAAA,IACJ;AAAA,EACJ;AACJ;AAEO,SAAS,YAAY,KAAA,EAA2B;AACnD,EAAA,IAAI;AACA,IAAA,iBAAA,CAAkB,KAAK,CAAA;AACvB,IAAA,OAAO,IAAA;AAAA,EACX,CAAA,CAAA,MAAQ;AACJ,IAAA,OAAO,KAAA;AAAA,EACX;AACJ;AC7HA,IAAM,OAAA,GAAU,IAAIC,aAAA,CAAY,EAAE,eAAe,KAAA,EAAO,UAAA,EAAY,OAAO,CAAA;AAK3E,IAAM,UAAA,GAAa,CAAA;AAKnB,IAAM,cAAA,GAAiB,EAAA;AAEvB,IAAM,gBAAA,GAA2C;AAAA,EAC7C,CAAC,EAAE,GAAG,OAAA;AAAA,EACN,CAAC,GAAG,GAAG,OAAA;AAAA,EACP,CAAC,GAAG,GAAG;AACX,CAAA;AAYO,SAAS,gBAAgB,KAAA,EAA8B;AAC1D,EAAA,IAAI,KAAA,GAAiB,OAAA,CAAQ,MAAA,CAAO,KAAK,CAAA;AACzC,EAAA,IAAI,KAAA,YAAiBC,SAAA,IAAO,KAAA,CAAM,GAAA,KAAQ,EAAA,EAAI;AAE1C,IAAA,MAAM,WAAW,KAAA,CAAM,KAAA;AACvB,IAAA,KAAA,GAAQ,QAAA,YAAoB,UAAA,GAAa,OAAA,CAAQ,MAAA,CAAO,QAAQ,CAAA,GAAI,QAAA;AAAA,EACxE;AACA,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,IAAK,KAAA,CAAM,WAAW,CAAA,EAAG;AAC7C,IAAA,MAAM,IAAI,yBAAyB,6CAA6C,CAAA;AAAA,EACpF;AACA,EAAA,MAAM,CAAC,oBAAA,EAAsB,iBAAA,EAAmB,UAAA,EAAY,SAAS,CAAA,GAAI,KAAA;AACzE,EAAA,IAAI,EAAE,gCAAgC,UAAA,CAAA,EAAa;AAC/C,IAAA,MAAM,IAAI,yBAAyB,4CAA4C,CAAA;AAAA,EACnF;AACA,EAAA,IAAI,EAAE,6BAA6B,GAAA,CAAA,EAAM;AACrC,IAAA,MAAM,IAAI,yBAAyB,6CAA6C,CAAA;AAAA,EACpF;AACA,EAAA,IAAI,EAAE,qBAAqB,UAAA,CAAA,EAAa;AACpC,IAAA,MAAM,IAAI,yBAAyB,qCAAqC,CAAA;AAAA,EAC5E;AAEA,EAAA,IAAI,eAAA;AACJ,EAAA,IAAI;AACA,IAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,MAAA,CAAO,oBAAoB,CAAA;AACnD,IAAA,IAAI,EAAE,mBAAmB,GAAA,CAAA,EAAM;AAC3B,MAAA,MAAM,IAAI,MAAM,4BAA4B,CAAA;AAAA,IAChD;AACA,IAAA,eAAA,GAAkB,OAAA;AAAA,EACtB,CAAA,CAAA,MAAQ;AACJ,IAAA,MAAM,IAAI,yBAAyB,mDAAmD,CAAA;AAAA,EAC1F;AAEA,EAAA,MAAM,QAAA,GAAW,eAAA,CAAgB,GAAA,CAAI,UAAU,CAAA;AAC/C,EAAA,MAAM,MAAM,OAAO,QAAA,KAAa,QAAA,GAAW,gBAAA,CAAiB,QAAQ,CAAA,GAAI,MAAA;AACxE,EAAA,IAAI,CAAC,GAAA,EAAK;AACN,IAAA,MAAM,IAAI,wBAAA,CAAyB,CAAA,mCAAA,EAAsC,MAAA,CAAO,QAAQ,CAAC,CAAA,CAAE,CAAA;AAAA,EAC/F;AAGA,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI,sBAAsB,UAAA,EAAY;AAClC,IAAA,OAAA,GAAU,UAAA;AAAA,EACd,CAAA,MAAA,IAAW,sBAAsBA,SAAA,IAAO,UAAA,CAAW,QAAQ,EAAA,IAAM,UAAA,CAAW,iBAAiB,UAAA,EAAY;AACrG,IAAA,OAAA,GAAU,UAAA,CAAW,KAAA;AAAA,EACzB,CAAA,MAAO;AACH,IAAA,MAAM,IAAI,yBAAyB,0CAA0C,CAAA;AAAA,EACjF;AAGA,EAAA,MAAM,KAAA,GAAQ,iBAAA,CAAkB,GAAA,CAAI,cAAc,CAAA;AAClD,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI,UAAU,MAAA,EAAW;AACrB,IAAA,MAAM,IAAI,yBAAyB,6DAA6D,CAAA;AAAA,EACpG;AACA,EAAA,IAAI,iBAAiB,UAAA,EAAY;AAC7B,IAAA,OAAA,GAAU,CAAC,KAAK,CAAA;AAAA,EACpB,CAAA,MAAA,IAAW,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,IAAK,KAAA,CAAM,KAAA,CAAM,CAAC,CAAA,KAAM,CAAA,YAAa,UAAU,CAAA,EAAG;AAC5E,IAAA,OAAA,GAAU,KAAA;AAAA,EACd,CAAA,MAAO;AACH,IAAA,MAAM,IAAI,yBAAyB,oDAAoD,CAAA;AAAA,EAC3F;AAEA,EAAA,OAAO;AAAA,IACH,oBAAA;AAAA,IACA,eAAA;AAAA,IACA,iBAAA;AAAA,IACA,OAAA;AAAA,IACA,SAAA;AAAA,IACA,OAAA;AAAA,IACA;AAAA,GACJ;AACJ;AAEA,IAAM,WAAA,GAAsC;AAAA,EACxC,KAAA,EAAO,SAAA;AAAA,EACP,KAAA,EAAO,SAAA;AAAA,EACP,KAAA,EAAO;AACX,CAAA;AAMA,eAAsB,eAAA,CAClB,SAAA,EACA,SAAA,EACA,iBAAA,EACa;AACb,EAAA,IAAI,CAAC,iBAAA,CAAkB,QAAA,CAAS,SAAA,CAAU,GAAG,CAAA,EAAG;AAC5C,IAAA,MAAM,IAAI,wBAAA,CAAyB,CAAA,qBAAA,EAAwB,SAAA,CAAU,GAAG,CAAA,iBAAA,CAAmB,CAAA;AAAA,EAC/F;AACA,EAAA,MAAM,OAAA,GAAU,WAAA,CAAY,SAAA,CAAU,GAAG,CAAA;AACzC,EAAA,IAAI,CAAC,OAAA,EAAS;AACV,IAAA,MAAM,IAAI,wBAAA,CAAyB,CAAA,wBAAA,EAA2B,SAAA,CAAU,GAAG,CAAA,CAAE,CAAA;AAAA,EACjF;AAKA,EAAA,MAAM,YAAA,GAAe,CAAC,YAAA,EAAc,SAAA,CAAU,oBAAA,EAAsB,IAAI,UAAA,CAAW,CAAC,CAAA,EAAG,SAAA,CAAU,OAAO,CAAA;AACxG,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,MAAA,CAAO,YAAY,CAAA;AAG5C,EAAA,MAAM,EAAA,GAAK,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA;AAAA,IAC3B,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,OAAA,EAAQ;AAAA,IAC/B,SAAA;AAAA,IACA,IAAI,UAAA,CAAW,SAAA,CAAU,SAAS,CAAA;AAAA,IAClC;AAAA,GACJ;AACA,EAAA,IAAI,CAAC,EAAA,EAAI;AACL,IAAA,MAAM,IAAI,yBAAyB,0CAA0C,CAAA;AAAA,EACjF;AACJ;AC1IA,IAAMC,QAAAA,GAAU,IAAIF,aAAAA,CAAY,EAAE,eAAe,KAAA,EAAO,UAAA,EAAY,OAAO,CAAA;AAE3E,IAAM,oCAAoB,IAAI,GAAA,CAAI,CAAC,SAAA,EAAW,SAAA,EAAW,SAAS,CAAC,CAAA;AAEnE,eAAsB,iBAAA,CAAkB,WAAuB,eAAA,EAA8C;AACzG,EAAA,IAAI,CAAC,iBAAA,CAAkB,GAAA,CAAI,eAAe,CAAA,EAAG;AACzC,IAAA,MAAM,IAAI,wBAAA,CAAyB,CAAA,0BAAA,EAA6B,eAAe,CAAA,CAAE,CAAA;AAAA,EACrF;AAEA,EAAA,MAAM,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,OAAO,eAAA,EAAiB,IAAI,UAAA,CAAW,SAAS,CAAC,CAAA;AACjF,EAAA,OAAO,IAAI,WAAW,GAAG,CAAA;AAC7B;AAEA,SAAS,UAAA,CAAW,GAAe,CAAA,EAAwB;AACvD,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,CAAE,MAAA,EAAQ,OAAO,KAAA;AAClC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,QAAQ,CAAA,EAAA,EAAK;AAC/B,IAAA,IAAI,EAAE,CAAC,CAAA,KAAM,CAAA,CAAE,CAAC,GAAG,OAAO,KAAA;AAAA,EAC9B;AACA,EAAA,OAAO,IAAA;AACX;AAWA,SAAS,cAAc,SAAA,EAA6C;AAChE,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI;AACA,IAAA,OAAA,GAAUE,QAAAA,CAAQ,OAAO,SAAS,CAAA;AAAA,EACtC,CAAA,CAAA,MAAQ;AACJ,IAAA,MAAM,IAAI,yBAAyB,wCAAwC,CAAA;AAAA,EAC/E;AAEA,EAAA,IAAI,KAAA;AACJ,EAAA,IAAI,mBAAmBD,SAAAA,IAAO,OAAA,CAAQ,QAAQ,EAAA,IAAM,OAAA,CAAQ,iBAAiB,UAAA,EAAY;AAErF,IAAA,KAAA,GAAQC,QAAAA,CAAQ,MAAA,CAAO,OAAA,CAAQ,KAAmB,CAAA;AAAA,EACtD,WACI,OAAA,KAAY,IAAA,IACZ,OAAO,OAAA,KAAY,QAAA,IACnB,EAAE,OAAA,YAAmBD,SAAAA,CAAAA,IACrB,EAAE,OAAA,YAAmB,GAAA,CAAA,IACrB,EAAE,OAAA,YAAmB,UAAA,CAAA,IACrB,WAAY,OAAA,IACX,OAAA,CAA+B,iBAAiB,UAAA,EACnD;AAEE,IAAA,KAAA,GAAQC,QAAAA,CAAQ,MAAA,CAAQ,OAAA,CAAkC,KAAK,CAAA;AAAA,EACnE,CAAA,MAAA,IAAW,mBAAmB,GAAA,EAAK;AAE/B,IAAA,KAAA,GAAQ,OAAA;AAAA,EACZ,CAAA,MAAO;AACH,IAAA,MAAM,IAAI,yBAAyB,oDAAoD,CAAA;AAAA,EAC3F;AAEA,EAAA,IAAI,EAAE,iBAAiB,GAAA,CAAA,EAAM;AACzB,IAAA,MAAM,IAAI,yBAAyB,uCAAuC,CAAA;AAAA,EAC9E;AACA,EAAA,OAAO,KAAA;AACX;AAUA,eAAsB,gBAAA,CAClB,YACA,GAAA,EACa;AACb,EAAA,KAAA,MAAW,CAAC,EAAA,EAAI,KAAK,CAAA,IAAK,UAAA,EAAY;AAClC,IAAA,MAAM,QAAA,GAAW,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,EAAE,CAAA;AACxC,IAAA,IAAI,CAAC,QAAA,EAAU;AACX,MAAA,MAAM,IAAI,wBAAA,CAAyB,CAAA,UAAA,EAAa,EAAE,CAAA,iCAAA,CAAmC,CAAA;AAAA,IACzF;AACA,IAAA,KAAA,MAAW,aAAa,KAAA,EAAO;AAE3B,MAAA,MAAM,IAAA,GAAO,MAAM,iBAAA,CAAkB,SAAA,EAAW,IAAI,eAAe,CAAA;AAGnE,MAAA,MAAM,IAAA,GAAO,cAAc,SAAS,CAAA;AACpC,MAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,CAAI,UAAU,CAAA;AACpC,MAAA,IAAI,OAAO,aAAa,QAAA,EAAU;AAC9B,QAAA,MAAM,IAAI,yBAAyB,mCAAmC,CAAA;AAAA,MAC1E;AAEA,MAAA,MAAM,cAAA,GAAiB,QAAA,CAAS,GAAA,CAAI,QAAQ,CAAA;AAC5C,MAAA,IAAI,CAAC,cAAA,EAAgB;AACjB,QAAA,MAAM,IAAI,wBAAA,CAAyB,CAAA,SAAA,EAAY,QAAQ,CAAA,+BAAA,EAAkC,EAAE,CAAA,CAAA,CAAG,CAAA;AAAA,MAClG;AACA,MAAA,IAAI,CAAC,UAAA,CAAW,IAAA,EAAM,cAAc,CAAA,EAAG;AACnC,QAAA,MAAM,IAAI,wBAAA,CAAyB,CAAA,uBAAA,EAA0B,EAAE,CAAA,UAAA,EAAa,QAAQ,CAAA,CAAE,CAAA;AAAA,MAC1F;AAAA,IACJ;AAAA,EACJ;AACJ;ACzGA,IAAMA,QAAAA,GAAU,IAAIF,aAAAA,CAAY,EAAE,eAAe,KAAA,EAAO,UAAA,EAAY,OAAO,CAAA;AAe3E,SAAS,eAAe,KAAA,EAAsB;AAC1C,EAAA,IAAI,KAAA,YAAiB,MAAM,OAAO,KAAA;AAClC,EAAA,IAAI,iBAAiBC,SAAAA,EAAK;AAEtB,IAAA,IAAI,MAAM,GAAA,KAAQ,CAAA,IAAK,OAAO,KAAA,CAAM,UAAU,QAAA,EAAU;AACpD,MAAA,OAAO,IAAI,IAAA,CAAK,KAAA,CAAM,KAAK,CAAA;AAAA,IAC/B;AACA,IAAA,IAAI,MAAM,GAAA,KAAQ,CAAA,IAAK,OAAO,KAAA,CAAM,UAAU,QAAA,EAAU;AACpD,MAAA,OAAO,IAAI,IAAA,CAAK,KAAA,CAAM,KAAA,GAAQ,GAAI,CAAA;AAAA,IACtC;AACA,IAAA,IAAI,MAAM,GAAA,KAAQ,IAAA,IAAQ,OAAO,KAAA,CAAM,UAAU,QAAA,EAAU;AACvD,MAAA,OAAO,IAAI,IAAA,CAAK,KAAA,CAAM,KAAK,CAAA;AAAA,IAC/B;AAAA,EACJ;AACA,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC3B,IAAA,OAAO,IAAI,KAAK,KAAK,CAAA;AAAA,EACzB;AACA,EAAA,MAAM,IAAI,wBAAA,CAAyB,CAAA,kCAAA,EAAqC,OAAO,KAAK,CAAA,CAAE,CAAA;AAC1F;AAEO,SAAS,UAAU,OAAA,EAA2C;AACjE,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACA,IAAA,GAAA,GAAMC,QAAAA,CAAQ,OAAO,OAAO,CAAA;AAI5B,IAAA,IAAI,eAAeD,SAAAA,IAAO,GAAA,CAAI,QAAQ,EAAA,IAAM,GAAA,CAAI,iBAAiB,UAAA,EAAY;AACzE,MAAA,GAAA,GAAMC,QAAAA,CAAQ,MAAA,CAAO,GAAA,CAAI,KAAK,CAAA;AAAA,IAClC,WACI,GAAA,KAAQ,IAAA,IACR,OAAO,GAAA,KAAQ,QAAA,IACf,EAAE,GAAA,YAAeD,SAAAA,CAAAA,IACjB,EAAE,GAAA,YAAe,GAAA,CAAA,IACjB,EAAE,GAAA,YAAe,UAAA,CAAA,IACjB,WAAY,GAAA,IACX,GAAA,CAA2B,iBAAiB,UAAA,EAC/C;AAME,MAAA,GAAA,GAAMC,QAAAA,CAAQ,MAAA,CAAQ,GAAA,CAA8B,KAAK,CAAA;AAAA,IAC7D;AAAA,EACJ,SAAS,GAAA,EAAK;AACV,IAAA,IAAI,GAAA,YAAe,0BAA0B,MAAM,GAAA;AACnD,IAAA,MAAM,IAAI,yBAAyB,mCAAmC,CAAA;AAAA,EAC1E;AACA,EAAA,IAAI,EAAE,eAAe,GAAA,CAAA,EAAM;AACvB,IAAA,MAAM,IAAI,yBAAyB,wBAAwB,CAAA;AAAA,EAC/D;AACA,EAAA,MAAM,CAAA,GAAI,GAAA;AAEV,EAAA,MAAM,OAAA,GAAU,CAAA,CAAE,GAAA,CAAI,SAAS,CAAA;AAC/B,EAAA,IAAI,OAAO,YAAY,QAAA,EAAU;AAC7B,IAAA,MAAM,IAAI,yBAAyB,8BAA8B,CAAA;AAAA,EACrE;AACA,EAAA,MAAM,eAAA,GAAkB,CAAA,CAAE,GAAA,CAAI,iBAAiB,CAAA;AAC/C,EAAA,IAAI,OAAO,oBAAoB,QAAA,EAAU;AACrC,IAAA,MAAM,IAAI,yBAAyB,sCAAsC,CAAA;AAAA,EAC7E;AACA,EAAA,MAAM,OAAA,GAAU,CAAA,CAAE,GAAA,CAAI,SAAS,CAAA;AAC/B,EAAA,IAAI,OAAO,YAAY,QAAA,EAAU;AAC7B,IAAA,MAAM,IAAI,yBAAyB,8BAA8B,CAAA;AAAA,EACrE;AAEA,EAAA,MAAM,KAAA,GAAQ,CAAA,CAAE,GAAA,CAAI,cAAc,CAAA;AAClC,EAAA,IAAI,EAAE,iBAAiB,GAAA,CAAA,EAAM;AACzB,IAAA,MAAM,IAAI,yBAAyB,gCAAgC,CAAA;AAAA,EACvE;AACA,EAAA,MAAM,YAAA,uBAAmB,GAAA,EAAqC;AAC9D,EAAA,KAAA,MAAW,CAAC,EAAA,EAAI,KAAK,CAAA,IAAK,KAAA,CAAM,SAAQ,EAAG;AACvC,IAAA,IAAI,OAAO,EAAA,KAAO,QAAA,IAAY,EAAE,iBAAiB,GAAA,CAAA,EAAM;AACnD,MAAA,MAAM,IAAI,yBAAyB,kCAAkC,CAAA;AAAA,IACzE;AACA,IAAA,MAAM,KAAA,uBAAY,GAAA,EAAwB;AAC1C,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,MAAM,CAAA,IAAM,KAAA,CAAgC,SAAQ,EAAG;AACnE,MAAA,IAAI,OAAO,EAAA,KAAO,QAAA,IAAY,EAAE,kBAAkB,UAAA,CAAA,EAAa;AAC3D,QAAA,MAAM,IAAI,yBAAyB,4CAAuC,CAAA;AAAA,MAC9E;AACA,MAAA,KAAA,CAAM,GAAA,CAAI,IAAI,MAAM,CAAA;AAAA,IACxB;AACA,IAAA,YAAA,CAAa,GAAA,CAAI,IAAI,KAAK,CAAA;AAAA,EAC9B;AAEA,EAAA,MAAM,KAAA,GAAQ,CAAA,CAAE,GAAA,CAAI,cAAc,CAAA;AAClC,EAAA,IAAI,EAAE,iBAAiB,GAAA,CAAA,EAAM;AACzB,IAAA,MAAM,IAAI,yBAAyB,gCAAgC,CAAA;AAAA,EACvE;AACA,EAAA,MAAM,EAAA,GAAK,KAAA;AACX,EAAA,MAAM,YAAA,GAAqD;AAAA,IACvD,MAAA,EAAQ,cAAA,CAAe,EAAA,CAAG,GAAA,CAAI,QAAQ,CAAC,CAAA;AAAA,IACvC,SAAA,EAAW,cAAA,CAAe,EAAA,CAAG,GAAA,CAAI,WAAW,CAAC,CAAA;AAAA,IAC7C,UAAA,EAAY,cAAA,CAAe,EAAA,CAAG,GAAA,CAAI,YAAY,CAAC;AAAA,GACnD;AACA,EAAA,IAAI,EAAA,CAAG,GAAA,CAAI,gBAAgB,CAAA,EAAG;AAC1B,IAAA,YAAA,CAAa,cAAA,GAAiB,cAAA,CAAe,EAAA,CAAG,GAAA,CAAI,gBAAgB,CAAC,CAAA;AAAA,EACzE;AAEA,EAAA,OAAO,EAAE,OAAA,EAAS,eAAA,EAAiB,YAAA,EAAc,SAAS,YAAA,EAAa;AAC3E;AAWO,SAAS,mBAAA,CAAoB,KAA2B,GAAA,EAAiB;AAC5E,EAAA,MAAM,EAAE,MAAA,EAAQ,SAAA,EAAW,UAAA,KAAe,GAAA,CAAI,YAAA;AAC9C,EAAA,IAAI,MAAA,CAAO,OAAA,EAAQ,GAAI,GAAA,CAAI,SAAQ,EAAG;AAClC,IAAA,MAAM,IAAI,wBAAA,CAAyB,CAAA,WAAA,EAAc,MAAA,CAAO,WAAA,EAAa,CAAA,iBAAA,CAAmB,CAAA;AAAA,EAC5F;AACA,EAAA,IAAI,SAAA,CAAU,OAAA,EAAQ,GAAI,GAAA,CAAI,SAAQ,EAAG;AACrC,IAAA,MAAM,IAAI,wBAAA,CAAyB,CAAA,cAAA,EAAiB,SAAA,CAAU,WAAA,EAAa,CAAA,iBAAA,CAAmB,CAAA;AAAA,EAClG;AACA,EAAA,IAAI,SAAA,CAAU,OAAA,EAAQ,GAAI,UAAA,CAAW,SAAQ,EAAG;AAC5C,IAAA,MAAM,IAAI,yBAAyB,mCAAmC,CAAA;AAAA,EAC1E;AACA,EAAA,IAAI,MAAA,CAAO,OAAA,EAAQ,GAAI,SAAA,CAAU,OAAA,EAAQ,IAAK,MAAA,CAAO,OAAA,EAAQ,GAAI,UAAA,CAAW,OAAA,EAAQ,EAAG;AACnF,IAAA,MAAM,IAAI,yBAAyB,2CAA2C,CAAA;AAAA,EAClF;AACA,EAAA,IAAI,UAAA,CAAW,OAAA,EAAQ,GAAI,GAAA,CAAI,SAAQ,EAAG;AACtC,IAAA,MAAM,IAAI,sBAAA,CAAuB,CAAA,eAAA,EAAkB,UAAA,CAAW,WAAA,EAAa,CAAA,eAAA,CAAiB,CAAA;AAAA,EAChG;AACJ;AAMO,SAAS,kBAAA,CAAmB,KAA2B,eAAA,EAA+B;AACzF,EAAA,IAAI,GAAA,CAAI,YAAY,eAAA,EAAiB;AACjC,IAAA,MAAM,IAAI,wBAAA,CAAyB,CAAA,YAAA,EAAe,IAAI,OAAO,CAAA,yBAAA,EAA4B,eAAe,CAAA,CAAE,CAAA;AAAA,EAC9G;AACJ;;;AClJA,IAAMA,QAAAA,GAAU,IAAIF,aAAAA,CAAY,EAAE,eAAe,KAAA,EAAO,UAAA,EAAY,OAAO,CAAA;AAC3E,IAAM,OAAA,GAAU,IAAIA,aAAAA,CAAY,EAAE,eAAe,KAAA,EAAO,UAAA,EAAY,OAAO,CAAA;AAE3E,IAAM,0BAAA,GAA6B,CAAC,OAAA,EAAS,OAAA,EAAS,OAAO,CAAA;AAE7D,SAASG,WAAAA,CAAW,GAAe,CAAA,EAAwB;AACvD,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,CAAE,MAAA,EAAQ,OAAO,KAAA;AAClC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,QAAQ,CAAA,EAAA,EAAK;AAC/B,IAAA,IAAI,EAAE,CAAC,CAAA,KAAM,CAAA,CAAE,CAAC,GAAG,OAAO,KAAA;AAAA,EAC9B;AACA,EAAA,OAAO,IAAA;AACX;AAEA,SAAS,SAAS,GAAA,EAAyB;AACvC,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,KAAA,MAAW,CAAA,IAAK,GAAA,EAAK,MAAA,IAAU,MAAA,CAAO,aAAa,CAAC,CAAA;AACpD,EAAA,MAAM,GAAA,GAAM,UAAA,CAAW,IAAA,CAAK,MAAM,CAAA;AAClC,EAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,KAAA,CAAM,UAAU,KAAK,EAAC;AACxC,EAAA,OAAO,CAAA;AAAA,EAAgC,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC;AAAA,yBAAA,CAAA;AAC3D;AAEA,SAAS,2BAA2B,QAAA,EAA8B;AAE9D,EAAA,OAAO,EAAA;AACX;AAgBA,SAAS,oBAAoB,IAAA,EAA2B;AACpD,EAAA,IAAI,gBAAgBF,SAAAA,IAAO,IAAA,CAAK,QAAQ,EAAA,IAAM,IAAA,CAAK,iBAAiB,UAAA,EAAY;AAC5E,IAAA,OAAO,IAAA,CAAK,KAAA;AAAA,EAChB;AACA,EAAA,IAAI,gBAAgB,UAAA,EAAY;AAC5B,IAAA,OAAO,IAAA;AAAA,EACX;AACA,EAAA,IACI,IAAA,KAAS,IAAA,IACT,OAAO,IAAA,KAAS,YAChB,EAAE,IAAA,YAAgBA,SAAAA,CAAAA,IAClB,EAAE,gBAAgB,GAAA,CAAA,IAClB,OAAA,IAAY,IAAA,IACX,IAAA,CAA4B,iBAAiB,UAAA,EAChD;AACE,IAAA,OAAQ,IAAA,CAA+B,KAAA;AAAA,EAC3C;AACA,EAAA,MAAM,IAAI,yBAAyB,+CAA+C,CAAA;AACtF;AAQA,SAAS,eAAe,UAAA,EAGtB;AACE,EAAA,MAAM,OAAyB,EAAC;AAChC,EAAA,MAAM,aAAsD,EAAC;AAC7D,EAAA,KAAA,MAAW,CAAC,EAAA,EAAI,KAAK,CAAA,IAAK,UAAA,CAAW,SAAQ,EAAG;AAC5C,IAAA,MAAM,QAAA,GAAoC,UAAA,CAAW,EAAE,CAAA,IAAK,EAAC;AAC7D,IAAA,KAAA,MAAW,aAAa,KAAA,EAAO;AAC3B,MAAA,IAAI,OAAA;AACJ,MAAA,IAAI;AACA,QAAA,OAAA,GAAUC,QAAAA,CAAQ,OAAO,SAAS,CAAA;AAAA,MACtC,CAAA,CAAA,MAAQ;AACJ,QAAA;AAAA,MACJ;AAGA,MAAA,IAAI,KAAA;AACJ,MAAA,IAAI,mBAAmBD,SAAAA,IAAO,OAAA,CAAQ,QAAQ,EAAA,IAAM,OAAA,CAAQ,iBAAiB,UAAA,EAAY;AAErF,QAAA,KAAA,GAAQC,QAAAA,CAAQ,MAAA,CAAO,OAAA,CAAQ,KAAmB,CAAA;AAAA,MACtD,WACI,OAAA,KAAY,IAAA,IACZ,OAAO,OAAA,KAAY,QAAA,IACnB,EAAE,OAAA,YAAmBD,SAAAA,CAAAA,IACrB,EAAE,OAAA,YAAmB,GAAA,CAAA,IACrB,EAAE,OAAA,YAAmB,UAAA,CAAA,IACrB,WAAY,OAAA,IACX,OAAA,CAA+B,iBAAiB,UAAA,EACnD;AAEE,QAAA,KAAA,GAAQC,QAAAA,CAAQ,MAAA,CAAQ,OAAA,CAAkC,KAAK,CAAA;AAAA,MACnE,CAAA,MAAA,IAAW,mBAAmB,GAAA,EAAK;AAE/B,QAAA,KAAA,GAAQ,OAAA;AAAA,MACZ,CAAA,MAAO;AACH,QAAA;AAAA,MACJ;AAEA,MAAA,IAAI,iBAAiB,GAAA,EAAK;AACtB,QAAA,MAAM,EAAA,GAAM,KAAA,CAA+B,GAAA,CAAI,mBAAmB,CAAA;AAClE,QAAA,MAAM,GAAA,GAAO,KAAA,CAA+B,GAAA,CAAI,cAAc,CAAA;AAC9D,QAAA,IAAI,OAAO,OAAO,QAAA,EAAU;AACxB,UAAC,IAAA,CAAiC,EAAE,CAAA,GAAI,GAAA;AACxC,UAAA,QAAA,CAAS,EAAE,CAAA,GAAI,GAAA;AAAA,QACnB;AAAA,MACJ;AAAA,IACJ;AACA,IAAA,UAAA,CAAW,EAAE,CAAA,GAAI,QAAA;AAAA,EACrB;AACA,EAAA,OAAO,EAAE,MAAM,UAAA,EAAW;AAC9B;AAaO,IAAM,aAAN,MAA8C;AAAA,EACxC,MAAA,GAA2B,MAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOpC,SAAS,OAAA,EAA2B;AAChC,IAAA,OAAO,OAAA,YAAmB,UAAA;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,KAAA,CAAM,OAAA,EAAkB,OAAA,EAAoD;AAC9E,IAAA,IAAI,EAAE,mBAAmB,UAAA,CAAA,EAAa;AAClC,MAAA,MAAM,IAAI,yBAAyB,mCAAmC,CAAA;AAAA,IAC1E;AACA,IAAA,MAAM,iBAAA,GAAoB,QAAQ,iBAAA,IAAqB,0BAAA;AAGvD,IAAA,IAAI,cAAA;AACJ,IAAA,IAAI;AACA,MAAA,MAAM,OAAA,GAAUA,QAAAA,CAAQ,MAAA,CAAO,OAAO,CAAA;AACtC,MAAA,IAAI,EAAE,OAAA,YAAmB,GAAA,CAAA,EAAM,MAAM,IAAI,KAAA,EAAM;AAC/C,MAAA,cAAA,GAAiB,OAAA;AAAA,IACrB,CAAA,CAAA,MAAQ;AACJ,MAAA,MAAM,IAAI,yBAAyB,0CAA0C,CAAA;AAAA,IACjF;AAGA,IAAA,MAAM,IAAA,GAAO,cAAA,CAAe,GAAA,CAAI,WAAW,CAAA;AAC3C,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,IAAK,IAAA,CAAK,WAAW,CAAA,EAAG;AAC3C,MAAA,MAAM,IAAI,yBAAyB,iCAAiC,CAAA;AAAA,IACxE;AACA,IAAA,MAAM,QAAA,GAAW,KAAK,CAAC,CAAA;AACvB,IAAA,IAAI,EAAE,oBAAoB,GAAA,CAAA,EAAM;AAC5B,MAAA,MAAM,IAAI,yBAAyB,wBAAwB,CAAA;AAAA,IAC/D;AACA,IAAA,MAAM,YAAA,GAAe,QAAA,CAAS,GAAA,CAAI,cAAc,CAAA;AAChD,IAAA,IAAI,EAAE,wBAAwB,GAAA,CAAA,EAAM;AAChC,MAAA,MAAM,IAAI,yBAAyB,qCAAqC,CAAA;AAAA,IAC5E;AACA,IAAA,MAAM,UAAA,GAAa,YAAA,CAAa,GAAA,CAAI,YAAY,CAAA;AAChD,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,UAAU,CAAA,EAAG;AAC5B,MAAA,MAAM,IAAI,yBAAyB,uCAAuC,CAAA;AAAA,IAC9E;AAGA,IAAA,MAAM,eAAA,GAAkB,OAAA,CAAQ,MAAA,CAAO,UAAU,CAAA;AAGjD,IAAA,MAAM,IAAA,GAAO,gBAAgB,eAAe,CAAA;AAC5C,IAAA,IAAI,CAAC,iBAAA,CAAkB,QAAA,CAAS,IAAA,CAAK,GAAG,CAAA,EAAG;AACvC,MAAA,OAAO;AAAA,QACH,KAAA,EAAO,KAAA;AAAA,QACP,QAAQ,IAAA,CAAK,MAAA;AAAA,QACb,QAAQ,EAAC;AAAA,QACT,QAAQ,EAAE,WAAA,EAAa,IAAI,UAAA,EAAW,EAAG,SAAS,EAAA,EAAG;AAAA,QACrD,KAAA,EAAO,CAAA,uBAAA,EAA0B,IAAA,CAAK,GAAG,CAAA;AAAA,OAC7C;AAAA,IACJ;AAGA,IAAA,MAAM,eAAA,GAAkB,IAAA,CAAK,OAAA,CAAQ,CAAC,CAAA;AACtC,IAAA,IAAI,CAAC,eAAA,EAAiB;AAClB,MAAA,MAAM,IAAI,yBAAyB,uCAAuC,CAAA;AAAA,IAC9E;AACA,IAAA,IAAI,OAAA,CAAQ,mBAAA,CAAoB,MAAA,KAAW,CAAA,EAAG;AAC1C,MAAA,IAAI,OAAA,CAAQ,mBAAmB,IAAA,EAAM;AACjC,QAAA,MAAM,IAAI,wBAAA;AAAA,UACN;AAAA,SACJ;AAAA,MACJ;AAAA,IACJ,CAAA,MAAO;AACH,MAAA,MAAM,OAAA,GAAU,QAAQ,mBAAA,CAAoB,IAAA,CAAK,CAAC,CAAA,KAAMC,WAAAA,CAAW,CAAA,EAAG,eAAe,CAAC,CAAA;AACtF,MAAA,IAAI,CAAC,OAAA,EAAS;AACV,QAAA,OAAO;AAAA,UACH,KAAA,EAAO,KAAA;AAAA,UACP,QAAQ,IAAA,CAAK,MAAA;AAAA,UACb,QAAQ,EAAC;AAAA,UACT,MAAA,EAAQ,EAAE,WAAA,EAAa,eAAA,EAAiB,SAAS,EAAA,EAAG;AAAA,UACpD,KAAA,EAAO;AAAA,SACX;AAAA,MACJ;AAAA,IACJ;AAGA,IAAA,MAAM,YAAY,MAAMC,eAAA,CAAW,SAAS,eAAe,CAAA,EAAG,KAAK,GAAG,CAAA;AACtE,IAAA,IAAI;AACA,MAAA,MAAM,eAAA,CAAgB,IAAA,EAAM,SAAA,EAAW,iBAAiB,CAAA;AAAA,IAC5D,SAAS,GAAA,EAAK;AACV,MAAA,IAAI,eAAe,wBAAA,EAA0B;AACzC,QAAA,OAAO;AAAA,UACH,KAAA,EAAO,KAAA;AAAA,UACP,QAAQ,IAAA,CAAK,MAAA;AAAA,UACb,QAAQ,EAAC;AAAA,UACT,MAAA,EAAQ,EAAE,WAAA,EAAa,eAAA,EAAiB,SAAS,EAAA,EAAG;AAAA,UACpD,OAAO,GAAA,CAAI;AAAA,SACf;AAAA,MACJ;AACA,MAAA,MAAM,GAAA;AAAA,IACV;AAGA,IAAA,MAAM,GAAA,GAAM,SAAA,CAAU,IAAA,CAAK,OAAO,CAAA;AAClC,IAAA,IAAI;AACA,MAAA,mBAAA,CAAoB,GAAA,kBAAK,IAAI,IAAA,EAAM,CAAA;AAAA,IACvC,SAAS,GAAA,EAAK;AACV,MAAA,IAAI,eAAe,sBAAA,EAAwB;AACvC,QAAA,OAAO;AAAA,UACH,KAAA,EAAO,KAAA;AAAA,UACP,QAAQ,IAAA,CAAK,MAAA;AAAA,UACb,QAAQ,EAAC;AAAA,UACT,MAAA,EAAQ,EAAE,WAAA,EAAa,eAAA,EAAiB,SAAS,EAAA,EAAG;AAAA,UACpD,KAAA,EAAO;AAAA,SACX;AAAA,MACJ;AACA,MAAA,MAAM,GAAA;AAAA,IACV;AAEA,IAAA,IAAI,OAAA,CAAQ,oBAAoB,MAAA,EAAW;AACvC,MAAA,IAAI;AACA,QAAA,kBAAA,CAAmB,GAAA,EAAK,QAAQ,eAAe,CAAA;AAAA,MACnD,SAAS,GAAA,EAAK;AACV,QAAA,IAAI,eAAe,wBAAA,EAA0B;AACzC,UAAA,OAAO;AAAA,YACH,KAAA,EAAO,KAAA;AAAA,YACP,QAAQ,IAAA,CAAK,MAAA;AAAA,YACb,QAAQ,EAAC;AAAA,YACT,MAAA,EAAQ,EAAE,WAAA,EAAa,eAAA,EAAiB,SAAS,EAAA,EAAG;AAAA,YACpD,OAAO,GAAA,CAAI;AAAA,WACf;AAAA,QACJ;AACA,QAAA,MAAM,GAAA;AAAA,MACV;AAAA,IACJ;AAGA,IAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,GAAA,CAAI,YAAY,CAAA;AAC3C,IAAA,IAAI,EAAE,iBAAiB,GAAA,CAAA,EAAM;AACzB,MAAA,MAAM,IAAI,yBAAyB,uCAAuC,CAAA;AAAA,IAC9E;AACA,IAAA,MAAM,UAAA,uBAAiB,GAAA,EAA0B;AACjD,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,KAAK,CAAA,IAAM,KAAA,CAAgC,SAAQ,EAAG;AAClE,MAAA,IAAI,OAAO,EAAA,KAAO,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACjD,QAAA,MAAM,IAAI,yBAAyB,4BAA4B,CAAA;AAAA,MACnE;AACA,MAAA,UAAA,CAAW,GAAA,CAAI,EAAA,EAAI,KAAA,CAAM,GAAA,CAAI,mBAAmB,CAAC,CAAA;AAAA,IACrD;AACA,IAAA,MAAM,gBAAA,CAAiB,YAAY,GAAG,CAAA;AAGtC,IAAA,MAAM,EAAE,IAAA,EAAM,MAAA,EAAQ,YAAY,gBAAA,EAAiB,GAAI,eAAe,UAAU,CAAA;AAEhF,IAAA,MAAM,MAAA,GAAqB;AAAA,MACvB,WAAA,EAAa,eAAA;AAAA,MACb,OAAA,EAAS,2BAA0C;AAAA,KACvD;AACA,IAAA,OAAO;AAAA,MACH,KAAA,EAAO,IAAA;AAAA,MACP,QAAQ,IAAA,CAAK,MAAA;AAAA,MACb,MAAA;AAAA,MACA,MAAA;AAAA,MACA,SAAS,GAAA,CAAI,OAAA;AAAA,MACb;AAAA,KACJ;AAAA,EACJ;AACJ;AC5SA,IAAMC,2BAAAA,GAA6B,CAAC,OAAA,EAAS,OAAA,EAAS,OAAO,CAAA;AAM7D,IAAM,YAAA,GAA4B,OAAO,IAAA,EAA4B,IAAA,KAAsC;AACvG,EAAA,MAAMC,QAAAA,GAAU,IAAI,WAAA,EAAY;AAChC,EAAA,MAAM,QAAQ,OAAO,IAAA,KAAS,WAAWA,QAAAA,CAAQ,MAAA,CAAO,IAAI,CAAA,GAAI,IAAA;AAChE,EAAA,MAAM,aAAa,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,WAAW,KAAK,CAAA;AAC9D,EAAA,OAAO,IAAI,WAAW,UAAU,CAAA;AACpC,CAAA;AAGA,IAAM,YAAA,GAAe,kEAAA;AAMrB,SAAS,cAAc,MAAA,EAAyC;AAC5D,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AACxC,EAAA,MAAM,aAAa,IAAA,CAAK,KAAA,CAAO,OAAA,CAAQ,MAAA,GAAS,IAAK,CAAC,CAAA;AACtD,EAAA,MAAM,MAAA,GAAS,IAAI,WAAA,CAAY,UAAU,CAAA;AACzC,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,MAAM,CAAA;AAEnC,EAAA,IAAI,SAAA,GAAY,CAAA;AAChB,EAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,OAAA,CAAQ,MAAA,EAAQ,KAAK,CAAA,EAAG;AACxC,IAAA,MAAM,CAAA,GAAI,YAAA,CAAa,OAAA,CAAQ,OAAA,CAAQ,CAAC,CAAC,CAAA;AACzC,IAAA,MAAM,CAAA,GAAI,CAAA,GAAI,CAAA,GAAI,OAAA,CAAQ,MAAA,GAAS,YAAA,CAAa,OAAA,CAAQ,OAAA,CAAQ,CAAA,GAAI,CAAC,CAAC,CAAA,GAAI,CAAA;AAC1E,IAAA,MAAM,CAAA,GAAI,CAAA,GAAI,CAAA,GAAI,OAAA,CAAQ,MAAA,GAAS,YAAA,CAAa,OAAA,CAAQ,OAAA,CAAQ,CAAA,GAAI,CAAC,CAAC,CAAA,GAAI,CAAA;AAC1E,IAAA,MAAM,CAAA,GAAI,CAAA,GAAI,CAAA,GAAI,OAAA,CAAQ,MAAA,GAAS,YAAA,CAAa,OAAA,CAAQ,OAAA,CAAQ,CAAA,GAAI,CAAC,CAAC,CAAA,GAAI,CAAA;AAE1E,IAAA,KAAA,CAAM,SAAA,EAAW,CAAA,GAAK,CAAA,IAAK,CAAA,GAAM,CAAA,IAAK,CAAA;AACtC,IAAA,IAAI,SAAA,GAAY,YAAY,KAAA,CAAM,SAAA,EAAW,KAAM,CAAA,GAAI,EAAA,KAAS,IAAM,CAAA,IAAK,CAAA;AAC3E,IAAA,IAAI,YAAY,UAAA,EAAY,KAAA,CAAM,WAAW,CAAA,GAAA,CAAM,CAAA,GAAI,MAAS,CAAA,GAAK,CAAA;AAAA,EACzE;AAEA,EAAA,OAAO,KAAA;AACX;AAKA,SAASH,WAAAA,CAAW,GAAe,CAAA,EAAwB;AACvD,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,CAAE,MAAA,EAAQ,OAAO,KAAA;AAClC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,QAAQ,CAAA,EAAA,EAAK;AAC/B,IAAA,IAAI,EAAE,CAAC,CAAA,KAAM,CAAA,CAAE,CAAC,GAAG,OAAO,KAAA;AAAA,EAC9B;AACA,EAAA,OAAO,IAAA;AACX;AAKA,SAASI,UAAS,SAAA,EAA2B;AACzC,EAAA,MAAM,KAAA,GAAQ,SAAA,CAAU,KAAA,CAAM,UAAU,KAAK,EAAC;AAC9C,EAAA,OAAO,CAAA;AAAA,EAAgC,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC;AAAA,yBAAA,CAAA;AAC3D;AAMA,SAAS,iBAAiB,KAAA,EAA2B;AACjD,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACtB,IAAA,MAAA,IAAU,MAAA,CAAO,aAAa,IAAI,CAAA;AAAA,EACtC;AACA,EAAA,OAAO,UAAA,CAAW,IAAA,CAAK,MAAM,CAAA,CAAE,QAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC5F;AAMA,SAAS,sBAAsB,GAAA,EAAgD;AAC3E,EAAA,MAAM,SAA2B,EAAC;AAElC,EAAA,IAAI,OAAO,GAAA,CAAI,aAAa,CAAA,KAAM,SAAA,EAAW;AACzC,IAAA,MAAA,CAAO,WAAA,GAAc,IAAI,aAAa,CAAA;AAAA,EAC1C;AACA,EAAA,IAAI,OAAO,GAAA,CAAI,aAAa,CAAA,KAAM,SAAA,EAAW;AACzC,IAAA,MAAA,CAAO,WAAA,GAAc,IAAI,aAAa,CAAA;AAAA,EAC1C;AACA,EAAA,IAAI,OAAO,GAAA,CAAI,kBAAkB,CAAA,KAAM,QAAA,EAAU;AAC7C,IAAA,MAAA,CAAO,gBAAA,GAAmB,IAAI,kBAAkB,CAAA;AAAA,EACpD;AACA,EAAA,IAAI,OAAO,GAAA,CAAI,aAAa,CAAA,KAAM,QAAA,EAAU;AACxC,IAAA,MAAA,CAAO,WAAA,GAAc,IAAI,aAAa,CAAA;AAAA,EAC1C;AACA,EAAA,IAAI,OAAO,GAAA,CAAI,mBAAmB,CAAA,KAAM,QAAA,EAAU;AAC9C,IAAA,MAAA,CAAO,iBAAA,GAAoB,IAAI,mBAAmB,CAAA;AAAA,EACtD;AAEA,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAA,EAAG;AAC5C,IAAA,IACI,EAAE,GAAA,IAAO,MAAA,CAAA,IACT,CAAC,GAAA,CAAI,WAAW,KAAK,CAAA,IACrB,GAAA,KAAQ,KAAA,IACR,QAAQ,KAAA,IACR,GAAA,KAAQ,SACR,GAAA,KAAQ,KAAA,IACR,QAAQ,KAAA,EACV;AACE,MAAA,MAAA,CAAO,GAAG,CAAA,GAAI,KAAA;AAAA,IAClB;AAAA,EACJ;AAEA,EAAA,OAAO,MAAA;AACX;AAKA,SAAS,mBAAmB,MAAA,EAAwB;AAChD,EAAA,IAAI;AACA,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,MAAM,CAAA;AAC1B,IAAA,MAAM,GAAA,GAAM,IAAI,QAAA,CAAS,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,IAAO,WAAA,EAAY;AACvD,IAAA,IAAI,GAAA,IAAO,GAAA,CAAI,MAAA,KAAW,CAAA,EAAG;AACzB,MAAA,OAAO,GAAA;AAAA,IACX;AAAA,EACJ,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,OAAO,EAAA;AACX;AAYO,IAAM,cAAN,MAA+C;AAAA,EACzC,MAAA,GAA2B,WAAA;AAAA,EAEpC,SAAS,OAAA,EAA2B;AAChC,IAAA,OAAO,OAAO,OAAA,KAAY,QAAA,IAAY,OAAA,CAAQ,SAAS,GAAG,CAAA;AAAA,EAC9D;AAAA,EAEA,MAAM,KAAA,CAAM,OAAA,EAAkB,OAAA,EAAoD;AAC9E,IAAA,IAAI,OAAO,YAAY,QAAA,EAAU;AAC7B,MAAA,MAAM,IAAI,yBAAyB,2BAA2B,CAAA;AAAA,IAClE;AAEA,IAAA,MAAM,iBAAA,GAAoB,QAAQ,iBAAA,IAAqBF,2BAAAA;AAEvD,IAAA,MAAM,aAAA,GAAgB,CAAC,KAAA,MAAuC;AAAA,MAC1D,KAAA,EAAO,KAAA;AAAA,MACP,QAAQ,IAAA,CAAK,MAAA;AAAA,MACb,QAAQ,EAAC;AAAA,MACT,QAAQ,EAAE,WAAA,EAAa,IAAI,UAAA,EAAW,EAAG,SAAS,EAAA,EAAG;AAAA,MACrD;AAAA,KACJ,CAAA;AAGA,IAAA,IAAI,KAAA;AACJ,IAAA,IAAI;AACA,MAAA,KAAA,GAAQG,kBAAW,OAAO,CAAA;AAAA,IAC9B,CAAA,CAAA,MAAQ;AACJ,MAAA,MAAM,IAAI,yBAAyB,kCAAkC,CAAA;AAAA,IACzE;AAGA,IAAA,IAAI,MAAA;AACJ,IAAA,IAAI;AACA,MAAA,MAAA,GAASC,0BAAA,CAAsB,MAAM,GAAG,CAAA;AAAA,IAC5C,CAAA,CAAA,MAAQ;AACJ,MAAA,MAAM,IAAI,yBAAyB,2CAA2C,CAAA;AAAA,IAClF;AAGA,IAAA,MAAM,MAAM,MAAA,CAAO,GAAA;AACnB,IAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,CAAC,iBAAA,CAAkB,QAAA,CAAS,GAAG,CAAA,EAAG;AAC7D,MAAA,OAAO,aAAA,CAAc,CAAA,uBAAA,EAA0B,GAAG,CAAA,CAAE,CAAA;AAAA,IACxD;AAGA,IAAA,MAAM,WAAW,MAAA,CAAO,GAAA;AACxB,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,QAAQ,CAAA,IAAK,QAAA,CAAS,MAAA,KAAW,CAAA,IAAK,OAAO,QAAA,CAAS,CAAC,CAAA,KAAM,QAAA,EAAU;AACtF,MAAA,MAAM,IAAI,yBAAyB,sCAAsC,CAAA;AAAA,IAC7E;AAEA,IAAA,IAAI,SAAA;AACJ,IAAA,IAAI,eAAA;AACJ,IAAA,IAAI;AACA,MAAA,SAAA,GAAY,MAAML,eAAAA,CAAWG,SAAAA,CAAS,SAAS,CAAC,CAAC,GAAG,GAAG,CAAA;AACvD,MAAA,eAAA,GAAkB,aAAA,CAAc,QAAA,CAAS,CAAC,CAAC,CAAA;AAAA,IAC/C,SAAS,GAAA,EAAK;AACV,MAAA,IAAI,GAAA,YAAe,0BAA0B,MAAM,GAAA;AACnD,MAAA,MAAM,IAAI,yBAAyB,qCAAqC,CAAA;AAAA,IAC5E;AAGA,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACA,MAAA,MAAM,MAAA,GAAS,MAAMG,cAAA,CAAU,KAAA,CAAM,KAAK,SAAA,EAAW,EAAE,UAAA,EAAY,iBAAA,EAAmB,CAAA;AACtF,MAAA,OAAA,GAAU,MAAA,CAAO,OAAA;AAAA,IACrB,CAAA,CAAA,MAAQ;AACJ,MAAA,OAAO,cAAc,0CAA0C,CAAA;AAAA,IACnE;AAIA,IAAA,MAAM,YAAA,GAAe,OAAO,OAAA,CAAQ,KAAK,MAAM,QAAA,GAAW,OAAA,CAAQ,KAAK,CAAA,GAAI,EAAA;AAC3E,IAAA,MAAM,UAAA,GAAyB;AAAA,MAC3B,WAAA,EAAa,eAAA;AAAA,MACb,OAAA,EAAS,mBAAmB,YAAY;AAAA,KAC5C;AAEA,IAAA,IAAI,OAAA,CAAQ,mBAAA,CAAoB,MAAA,KAAW,CAAA,EAAG;AAC1C,MAAA,IAAI,OAAA,CAAQ,mBAAmB,IAAA,EAAM;AACjC,QAAA,MAAM,IAAI,wBAAA;AAAA,UACN;AAAA,SACJ;AAAA,MACJ;AAAA,IACJ,CAAA,MAAO;AACH,MAAA,MAAM,SAAA,GAAY,QAAQ,mBAAA,CAAoB,IAAA,CAAK,CAAC,OAAA,KAAYP,WAAAA,CAAW,OAAA,EAAS,eAAe,CAAC,CAAA;AACpG,MAAA,IAAI,CAAC,SAAA,EAAW;AACZ,QAAA,OAAO,cAAc,mCAAmC,CAAA;AAAA,MAC5D;AAAA,IACJ;AAGA,IAAA,MAAM,OAAA,GAAU,QAAQ,KAAK,CAAA;AAC7B,IAAA,IAAI,KAAA,CAAM,WAAA,CAAY,MAAA,GAAS,CAAA,EAAG;AAC9B,MAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,IAAK,OAAA,CAAQ,WAAW,CAAA,EAAG;AACjD,QAAA,OAAO,cAAc,oDAAoD,CAAA;AAAA,MAC7E;AACA,MAAA,KAAA,MAAW,UAAA,IAAc,MAAM,WAAA,EAAa;AACxC,QAAA,MAAM,SAAA,GAAY,MAAM,YAAA,CAAa,UAAqB,CAAA;AAC1D,QAAA,MAAM,UAAA,GAAa,iBAAiB,SAAS,CAAA;AAC7C,QAAA,IAAI,CAAC,OAAA,CAAQ,QAAA,CAAS,UAAU,CAAA,EAAG;AAC/B,UAAA,OAAO,cAAc,0BAA0B,CAAA;AAAA,QACnD;AAAA,MACJ;AAAA,IACJ;AAGA,IAAA,IAAI,MAAM,KAAA,EAAO;AAEb,MAAA,MAAM,GAAA,GAAM,QAAQ,KAAK,CAAA;AACzB,MAAA,IAAI,CAAC,OAAO,OAAO,GAAA,KAAQ,YAAY,CAAC,GAAA,CAAI,KAAK,CAAA,EAAG;AAChD,QAAA,MAAM,IAAI,yBAAyB,+CAA+C,CAAA;AAAA,MACtF;AAEA,MAAA,IAAI,SAAA;AACJ,MAAA,IAAI;AACA,QAAA,MAAM,QAAA,GAAWM,0BAAA,CAAsB,KAAA,CAAM,KAAK,CAAA;AAClD,QAAA,MAAM,QAAQ,QAAA,CAAS,GAAA;AACvB,QAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,iBAAA,CAAkB,QAAA,CAAS,KAAK,CAAA,EAAG;AACjE,UAAA,OAAO,aAAA,CAAc,CAAA,8BAAA,EAAiC,KAAK,CAAA,CAAE,CAAA;AAAA,QACjE;AACA,QAAA,SAAA,GAAY,MAAME,cAAA,CAAU,GAAA,CAAI,KAAK,GAA8B,KAAK,CAAA;AAAA,MAC5E,SAAS,GAAA,EAAK;AACV,QAAA,IAAI,GAAA,YAAe,0BAA0B,MAAM,GAAA;AACnD,QAAA,MAAM,IAAI,yBAAyB,0CAA0C,CAAA;AAAA,MACjF;AAGA,MAAA,IAAI,SAAA;AACJ,MAAA,IAAI;AACA,QAAA,MAAM,QAAA,GAAW,MAAMD,cAAA,CAAU,KAAA,CAAM,OAAO,SAAA,EAAW;AAAA,UACrD,UAAA,EAAY,iBAAA;AAAA,UACZ,GAAI,QAAQ,QAAA,GAAW,EAAE,UAAU,OAAA,CAAQ,QAAA,KAAa;AAAC,SAC5D,CAAA;AACD,QAAA,SAAA,GAAY,QAAA,CAAS,OAAA;AAAA,MACzB,CAAA,CAAA,MAAQ;AACJ,QAAA,OAAO,cAAc,+CAA+C,CAAA;AAAA,MACxE;AAGA,MAAA,IAAI,SAAA,CAAU,OAAO,CAAA,KAAM,OAAA,CAAQ,KAAA,EAAO;AACtC,QAAA,OAAO,cAAc,sCAAsC,CAAA;AAAA,MAC/D;AAGA,MAAA,MAAM,cAAA,GAAiB,KAAA,CAAM,WAAA,CAAY,MAAA,GAAS,CAAA,GAAI,MAAM,WAAA,CAAY,IAAA,CAAK,GAAG,CAAA,GAAI,GAAA,GAAM,EAAA;AAC1F,MAAA,MAAM,YAAA,GAAe,KAAA,CAAM,GAAA,GAAM,GAAA,GAAM,cAAA;AACvC,MAAA,MAAM,WAAA,GAAc,MAAM,YAAA,CAAa,YAAuB,CAAA;AAC9D,MAAA,MAAM,cAAA,GAAiB,iBAAiB,WAAW,CAAA;AACnD,MAAA,IAAI,SAAA,CAAU,SAAS,CAAA,KAAM,cAAA,EAAgB;AACzC,QAAA,OAAO,cAAc,wCAAwC,CAAA;AAAA,MACjE;AAAA,IACJ;AAGA,IAAA,IAAI,cAAA;AACJ,IAAA,IAAI;AACA,MAAA,MAAM,OAAA,GAAU,MAAME,kBAAA,CAAY,OAAA,EAAS,YAAY,CAAA;AACvD,MAAA,cAAA,GAAiB,MAAMC,gBAAA;AAAA,QACnB,QAAQ,GAAA,CAAI,OAAA;AAAA,QACZ,OAAA,CAAQ,WAAA;AAAA,QACR;AAAA,OACJ;AAAA,IACJ,CAAA,CAAA,MAAQ;AACJ,MAAA,MAAM,IAAI,yBAAyB,qCAAqC,CAAA;AAAA,IAC5E;AAEA,IAAA,MAAM,GAAA,GAAM,OAAO,OAAA,CAAQ,KAAK,MAAM,QAAA,GAAY,OAAA,CAAQ,KAAK,CAAA,GAAe,MAAA;AAE9E,IAAA,OAAO;AAAA,MACH,KAAA,EAAO,IAAA;AAAA,MACP,QAAQ,IAAA,CAAK,MAAA;AAAA,MACb,MAAA,EAAQ,sBAAsB,cAAc,CAAA;AAAA,MAC5C,MAAA,EAAQ,UAAA;AAAA,MACR,GAAI,GAAA,KAAQ,MAAA,GAAY,EAAE,GAAA,KAAQ;AAAC,KACvC;AAAA,EACJ;AACJ;;;ACpUA,IAAM,UAA+B,CAAC,IAAI,aAAY,EAAG,IAAI,YAAY,CAAA;AAEzE,eAAsB,iBAAA,CAAkB,SAAkB,OAAA,EAAoD;AAC1G,EAAA,KAAA,MAAW,UAAU,OAAA,EAAS;AAC1B,IAAA,IAAI,MAAA,CAAO,QAAA,CAAS,OAAO,CAAA,EAAG;AAC1B,MAAA,OAAO,MAAA,CAAO,KAAA,CAAM,OAAA,EAAS,OAAO,CAAA;AAAA,IACxC;AAAA,EACJ;AAEA,EAAA,OAAO;AAAA,IACH,KAAA,EAAO,KAAA;AAAA,IACP,MAAA,EAAQ,WAAA;AAAA,IACR,QAAQ,EAAC;AAAA,IACT,QAAQ,EAAE,WAAA,EAAa,IAAI,UAAA,EAAW,EAAG,SAAS,EAAA,EAAG;AAAA,IACrD,KAAA,EAAO;AAAA,GACX;AACJ;ACFA,IAAM,uBAAA,GAA4D;AAAA,EAC9D,WAAA,EAAa,WAAA;AAAA,EACb,IAAA,EAAM;AACV,CAAA;AAcA,SAAS,gBAAA,CACL,KAAA,EACA,OAAA,EACA,SAAA,EACe;AACf,EAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,KAAA,CAAM,MAAA,EAAQ,OAAO,iBAAA;AAE5C,EAAA,IAAI,KAAA,CAAM,WAAW,WAAA,EAAa;AAC9B,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,EAAM,UAAA;AAC5B,IAAA,IAAI,OAAA,IAAW,OAAA,CAAQ,MAAA,GAAS,CAAA,IAAK,CAAC,QAAQ,QAAA,CAAS,OAAA,CAAQ,GAAA,IAAO,EAAE,CAAA,EAAG;AACvE,MAAA,OAAO,cAAA;AAAA,IACX;AAAA,EACJ;AAEA,EAAA,IAAI,KAAA,CAAM,WAAW,UAAA,EAAY;AAC7B,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,EAAM,aAAA;AAC7B,IAAA,IAAI,QAAA,IAAY,QAAA,KAAa,OAAA,CAAQ,OAAA,EAAS,OAAO,kBAAA;AAAA,EACzD;AAEA,EAAA,IAAI,KAAA,CAAM,mBAAA,IAAuB,KAAA,CAAM,mBAAA,CAAoB,SAAS,CAAA,EAAG;AACnE,IAAA,MAAM,cAAA,GAAiB,OAAA,CAAQ,qBAAA,IAAyB,EAAC;AACzD,IAAA,MAAM,QAAA,GAAW,MAAM,mBAAA,CAAoB,IAAA;AAAA,MAAK,CAAC,EAAA,KAC7C,EAAA,CAAG,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,KAAM,cAAA,CAAe,QAAA,CAAS,CAAC,CAAC;AAAA,KACpD;AACA,IAAA,IAAI,CAAC,UAAU,OAAO,4BAAA;AAAA,EAC1B;AAEA,EAAA,IAAI,WAAW,OAAO,gBAAA;AACtB,EAAA,OAAO,qBAAA;AACX;AASA,SAAS,eAAA,CACL,KAAA,EACA,OAAA,EACA,KAAA,EACe;AACf,EAAA,IAAI,KAAA,CAAM,SAAA,CAAU,MAAA,KAAW,CAAA,EAAG,OAAO,KAAA;AAEzC,EAAA,MAAM,OAAA,GAAU,KAAA,CAAM,SAAA,CAAU,GAAA,CAAI,CAAC,KAAA,KAAU;AAC3C,IAAA,MAAM,eAAA,GAAkB,MAAM,WAAA,CAAY,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,EAAA,KAAO,KAAA,CAAM,OAAO,CAAA;AAC5E,IAAA,IAAI,CAAC,iBAAiB,OAAO,KAAA;AAC7B,IAAA,MAAM,WAAW,gBAAA,CAAiB,eAAA,EAAiB,OAAA,EAAS,KAAA,CAAM,WAAW,MAAS,CAAA;AACtF,IAAA,OAAO,EAAE,GAAG,KAAA,EAAO,MAAA,EAAQ,QAAA,EAAS;AAAA,EACxC,CAAC,CAAA;AAED,EAAA,OAAO,EAAE,GAAG,KAAA,EAAO,SAAA,EAAW,OAAA,EAAQ;AAC1C;AAaA,eAAsB,kBAAA,CAClB,OAAA,EACA,KAAA,EACA,OAAA,EACqB;AACrB,EAAA,MAAM,MAAA,GAAS,MAAM,iBAAA,CAAkB,OAAA,EAAS,OAAO,CAAA;AAEvD,EAAA,MAAM,UAAA,GAAa,uBAAA,CAAwB,MAAA,CAAO,MAAM,KAAK,MAAA,CAAO,MAAA;AAIpE,EAAA,MAAM,aAAA,GACF,OAAO,MAAA,KAAW,MAAA,IAAU,OAAO,gBAAA,KAAqB,MAAA,GACjD,MAAA,CAAO,gBAAA,GACP,MAAA,CAAO,MAAA;AAElB,EAAA,MAAM,OAAA,GAA6B;AAAA,IAC/B,EAAA,EAAI,KAAA,CAAM,WAAA,CAAY,CAAC,GAAG,EAAA,IAAM,WAAA;AAAA,IAChC,MAAA,EAAQ,UAAA;AAAA,IACR,MAAA,EAAQ;AAAA,GACZ;AAEA,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,IAAe,OAAO,MAAA,CAAO,QAAQ,QAAA,EAAU;AACjE,IAAA,OAAA,CAAQ,MAAM,MAAA,CAAO,GAAA;AAAA,EACzB;AACA,EAAA,IAAI,OAAO,MAAA,KAAW,MAAA,IAAU,OAAO,MAAA,CAAO,YAAY,QAAA,EAAU;AAChE,IAAA,OAAA,CAAQ,UAAU,MAAA,CAAO,OAAA;AAAA,EAC7B;AAEA,EAAA,MAAM,QAAA,GAAWC,eAAA,CAAW,KAAA,EAAO,CAAC,OAAO,CAAC,CAAA;AAC5C,EAAA,MAAM,KAAA,GAAQ,eAAA,CAAgB,KAAA,EAAO,OAAA,EAAS,QAAQ,CAAA;AACtD,EAAA,MAAM,aAAa,KAAA,CAAM,SAAA,GAAYC,oBAAA,CAAgB,KAAA,EAAO,KAAK,CAAA,GAAI,IAAA;AAErE,EAAA,OAAO;AAAA,IACH,MAAA;AAAA,IACA,KAAA;AAAA,IACA,UAAA;AAAA,IACA,KAAA,EAAO,MAAA,CAAO,KAAA,IAAS,KAAA,CAAM;AAAA,GACjC;AACJ;AC7IO,IAAM,OAAA,GAAU","file":"index.cjs","sourcesContent":["import { v4 as uuidv4 } from 'uuid';\nimport type { DcqlQuery } from '@openeudi/dcql';\n\nimport type { AuthorizationRequestInput, AuthorizationRequest } from './types/authorization.js';\n\nexport function createAuthorizationRequest(\n    input: AuthorizationRequestInput,\n    query: DcqlQuery,\n): AuthorizationRequest {\n    if (!input.clientId) throw new TypeError('clientId is required');\n    if (!input.nonce) throw new TypeError('nonce is required');\n    if (!input.responseUri) throw new TypeError('responseUri is required');\n\n    const state = input.state ?? uuidv4();\n    const responseMode = input.responseMode ?? 'direct_post';\n\n    const params = new URLSearchParams({\n        response_type: 'vp_token',\n        response_mode: responseMode,\n        response_uri: input.responseUri,\n        client_id: input.clientId,\n        nonce: input.nonce,\n        state,\n        dcql_query: JSON.stringify(query),\n    });\n\n    return {\n        uri: `openid4vp://authorize?${params.toString()}`,\n        dcqlQuery: query,\n        nonce: input.nonce,\n        state,\n    };\n}\n","export class InvalidSignatureError extends Error {\n    constructor(message = 'Credential signature validation failed') {\n        super(message);\n        this.name = 'InvalidSignatureError';\n        Object.setPrototypeOf(this, new.target.prototype);\n    }\n}\n\nexport class ExpiredCredentialError extends Error {\n    constructor(message = 'Credential has expired') {\n        super(message);\n        this.name = 'ExpiredCredentialError';\n        Object.setPrototypeOf(this, new.target.prototype);\n    }\n}\n\nexport class UnsupportedFormatError extends Error {\n    constructor(format: string) {\n        super(`Unsupported credential format: ${format}`);\n        this.name = 'UnsupportedFormatError';\n        Object.setPrototypeOf(this, new.target.prototype);\n    }\n}\n\nexport class MalformedCredentialError extends Error {\n    constructor(message = 'Credential structure is malformed') {\n        super(message);\n        this.name = 'MalformedCredentialError';\n        Object.setPrototypeOf(this, new.target.prototype);\n    }\n}\n\nexport class NonceValidationError extends Error {\n    constructor(message = 'Nonce does not match expected value') {\n        super(message);\n        this.name = 'NonceValidationError';\n        Object.setPrototypeOf(this, new.target.prototype);\n    }\n}\n\nexport type HaipValidationCode =\n    | 'EMPTY_QUERY'\n    | 'UNSUPPORTED_FORMAT'\n    | 'MISSING_SDJWT_META'\n    | 'MISSING_MDOC_META'\n    | 'NO_CLAIMS'\n    | 'CLAIM_SETS_DISALLOWED'\n    | 'CREDENTIAL_SETS_DISALLOWED';\n\nexport class HaipValidationError extends Error {\n    readonly code: HaipValidationCode;\n    readonly credentialId?: string;\n\n    constructor(code: HaipValidationCode, message: string, credentialId?: string) {\n        super(message);\n        this.name = 'HaipValidationError';\n        this.code = code;\n        this.credentialId = credentialId;\n        Object.setPrototypeOf(this, new.target.prototype);\n    }\n}\n","import type { DcqlQuery, CredentialQuery, ClaimsQuery } from '@openeudi/dcql';\nimport { HaipValidationError } from './errors.js';\nimport type { HaipQueryInput } from './types/haip.js';\n\nexport const HAIP_DOCTYPE_NAMESPACES: Record<string, string> = {\n    'org.iso.18013.5.1.mDL': 'org.iso.18013.5.1',\n    'eu.europa.ec.eudi.pid.1': 'eu.europa.ec.eudi.pid.1',\n};\n\nexport function buildHaipQuery(input: HaipQueryInput): DcqlQuery {\n    if (input.claims.length === 0) {\n        throw new HaipValidationError(\n            'NO_CLAIMS',\n            `credential '${input.credentialId}' must declare at least one claim`,\n            input.credentialId,\n        );\n    }\n\n    let meta: CredentialQuery['meta'];\n    let claims: ClaimsQuery[];\n\n    if (input.format === 'dc+sd-jwt') {\n        if (!input.vctValues || input.vctValues.length === 0) {\n            throw new HaipValidationError(\n                'MISSING_SDJWT_META',\n                `credential '${input.credentialId}' with format 'dc+sd-jwt' must provide non-empty vctValues`,\n                input.credentialId,\n            );\n        }\n        meta = { vct_values: input.vctValues };\n        claims = input.claims.map((c) => ({ path: [c] }));\n    } else {\n        if (!input.doctypeValue) {\n            throw new HaipValidationError(\n                'MISSING_MDOC_META',\n                `credential '${input.credentialId}' with format 'mso_mdoc' must provide doctypeValue`,\n                input.credentialId,\n            );\n        }\n        meta = { doctype_value: input.doctypeValue };\n        const namespace = HAIP_DOCTYPE_NAMESPACES[input.doctypeValue] ?? input.doctypeValue;\n        claims = input.claims.map((c) => ({ path: [namespace, c] }));\n    }\n\n    const credential: CredentialQuery = {\n        id: input.credentialId,\n        format: input.format,\n        meta,\n        claims,\n    };\n\n    if (input.trustedAuthorities && input.trustedAuthorities.length > 0) {\n        credential.trusted_authorities = input.trustedAuthorities;\n    }\n\n    return { credentials: [credential] };\n}\n\nconst HAIP_FORMATS = new Set<string>(['dc+sd-jwt', 'mso_mdoc']);\n\nexport function validateHaipQuery(query: DcqlQuery): void {\n    if (!query.credentials || query.credentials.length === 0) {\n        throw new HaipValidationError(\n            'EMPTY_QUERY',\n            'query.credentials must have at least one entry',\n        );\n    }\n\n    if (query.credential_sets !== undefined) {\n        throw new HaipValidationError(\n            'CREDENTIAL_SETS_DISALLOWED',\n            'credential_sets are not permitted in HAIP-minimal',\n        );\n    }\n\n    for (const credential of query.credentials) {\n        if (!HAIP_FORMATS.has(credential.format)) {\n            throw new HaipValidationError(\n                'UNSUPPORTED_FORMAT',\n                `credential '${credential.id}' uses unsupported format '${credential.format}' (allowed: dc+sd-jwt, mso_mdoc)`,\n                credential.id,\n            );\n        }\n\n        if (credential.format === 'dc+sd-jwt') {\n            const vctValues = credential.meta?.vct_values;\n            if (!vctValues || vctValues.length === 0) {\n                throw new HaipValidationError(\n                    'MISSING_SDJWT_META',\n                    `credential '${credential.id}' with format 'dc+sd-jwt' must set meta.vct_values`,\n                    credential.id,\n                );\n            }\n        }\n\n        if (credential.format === 'mso_mdoc') {\n            if (typeof credential.meta?.doctype_value !== 'string') {\n                throw new HaipValidationError(\n                    'MISSING_MDOC_META',\n                    `credential '${credential.id}' with format 'mso_mdoc' must set meta.doctype_value`,\n                    credential.id,\n                );\n            }\n        }\n\n        if (!credential.claims || credential.claims.length === 0) {\n            throw new HaipValidationError(\n                'NO_CLAIMS',\n                `credential '${credential.id}' must declare at least one claim`,\n                credential.id,\n            );\n        }\n\n        if (credential.claim_sets !== undefined) {\n            throw new HaipValidationError(\n                'CLAIM_SETS_DISALLOWED',\n                `credential '${credential.id}' uses claim_sets, not permitted in HAIP-minimal`,\n                credential.id,\n            );\n        }\n    }\n}\n\nexport function isHaipQuery(query: DcqlQuery): boolean {\n    try {\n        validateHaipQuery(query);\n        return true;\n    } catch {\n        return false;\n    }\n}\n","import { Encoder as CborEncoder, Tag } from 'cbor-x';\n\nimport { MalformedCredentialError } from '../errors.js';\n\n// Decoder that preserves CBOR maps as JS Maps (cbor-x default converts them to objects).\nconst decoder = new CborEncoder({ mapsAsObjects: false, useRecords: false });\n\n/**\n * COSE label for the `alg` header parameter.\n */\nconst HEADER_ALG = 1;\n\n/**\n * COSE label for the `x5chain` header parameter (RFC 9360).\n */\nconst HEADER_X5CHAIN = 33;\n\nconst COSE_ALG_TO_NAME: Record<number, string> = {\n    [-7]: 'ES256',\n    [-35]: 'ES384',\n    [-36]: 'ES512',\n};\n\nexport interface CoseSign1 {\n    protectedHeaderBytes: Uint8Array;\n    protectedHeader: Map<number, unknown>;\n    unprotectedHeader: Map<number, unknown>;\n    payload: Uint8Array;\n    signature: Uint8Array;\n    x5chain: Uint8Array[];\n    alg: 'ES256' | 'ES384' | 'ES512';\n}\n\nexport function decodeCoseSign1(bytes: Uint8Array): CoseSign1 {\n    let outer: unknown = decoder.decode(bytes);\n    if (outer instanceof Tag && outer.tag === 18) {\n        // tag-18 value may be the raw bytes of the COSE_Sign1 structure — decode again\n        const tagValue = outer.value;\n        outer = tagValue instanceof Uint8Array ? decoder.decode(tagValue) : tagValue;\n    }\n    if (!Array.isArray(outer) || outer.length !== 4) {\n        throw new MalformedCredentialError('COSE_Sign1 must be a CBOR array of length 4');\n    }\n    const [protectedHeaderBytes, unprotectedHeader, payloadRaw, signature] = outer;\n    if (!(protectedHeaderBytes instanceof Uint8Array)) {\n        throw new MalformedCredentialError('COSE_Sign1 protected header must be a bstr');\n    }\n    if (!(unprotectedHeader instanceof Map)) {\n        throw new MalformedCredentialError('COSE_Sign1 unprotected header must be a Map');\n    }\n    if (!(signature instanceof Uint8Array)) {\n        throw new MalformedCredentialError('COSE_Sign1 signature must be a bstr');\n    }\n\n    let protectedHeader: Map<number, unknown>;\n    try {\n        const decoded = decoder.decode(protectedHeaderBytes);\n        if (!(decoded instanceof Map)) {\n            throw new Error('protected header not a Map');\n        }\n        protectedHeader = decoded as Map<number, unknown>;\n    } catch {\n        throw new MalformedCredentialError('COSE_Sign1 protected header is not decodable CBOR');\n    }\n\n    const algLabel = protectedHeader.get(HEADER_ALG);\n    const alg = typeof algLabel === 'number' ? COSE_ALG_TO_NAME[algLabel] : undefined;\n    if (!alg) {\n        throw new MalformedCredentialError(`COSE_Sign1 uses unknown alg label: ${String(algLabel)}`);\n    }\n\n    // Payload may be a bstr, tag-24 bstr (embedded CBOR), or absent (detached — not supported here)\n    let payload: Uint8Array;\n    if (payloadRaw instanceof Uint8Array) {\n        payload = payloadRaw;\n    } else if (payloadRaw instanceof Tag && payloadRaw.tag === 24 && payloadRaw.value instanceof Uint8Array) {\n        payload = payloadRaw.value;\n    } else {\n        throw new MalformedCredentialError('COSE_Sign1 payload must be a byte string');\n    }\n\n    // x5chain may be a single cert bstr or an array of bstrs\n    const x5raw = unprotectedHeader.get(HEADER_X5CHAIN);\n    let x5chain: Uint8Array[];\n    if (x5raw === undefined) {\n        throw new MalformedCredentialError('COSE_Sign1 missing x5chain in unprotected header (label 33)');\n    }\n    if (x5raw instanceof Uint8Array) {\n        x5chain = [x5raw];\n    } else if (Array.isArray(x5raw) && x5raw.every((v) => v instanceof Uint8Array)) {\n        x5chain = x5raw as Uint8Array[];\n    } else {\n        throw new MalformedCredentialError('COSE_Sign1 x5chain must be a bstr or array of bstr');\n    }\n\n    return {\n        protectedHeaderBytes,\n        protectedHeader,\n        unprotectedHeader: unprotectedHeader as Map<number, unknown>,\n        payload,\n        signature,\n        x5chain,\n        alg: alg as 'ES256' | 'ES384' | 'ES512',\n    };\n}\n\nconst ALG_TO_HASH: Record<string, string> = {\n    ES256: 'SHA-256',\n    ES384: 'SHA-384',\n    ES512: 'SHA-512',\n};\n\n/**\n * Verifies the COSE_Sign1 signature using the provided public key.\n * Throws when the algorithm is not in the allowlist or the signature is invalid.\n */\nexport async function verifyCoseSign1(\n    coseSign1: CoseSign1,\n    publicKey: CryptoKey,\n    allowedAlgorithms: string[]\n): Promise<void> {\n    if (!allowedAlgorithms.includes(coseSign1.alg)) {\n        throw new MalformedCredentialError(`COSE_Sign1 algorithm ${coseSign1.alg} not in allowlist`);\n    }\n    const hashAlg = ALG_TO_HASH[coseSign1.alg];\n    if (!hashAlg) {\n        throw new MalformedCredentialError(`no hash mapping for alg ${coseSign1.alg}`);\n    }\n\n    // Sig_structure1 = [\"Signature1\", protected_header_bytes, external_aad (empty bstr), payload]\n    // coseSign1.payload is the raw bstr from the COSE array — it already contains the tag-24\n    // encoded MSO bytes as stored by the signer, so we use it directly without re-wrapping.\n    const sigStructure = ['Signature1', coseSign1.protectedHeaderBytes, new Uint8Array(0), coseSign1.payload];\n    const sigInput = decoder.encode(sigStructure);\n\n    // Copy into a plain Uint8Array<ArrayBuffer> so TS's BufferSource constraint is satisfied.\n    const ok = await crypto.subtle.verify(\n        { name: 'ECDSA', hash: hashAlg },\n        publicKey,\n        new Uint8Array(coseSign1.signature),\n        sigInput\n    );\n    if (!ok) {\n        throw new MalformedCredentialError('COSE_Sign1 signature verification failed');\n    }\n}\n","import { Encoder as CborEncoder, Tag } from 'cbor-x';\n\nimport { MalformedCredentialError } from '../errors.js';\n\nimport type { MobileSecurityObject } from './mso.js';\n\n// Decoder that preserves CBOR maps as JS Maps (cbor-x default converts them to objects).\nconst decoder = new CborEncoder({ mapsAsObjects: false, useRecords: false });\n\nconst ALLOWED_HASH_ALGS = new Set(['SHA-256', 'SHA-384', 'SHA-512']);\n\nexport async function computeItemDigest(itemBytes: Uint8Array, digestAlgorithm: string): Promise<Uint8Array> {\n    if (!ALLOWED_HASH_ALGS.has(digestAlgorithm)) {\n        throw new MalformedCredentialError(`Unknown digest algorithm: ${digestAlgorithm}`);\n    }\n    // Copy into a plain Uint8Array<ArrayBuffer> to satisfy TypeScript's BufferSource constraint.\n    const buf = await crypto.subtle.digest(digestAlgorithm, new Uint8Array(itemBytes));\n    return new Uint8Array(buf);\n}\n\nfunction bytesEqual(a: Uint8Array, b: Uint8Array): boolean {\n    if (a.length !== b.length) return false;\n    for (let i = 0; i < a.length; i++) {\n        if (a[i] !== b[i]) return false;\n    }\n    return true;\n}\n\n/**\n * Unwrap an IssuerSignedItem from its tag-24 encoding and return the inner Map.\n *\n * Three shapes arise depending on test vs. production paths:\n *   A) Tag(24, Uint8Array)    — production cbor-x path (no addExtension)\n *   B) EmbeddedCbor-like obj  — test-fixture path (addExtension in mdoc-helpers.ts registers a\n *                               custom class whose instances have `.value: Uint8Array`)\n *   C) Plain Map              — if cbor-x auto-unwraps deeper than expected\n */\nfunction unwrapItemMap(itemBytes: Uint8Array): Map<string, unknown> {\n    let decoded: unknown;\n    try {\n        decoded = decoder.decode(itemBytes);\n    } catch {\n        throw new MalformedCredentialError('IssuerSignedItem is not decodable CBOR');\n    }\n\n    let inner: unknown;\n    if (decoded instanceof Tag && decoded.tag === 24 && decoded.value instanceof Uint8Array) {\n        // Path A: tag-24 Tag object\n        inner = decoder.decode(decoded.value as Uint8Array);\n    } else if (\n        decoded !== null &&\n        typeof decoded === 'object' &&\n        !(decoded instanceof Tag) &&\n        !(decoded instanceof Map) &&\n        !(decoded instanceof Uint8Array) &&\n        'value' in (decoded as object) &&\n        (decoded as { value: unknown }).value instanceof Uint8Array\n    ) {\n        // Path B: EmbeddedCbor-like object from test fixture's addExtension\n        inner = decoder.decode((decoded as { value: Uint8Array }).value);\n    } else if (decoded instanceof Map) {\n        // Path C: already a Map\n        inner = decoded;\n    } else {\n        throw new MalformedCredentialError('IssuerSignedItem must be a tag-24 wrapped CBOR Map');\n    }\n\n    if (!(inner instanceof Map)) {\n        throw new MalformedCredentialError('IssuerSignedItem must decode to a Map');\n    }\n    return inner as Map<string, unknown>;\n}\n\n/**\n * Verifies every IssuerSignedItem across every namespace against the MSO's valueDigests.\n * All items must match — no partial acceptance.\n *\n * @param nameSpaces  Per-namespace arrays of tag-24-wrapped IssuerSignedItem bytes\n *                    (exactly the bytes used as digest input during issuance).\n * @param mso         Decoded MobileSecurityObject carrying the expected valueDigests.\n */\nexport async function verifyAllDigests(\n    nameSpaces: Map<string, Uint8Array[]>,\n    mso: MobileSecurityObject\n): Promise<void> {\n    for (const [ns, items] of nameSpaces) {\n        const expected = mso.valueDigests.get(ns);\n        if (!expected) {\n            throw new MalformedCredentialError(`namespace ${ns} has no valueDigests entry in MSO`);\n        }\n        for (const itemBytes of items) {\n            // Hash the raw tag-24 bytes — this is what the issuer hashed during issuance.\n            const hash = await computeItemDigest(itemBytes, mso.digestAlgorithm);\n\n            // Decode to extract digestID for lookup.\n            const item = unwrapItemMap(itemBytes);\n            const digestID = item.get('digestID');\n            if (typeof digestID !== 'number') {\n                throw new MalformedCredentialError('IssuerSignedItem missing digestID');\n            }\n\n            const expectedDigest = expected.get(digestID);\n            if (!expectedDigest) {\n                throw new MalformedCredentialError(`digestID ${digestID} missing from MSO valueDigests[${ns}]`);\n            }\n            if (!bytesEqual(hash, expectedDigest)) {\n                throw new MalformedCredentialError(`digest mismatch for ns=${ns} digestID=${digestID}`);\n            }\n        }\n    }\n}\n","import { Encoder as CborEncoder, Tag } from 'cbor-x';\n\nimport { MalformedCredentialError, ExpiredCredentialError } from '../errors.js';\n\n// Decoder that preserves CBOR maps as JS Maps (cbor-x default converts them to objects).\nconst decoder = new CborEncoder({ mapsAsObjects: false, useRecords: false });\n\nexport interface MobileSecurityObject {\n    version: string;\n    digestAlgorithm: string;\n    valueDigests: Map<string, Map<number, Uint8Array>>;\n    docType: string;\n    validityInfo: {\n        signed: Date;\n        validFrom: Date;\n        validUntil: Date;\n        expectedUpdate?: Date;\n    };\n}\n\nfunction decodeDateLike(value: unknown): Date {\n    if (value instanceof Date) return value;\n    if (value instanceof Tag) {\n        // Tag 0 = RFC 3339 string; Tag 1 = epoch seconds; Tag 1004 = full-date (YYYY-MM-DD)\n        if (value.tag === 0 && typeof value.value === 'string') {\n            return new Date(value.value);\n        }\n        if (value.tag === 1 && typeof value.value === 'number') {\n            return new Date(value.value * 1000);\n        }\n        if (value.tag === 1004 && typeof value.value === 'string') {\n            return new Date(value.value);\n        }\n    }\n    if (typeof value === 'string') {\n        return new Date(value);\n    }\n    throw new MalformedCredentialError(`unsupported date encoding in MSO: ${typeof value}`);\n}\n\nexport function decodeMso(payload: Uint8Array): MobileSecurityObject {\n    let raw: unknown;\n    try {\n        raw = decoder.decode(payload);\n        // Unwrap tag-24 (embedded CBOR): COSE payload may be tag-24 wrapped MSO bytes.\n        // In production cbor-x decodes tag-24 as Tag(24, bytes); in test fixtures that register\n        // a custom addExtension for tag-24 it decodes to an EmbeddedCbor-like object with .value.\n        if (raw instanceof Tag && raw.tag === 24 && raw.value instanceof Uint8Array) {\n            raw = decoder.decode(raw.value);\n        } else if (\n            raw !== null &&\n            typeof raw === 'object' &&\n            !(raw instanceof Tag) &&\n            !(raw instanceof Map) &&\n            !(raw instanceof Uint8Array) &&\n            'value' in (raw as object) &&\n            (raw as { value: unknown }).value instanceof Uint8Array\n        ) {\n            // TEST-FIXTURE COMPATIBILITY: tests/fixtures/mdoc-helpers.ts registers a custom\n            // tag-24 addExtension globally, so cbor-x returns an EmbeddedCbor-like object\n            // (with `.value: Uint8Array`) instead of Tag(24, bytes) during tests. The `!(raw\n            // instanceof Tag)` guard ensures we don't misinterpret arbitrary Tag(N, bytes)\n            // values as embedded CBOR in production.\n            raw = decoder.decode((raw as { value: Uint8Array }).value);\n        }\n    } catch (err) {\n        if (err instanceof MalformedCredentialError) throw err;\n        throw new MalformedCredentialError('MSO payload is not decodable CBOR');\n    }\n    if (!(raw instanceof Map)) {\n        throw new MalformedCredentialError('MSO must be a CBOR Map');\n    }\n    const m = raw as Map<string, unknown>;\n\n    const version = m.get('version');\n    if (typeof version !== 'string') {\n        throw new MalformedCredentialError('MSO.version must be a string');\n    }\n    const digestAlgorithm = m.get('digestAlgorithm');\n    if (typeof digestAlgorithm !== 'string') {\n        throw new MalformedCredentialError('MSO.digestAlgorithm must be a string');\n    }\n    const docType = m.get('docType');\n    if (typeof docType !== 'string') {\n        throw new MalformedCredentialError('MSO.docType must be a string');\n    }\n\n    const vdRaw = m.get('valueDigests');\n    if (!(vdRaw instanceof Map)) {\n        throw new MalformedCredentialError('MSO.valueDigests must be a Map');\n    }\n    const valueDigests = new Map<string, Map<number, Uint8Array>>();\n    for (const [ns, inner] of vdRaw.entries()) {\n        if (typeof ns !== 'string' || !(inner instanceof Map)) {\n            throw new MalformedCredentialError('MSO.valueDigests entry malformed');\n        }\n        const perNs = new Map<number, Uint8Array>();\n        for (const [id, digest] of (inner as Map<unknown, unknown>).entries()) {\n            if (typeof id !== 'number' || !(digest instanceof Uint8Array)) {\n                throw new MalformedCredentialError('MSO digest entry must map number→bstr');\n            }\n            perNs.set(id, digest);\n        }\n        valueDigests.set(ns, perNs);\n    }\n\n    const viRaw = m.get('validityInfo');\n    if (!(viRaw instanceof Map)) {\n        throw new MalformedCredentialError('MSO.validityInfo must be a Map');\n    }\n    const vi = viRaw as Map<string, unknown>;\n    const validityInfo: MobileSecurityObject['validityInfo'] = {\n        signed: decodeDateLike(vi.get('signed')),\n        validFrom: decodeDateLike(vi.get('validFrom')),\n        validUntil: decodeDateLike(vi.get('validUntil')),\n    };\n    if (vi.has('expectedUpdate')) {\n        validityInfo.expectedUpdate = decodeDateLike(vi.get('expectedUpdate'));\n    }\n\n    return { version, digestAlgorithm, valueDigests, docType, validityInfo };\n}\n\n/**\n * Validates the MSO's validityInfo block against a reference time.\n * Enforces strict ISO 18013-5 rules:\n *   - signed <= now\n *   - validFrom <= now\n *   - validFrom <= validUntil\n *   - signed within [validFrom, validUntil]\n *   - validUntil >= now (else ExpiredCredentialError)\n */\nexport function validateMsoValidity(mso: MobileSecurityObject, now: Date): void {\n    const { signed, validFrom, validUntil } = mso.validityInfo;\n    if (signed.getTime() > now.getTime()) {\n        throw new MalformedCredentialError(`MSO signed=${signed.toISOString()} is in the future`);\n    }\n    if (validFrom.getTime() > now.getTime()) {\n        throw new MalformedCredentialError(`MSO validFrom=${validFrom.toISOString()} is in the future`);\n    }\n    if (validFrom.getTime() > validUntil.getTime()) {\n        throw new MalformedCredentialError('MSO validFrom is after validUntil');\n    }\n    if (signed.getTime() < validFrom.getTime() || signed.getTime() > validUntil.getTime()) {\n        throw new MalformedCredentialError('MSO signed is outside the validity window');\n    }\n    if (validUntil.getTime() < now.getTime()) {\n        throw new ExpiredCredentialError(`MSO validUntil=${validUntil.toISOString()} is in the past`);\n    }\n}\n\n/**\n * Validates that the MSO's docType matches the expected one.\n * Used by callers who want to lock the accepted credential type.\n */\nexport function validateMsoDocType(mso: MobileSecurityObject, expectedDocType: string): void {\n    if (mso.docType !== expectedDocType) {\n        throw new MalformedCredentialError(`MSO docType=${mso.docType} does not match expected ${expectedDocType}`);\n    }\n}\n","import { Encoder as CborEncoder, Tag } from 'cbor-x';\nimport { importX509 } from 'jose';\n\nimport { decodeCoseSign1, verifyCoseSign1 } from '../crypto/cose-sign1.js';\nimport { verifyAllDigests } from '../crypto/digest.js';\nimport { decodeMso, validateMsoValidity, validateMsoDocType } from '../crypto/mso.js';\nimport { MalformedCredentialError, ExpiredCredentialError } from '../errors.js';\nimport type { IssuerInfo } from '../types/issuer.js';\nimport type { CredentialFormat, CredentialClaims, PresentationResult } from '../types/presentation.js';\n\nimport type { ICredentialParser, ParseOptions } from './parser.interface.js';\n\n// Decoder that preserves CBOR maps as JS Maps (cbor-x default converts them to objects).\nconst decoder = new CborEncoder({ mapsAsObjects: false, useRecords: false });\nconst encoder = new CborEncoder({ mapsAsObjects: false, useRecords: false });\n\nconst DEFAULT_ALLOWED_ALGORITHMS = ['ES256', 'ES384', 'ES512'];\n\nfunction bytesEqual(a: Uint8Array, b: Uint8Array): boolean {\n    if (a.length !== b.length) return false;\n    for (let i = 0; i < a.length; i++) {\n        if (a[i] !== b[i]) return false;\n    }\n    return true;\n}\n\nfunction derToPem(der: Uint8Array): string {\n    let binary = '';\n    for (const b of der) binary += String.fromCharCode(b);\n    const b64 = globalThis.btoa(binary);\n    const lines = b64.match(/.{1,64}/g) || [];\n    return `-----BEGIN CERTIFICATE-----\\n${lines.join('\\n')}\\n-----END CERTIFICATE-----`;\n}\n\nfunction extractCountryHintFromCert(_certDer: Uint8Array): string {\n    // Placeholder — full X.509 subject parsing is workstream 3.\n    return '';\n}\n\n/**\n * Extracts raw tag-24 bytes from an IssuerSignedItem.\n *\n * Each IssuerSignedItem in the DeviceResponse is stored as EmbeddedCbor(itemTag24),\n * which on the wire is tag-24 wrapping the already-tag-24-wrapped item bytes.\n * cbor-x decoding unwraps one layer, so `item.value` (or the Tag(24).value) is\n * exactly `itemTag24` — the bytes the issuer hashed. Return those directly.\n *\n * Three shapes arise depending on test vs. production paths:\n *   A) Tag(24, Uint8Array)    — production cbor-x path (no addExtension)\n *   B) EmbeddedCbor-like obj  — test-fixture path (addExtension in mdoc-helpers.ts registers a\n *                               custom class whose instances have `.value: Uint8Array`)\n *   C) Plain Uint8Array       — already encoded tag-24 bytes\n */\nfunction extractRawItemBytes(item: unknown): Uint8Array {\n    if (item instanceof Tag && item.tag === 24 && item.value instanceof Uint8Array) {\n        return item.value;\n    }\n    if (item instanceof Uint8Array) {\n        return item;\n    }\n    if (\n        item !== null &&\n        typeof item === 'object' &&\n        !(item instanceof Tag) &&\n        !(item instanceof Map) &&\n        'value' in (item as object) &&\n        (item as { value: unknown }).value instanceof Uint8Array\n    ) {\n        return (item as { value: Uint8Array }).value;\n    }\n    throw new MalformedCredentialError('IssuerSignedItem must be a tag-24 byte string');\n}\n\n/**\n * Maps raw IssuerSignedItem bytes (from all namespaces) to CredentialClaims\n * plus a namespace-grouped structure (for DCQL path addressing).\n *\n * Handles all three tag-24 shapes (Tag(24,bytes), EmbeddedCbor-like object, plain bytes).\n */\nfunction mapRawToClaims(nameSpaces: Map<string, Uint8Array[]>): {\n    flat: CredentialClaims;\n    namespaced: Record<string, Record<string, unknown>>;\n} {\n    const flat: CredentialClaims = {};\n    const namespaced: Record<string, Record<string, unknown>> = {};\n    for (const [ns, items] of nameSpaces.entries()) {\n        const nsBucket: Record<string, unknown> = namespaced[ns] ?? {};\n        for (const itemBytes of items) {\n            let decoded: unknown;\n            try {\n                decoded = decoder.decode(itemBytes);\n            } catch {\n                continue;\n            }\n\n            // Unwrap all three tag-24 shapes to get the inner CBOR bytes\n            let inner: unknown;\n            if (decoded instanceof Tag && decoded.tag === 24 && decoded.value instanceof Uint8Array) {\n                // Path A: Tag(24, bytes)\n                inner = decoder.decode(decoded.value as Uint8Array);\n            } else if (\n                decoded !== null &&\n                typeof decoded === 'object' &&\n                !(decoded instanceof Tag) &&\n                !(decoded instanceof Map) &&\n                !(decoded instanceof Uint8Array) &&\n                'value' in (decoded as object) &&\n                (decoded as { value: unknown }).value instanceof Uint8Array\n            ) {\n                // Path B: EmbeddedCbor-like object from test fixture's addExtension\n                inner = decoder.decode((decoded as { value: Uint8Array }).value);\n            } else if (decoded instanceof Map) {\n                // Path C: already a Map\n                inner = decoded;\n            } else {\n                continue;\n            }\n\n            if (inner instanceof Map) {\n                const id = (inner as Map<string, unknown>).get('elementIdentifier');\n                const val = (inner as Map<string, unknown>).get('elementValue');\n                if (typeof id === 'string') {\n                    (flat as Record<string, unknown>)[id] = val;\n                    nsBucket[id] = val;\n                }\n            }\n        }\n        namespaced[ns] = nsBucket;\n    }\n    return { flat, namespaced };\n}\n\n/**\n * mDOC / mDL credential parser.\n *\n * Decodes and validates mDOC (Mobile Document) credentials as specified in\n * ISO 18013-5 and the EUDI Wallet ecosystem. Composes the crypto modules\n * to perform full verification:\n *   - COSE_Sign1 decode + signature verification\n *   - MSO decode + validity + docType validation\n *   - Digest verification for all IssuerSignedItems\n *   - Issuer certificate trust chain check\n */\nexport class MdocParser implements ICredentialParser {\n    readonly format: CredentialFormat = 'mdoc';\n\n    /**\n     * Returns true when the token is binary data (Uint8Array or Buffer),\n     * indicating a CBOR-encoded mDOC DeviceResponse.\n     * Buffer extends Uint8Array, so `instanceof Uint8Array` catches both.\n     */\n    canParse(vpToken: unknown): boolean {\n        return vpToken instanceof Uint8Array;\n    }\n\n    /**\n     * Parses and validates an mDOC DeviceResponse token.\n     *\n     * @throws {MalformedCredentialError} when the CBOR structure cannot be decoded\n     *   or does not match the expected DeviceResponse format\n     */\n    async parse(vpToken: unknown, options: ParseOptions): Promise<PresentationResult> {\n        if (!(vpToken instanceof Uint8Array)) {\n            throw new MalformedCredentialError('mDOC vpToken must be a Uint8Array');\n        }\n        const allowedAlgorithms = options.allowedAlgorithms ?? DEFAULT_ALLOWED_ALGORITHMS;\n\n        // Step 1: Decode DeviceResponse\n        let deviceResponse: Map<unknown, unknown>;\n        try {\n            const decoded = decoder.decode(vpToken);\n            if (!(decoded instanceof Map)) throw new Error();\n            deviceResponse = decoded as Map<unknown, unknown>;\n        } catch {\n            throw new MalformedCredentialError('vpToken is not a CBOR DeviceResponse Map');\n        }\n\n        // Step 2: Extract first document\n        const docs = deviceResponse.get('documents');\n        if (!Array.isArray(docs) || docs.length === 0) {\n            throw new MalformedCredentialError('DeviceResponse has no documents');\n        }\n        const document = docs[0];\n        if (!(document instanceof Map)) {\n            throw new MalformedCredentialError('document must be a Map');\n        }\n        const issuerSigned = document.get('issuerSigned');\n        if (!(issuerSigned instanceof Map)) {\n            throw new MalformedCredentialError('document.issuerSigned must be a Map');\n        }\n        const issuerAuth = issuerSigned.get('issuerAuth');\n        if (!Array.isArray(issuerAuth)) {\n            throw new MalformedCredentialError('issuerAuth must be a COSE_Sign1 array');\n        }\n\n        // Re-encode issuerAuth as bytes so we can pass to decodeCoseSign1\n        const issuerAuthBytes = encoder.encode(issuerAuth);\n\n        // Step 3: Decode COSE_Sign1 + algorithm check\n        const cose = decodeCoseSign1(issuerAuthBytes);\n        if (!allowedAlgorithms.includes(cose.alg)) {\n            return {\n                valid: false,\n                format: this.format,\n                claims: {},\n                issuer: { certificate: new Uint8Array(), country: '' },\n                error: `Unsupported algorithm: ${cose.alg}`,\n            };\n        }\n\n        // Step 4: Trust check (reuse 0.2.1 skipTrustCheck semantics)\n        const issuerCertBytes = cose.x5chain[0];\n        if (!issuerCertBytes) {\n            throw new MalformedCredentialError('Missing issuer certificate in x5chain');\n        }\n        if (options.trustedCertificates.length === 0) {\n            if (options.skipTrustCheck !== true) {\n                throw new MalformedCredentialError(\n                    'trustedCertificates must not be empty unless skipTrustCheck is true'\n                );\n            }\n        } else {\n            const trusted = options.trustedCertificates.some((t) => bytesEqual(t, issuerCertBytes));\n            if (!trusted) {\n                return {\n                    valid: false,\n                    format: this.format,\n                    claims: {},\n                    issuer: { certificate: issuerCertBytes, country: '' },\n                    error: 'Issuer certificate is not trusted',\n                };\n            }\n        }\n\n        // Step 5: Import public key + verify signature\n        const publicKey = await importX509(derToPem(issuerCertBytes), cose.alg);\n        try {\n            await verifyCoseSign1(cose, publicKey, allowedAlgorithms);\n        } catch (err) {\n            if (err instanceof MalformedCredentialError) {\n                return {\n                    valid: false,\n                    format: this.format,\n                    claims: {},\n                    issuer: { certificate: issuerCertBytes, country: '' },\n                    error: err.message,\n                };\n            }\n            throw err;\n        }\n\n        // Step 6: Decode + validate MSO\n        const mso = decodeMso(cose.payload);\n        try {\n            validateMsoValidity(mso, new Date());\n        } catch (err) {\n            if (err instanceof ExpiredCredentialError) {\n                return {\n                    valid: false,\n                    format: this.format,\n                    claims: {},\n                    issuer: { certificate: issuerCertBytes, country: '' },\n                    error: 'Credential expired',\n                };\n            }\n            throw err;\n        }\n\n        if (options.expectedDocType !== undefined) {\n            try {\n                validateMsoDocType(mso, options.expectedDocType);\n            } catch (err) {\n                if (err instanceof MalformedCredentialError) {\n                    return {\n                        valid: false,\n                        format: this.format,\n                        claims: {},\n                        issuer: { certificate: issuerCertBytes, country: '' },\n                        error: err.message,\n                    };\n                }\n                throw err;\n            }\n        }\n\n        // Step 7: Extract items from nameSpaces, verify all digests\n        const nsRaw = issuerSigned.get('nameSpaces');\n        if (!(nsRaw instanceof Map)) {\n            throw new MalformedCredentialError('issuerSigned.nameSpaces must be a Map');\n        }\n        const nameSpaces = new Map<string, Uint8Array[]>();\n        for (const [ns, items] of (nsRaw as Map<unknown, unknown>).entries()) {\n            if (typeof ns !== 'string' || !Array.isArray(items)) {\n                throw new MalformedCredentialError('nameSpaces entry malformed');\n            }\n            nameSpaces.set(ns, items.map(extractRawItemBytes));\n        }\n        await verifyAllDigests(nameSpaces, mso);\n\n        // Step 8: Map to claims\n        const { flat: claims, namespaced: namespacedClaims } = mapRawToClaims(nameSpaces);\n\n        const issuer: IssuerInfo = {\n            certificate: issuerCertBytes,\n            country: extractCountryHintFromCert(issuerCertBytes),\n        };\n        return {\n            valid: true,\n            format: this.format,\n            claims,\n            issuer,\n            docType: mso.docType,\n            namespacedClaims,\n        };\n    }\n}\n","import { splitSdJwt, decodeSdJwt, getClaims } from '@sd-jwt/decode';\nimport { decodeProtectedHeader, jwtVerify, importX509, importJWK } from 'jose';\n\nimport { MalformedCredentialError } from '../errors.js';\nimport type { IssuerInfo } from '../types/issuer.js';\nimport type { CredentialFormat, CredentialClaims, PresentationResult } from '../types/presentation.js';\n\nimport type { ICredentialParser, ParseOptions } from './parser.interface.js';\n\n/**\n * Hasher function signature expected by @sd-jwt/decode.\n * Inlined here to avoid a direct dependency on @sd-jwt/types.\n */\ntype SdJwtHasher = (data: string | ArrayBuffer, alg: string) => Promise<Uint8Array>;\n\nconst DEFAULT_ALLOWED_ALGORITHMS = ['ES256', 'ES384', 'ES512'];\n\n/**\n * SHA-256 hasher implementation using the Web Crypto API.\n * Compatible with the @sd-jwt/decode Hasher signature.\n */\nconst sha256Hasher: SdJwtHasher = async (data: string | ArrayBuffer, _alg: string): Promise<Uint8Array> => {\n    const encoder = new TextEncoder();\n    const input = typeof data === 'string' ? encoder.encode(data) : data;\n    const hashBuffer = await crypto.subtle.digest('SHA-256', input);\n    return new Uint8Array(hashBuffer);\n};\n\n// Standard base64 alphabet for decoding x5c certificate entries\nconst BASE64_CHARS = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';\n\n/**\n * Decodes a standard base64-encoded string into raw bytes.\n * Does not depend on Node.js Buffer or browser atob.\n */\nfunction base64ToBytes(base64: string): Uint8Array<ArrayBuffer> {\n    const cleaned = base64.replace(/=+$/, '');\n    const byteLength = Math.floor((cleaned.length * 3) / 4);\n    const buffer = new ArrayBuffer(byteLength);\n    const bytes = new Uint8Array(buffer);\n\n    let byteIndex = 0;\n    for (let i = 0; i < cleaned.length; i += 4) {\n        const a = BASE64_CHARS.indexOf(cleaned[i]);\n        const b = i + 1 < cleaned.length ? BASE64_CHARS.indexOf(cleaned[i + 1]) : 0;\n        const c = i + 2 < cleaned.length ? BASE64_CHARS.indexOf(cleaned[i + 2]) : 0;\n        const d = i + 3 < cleaned.length ? BASE64_CHARS.indexOf(cleaned[i + 3]) : 0;\n\n        bytes[byteIndex++] = (a << 2) | (b >> 4);\n        if (byteIndex < byteLength) bytes[byteIndex++] = ((b & 0x0f) << 4) | (c >> 2);\n        if (byteIndex < byteLength) bytes[byteIndex++] = ((c & 0x03) << 6) | d;\n    }\n\n    return bytes;\n}\n\n/**\n * Checks whether two Uint8Array instances contain identical bytes.\n */\nfunction bytesEqual(a: Uint8Array, b: Uint8Array): boolean {\n    if (a.length !== b.length) return false;\n    for (let i = 0; i < a.length; i++) {\n        if (a[i] !== b[i]) return false;\n    }\n    return true;\n}\n\n/**\n * Converts a base64-encoded DER certificate to PEM format for jose.importX509.\n */\nfunction derToPem(base64Der: string): string {\n    const lines = base64Der.match(/.{1,64}/g) || [];\n    return `-----BEGIN CERTIFICATE-----\\n${lines.join('\\n')}\\n-----END CERTIFICATE-----`;\n}\n\n/**\n * Encodes a Uint8Array to base64url (no padding).\n * Used by disclosure hash verification (Task 5) and KB-JWT verification (Task 6).\n */\nfunction bytesToBase64url(bytes: Uint8Array): string {\n    let binary = '';\n    for (const byte of bytes) {\n        binary += String.fromCharCode(byte);\n    }\n    return globalThis.btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n}\n\n/**\n * Maps raw decoded claims to the CredentialClaims structure,\n * picking known age/residency fields and preserving any extra keys.\n */\nfunction mapToCredentialClaims(raw: Record<string, unknown>): CredentialClaims {\n    const claims: CredentialClaims = {};\n\n    if (typeof raw['age_over_18'] === 'boolean') {\n        claims.age_over_18 = raw['age_over_18'];\n    }\n    if (typeof raw['age_over_21'] === 'boolean') {\n        claims.age_over_21 = raw['age_over_21'];\n    }\n    if (typeof raw['resident_country'] === 'string') {\n        claims.resident_country = raw['resident_country'];\n    }\n    if (typeof raw['nationality'] === 'string') {\n        claims.nationality = raw['nationality'];\n    }\n    if (typeof raw['family_name_birth'] === 'string') {\n        claims.family_name_birth = raw['family_name_birth'];\n    }\n\n    for (const [key, value] of Object.entries(raw)) {\n        if (\n            !(key in claims) &&\n            !key.startsWith('_sd') &&\n            key !== 'iss' &&\n            key !== 'exp' &&\n            key !== 'iat' &&\n            key !== 'cnf' &&\n            key !== 'vct'\n        ) {\n            claims[key] = value;\n        }\n    }\n\n    return claims;\n}\n\n/**\n * Best-effort extraction of a country code hint from an issuer URL or string.\n */\nfunction extractCountryHint(issuer: string): string {\n    try {\n        const url = new URL(issuer);\n        const tld = url.hostname.split('.').pop()?.toUpperCase();\n        if (tld && tld.length === 2) {\n            return tld;\n        }\n    } catch {\n        // Not a valid URL\n    }\n    return '';\n}\n\n/**\n * SD-JWT VC credential parser.\n *\n * Decodes and cryptographically validates SD-JWT Verifiable Credentials:\n *   - JWT signature verification via x5c public key (jose)\n *   - Issuer certificate trust chain verification\n *   - Disclosure hash integrity verification\n *   - Key binding JWT signature and sd_hash verification\n *   - Selective disclosure claim extraction\n */\nexport class SdJwtParser implements ICredentialParser {\n    readonly format: CredentialFormat = 'sd-jwt-vc';\n\n    canParse(vpToken: unknown): boolean {\n        return typeof vpToken === 'string' && vpToken.includes('~');\n    }\n\n    async parse(vpToken: unknown, options: ParseOptions): Promise<PresentationResult> {\n        if (typeof vpToken !== 'string') {\n            throw new MalformedCredentialError('VP token must be a string');\n        }\n\n        const allowedAlgorithms = options.allowedAlgorithms ?? DEFAULT_ALLOWED_ALGORITHMS;\n\n        const invalidResult = (error: string): PresentationResult => ({\n            valid: false,\n            format: this.format,\n            claims: {},\n            issuer: { certificate: new Uint8Array(), country: '' },\n            error,\n        });\n\n        // Step 1: Split the SD-JWT into components\n        let parts: ReturnType<typeof splitSdJwt>;\n        try {\n            parts = splitSdJwt(vpToken);\n        } catch {\n            throw new MalformedCredentialError('Failed to split SD-JWT structure');\n        }\n\n        // Step 2: Peek at issuer JWT header (need alg and x5c before verification)\n        let header: ReturnType<typeof decodeProtectedHeader>;\n        try {\n            header = decodeProtectedHeader(parts.jwt);\n        } catch {\n            throw new MalformedCredentialError('Failed to decode SD-JWT issuer JWT header');\n        }\n\n        // Step 3: Check algorithm against allowlist\n        const alg = header.alg;\n        if (typeof alg !== 'string' || !allowedAlgorithms.includes(alg)) {\n            return invalidResult(`Unsupported algorithm: ${alg}`);\n        }\n\n        // Step 4: Extract public key from x5c certificate\n        const x5cArray = header.x5c;\n        if (!Array.isArray(x5cArray) || x5cArray.length === 0 || typeof x5cArray[0] !== 'string') {\n            throw new MalformedCredentialError('Missing or invalid x5c in JWT header');\n        }\n\n        let issuerKey: Awaited<ReturnType<typeof importX509>>;\n        let issuerCertBytes: Uint8Array;\n        try {\n            issuerKey = await importX509(derToPem(x5cArray[0]), alg);\n            issuerCertBytes = base64ToBytes(x5cArray[0]);\n        } catch (err) {\n            if (err instanceof MalformedCredentialError) throw err;\n            throw new MalformedCredentialError('Failed to import issuer certificate');\n        }\n\n        // Step 5: Verify issuer JWT signature (also validates exp, iat via jose)\n        let payload: Record<string, unknown>;\n        try {\n            const result = await jwtVerify(parts.jwt, issuerKey, { algorithms: allowedAlgorithms });\n            payload = result.payload as unknown as Record<string, unknown>;\n        } catch {\n            return invalidResult('Issuer JWT signature verification failed');\n        }\n\n        // Step 6: Trust check — certificate must be in the trusted set\n        // unless the caller explicitly opts out via skipTrustCheck.\n        const issuerString = typeof payload['iss'] === 'string' ? payload['iss'] : '';\n        const issuerInfo: IssuerInfo = {\n            certificate: issuerCertBytes,\n            country: extractCountryHint(issuerString),\n        };\n\n        if (options.trustedCertificates.length === 0) {\n            if (options.skipTrustCheck !== true) {\n                throw new MalformedCredentialError(\n                    'trustedCertificates must not be empty unless skipTrustCheck is true'\n                );\n            }\n        } else {\n            const isTrusted = options.trustedCertificates.some((trusted) => bytesEqual(trusted, issuerCertBytes));\n            if (!isTrusted) {\n                return invalidResult('Issuer certificate is not trusted');\n            }\n        }\n\n        // Step 7: Verify disclosure hashes against _sd array\n        const sdArray = payload['_sd'];\n        if (parts.disclosures.length > 0) {\n            if (!Array.isArray(sdArray) || sdArray.length === 0) {\n                return invalidResult('Disclosures present but no _sd array in issuer JWT');\n            }\n            for (const disclosure of parts.disclosures) {\n                const hashBytes = await sha256Hasher(disclosure, 'sha-256');\n                const hashB64url = bytesToBase64url(hashBytes);\n                if (!sdArray.includes(hashB64url)) {\n                    return invalidResult('Disclosure hash mismatch');\n                }\n            }\n        }\n\n        // Step 8: Verify key binding JWT (if present)\n        if (parts.kbJwt) {\n            // Extract holder public key from cnf claim\n            const cnf = payload['cnf'] as Record<string, unknown> | undefined;\n            if (!cnf || typeof cnf !== 'object' || !cnf['jwk']) {\n                throw new MalformedCredentialError('Missing cnf.jwk in issuer JWT for key binding');\n            }\n\n            let holderKey: Awaited<ReturnType<typeof importJWK>>;\n            try {\n                const kbHeader = decodeProtectedHeader(parts.kbJwt);\n                const kbAlg = kbHeader.alg;\n                if (typeof kbAlg !== 'string' || !allowedAlgorithms.includes(kbAlg)) {\n                    return invalidResult(`Unsupported KB-JWT algorithm: ${kbAlg}`);\n                }\n                holderKey = await importJWK(cnf['jwk'] as Record<string, unknown>, kbAlg);\n            } catch (err) {\n                if (err instanceof MalformedCredentialError) throw err;\n                throw new MalformedCredentialError('Failed to import holder key from cnf.jwk');\n            }\n\n            // Verify KB-JWT signature\n            let kbPayload: Record<string, unknown>;\n            try {\n                const kbResult = await jwtVerify(parts.kbJwt, holderKey, {\n                    algorithms: allowedAlgorithms,\n                    ...(options.audience ? { audience: options.audience } : {}),\n                });\n                kbPayload = kbResult.payload as unknown as Record<string, unknown>;\n            } catch {\n                return invalidResult('Key binding JWT signature verification failed');\n            }\n\n            // Validate nonce — must be present and match when KB-JWT is used\n            if (kbPayload['nonce'] !== options.nonce) {\n                return invalidResult('Key binding JWT nonce does not match');\n            }\n\n            // Verify sd_hash — hash of the SD-JWT content before the KB-JWT\n            const disclosurePart = parts.disclosures.length > 0 ? parts.disclosures.join('~') + '~' : '';\n            const sdJwtForHash = parts.jwt + '~' + disclosurePart;\n            const sdHashBytes = await sha256Hasher(sdJwtForHash, 'sha-256');\n            const expectedSdHash = bytesToBase64url(sdHashBytes);\n            if (kbPayload['sd_hash'] !== expectedSdHash) {\n                return invalidResult('Key binding JWT sd_hash does not match');\n            }\n        }\n\n        // Step 9: Decode disclosures and extract claims\n        let resolvedClaims: Record<string, unknown>;\n        try {\n            const decoded = await decodeSdJwt(vpToken, sha256Hasher);\n            resolvedClaims = await getClaims<Record<string, unknown>>(\n                decoded.jwt.payload,\n                decoded.disclosures,\n                sha256Hasher\n            );\n        } catch {\n            throw new MalformedCredentialError('Failed to decode SD-JWT disclosures');\n        }\n\n        const vct = typeof payload['vct'] === 'string' ? (payload['vct'] as string) : undefined;\n\n        return {\n            valid: true,\n            format: this.format,\n            claims: mapToCredentialClaims(resolvedClaims),\n            issuer: issuerInfo,\n            ...(vct !== undefined ? { vct } : {}),\n        };\n    }\n}\n","import { MdocParser } from './parsers/mdoc.parser.js';\nimport type { ParseOptions, ICredentialParser } from './parsers/parser.interface.js';\nimport { SdJwtParser } from './parsers/sd-jwt.parser.js';\nimport type { PresentationResult } from './types/presentation.js';\n\nconst parsers: ICredentialParser[] = [new SdJwtParser(), new MdocParser()];\n\nexport async function parsePresentation(vpToken: unknown, options: ParseOptions): Promise<PresentationResult> {\n    for (const parser of parsers) {\n        if (parser.canParse(vpToken)) {\n            return parser.parse(vpToken, options);\n        }\n    }\n\n    return {\n        valid: false,\n        format: 'sd-jwt-vc',\n        claims: {},\n        issuer: { certificate: new Uint8Array(), country: '' },\n        error: 'Unsupported credential format',\n    };\n}\n\nexport type { ParseOptions } from './parsers/parser.interface.js';\n","import { matchQuery, buildSubmission } from '@openeudi/dcql';\nimport type {\n    DcqlQuery,\n    DecodedCredential,\n    DcqlMatchResult,\n    CredentialQuery,\n    UnmatchedReason,\n} from '@openeudi/dcql';\n\nimport { parsePresentation } from './presentation.js';\nimport type { CredentialFormat } from './types/presentation.js';\nimport type { VerifyOptions, VerifyResult } from './types/verify.js';\n\n/**\n * Maps the internal `CredentialFormat` to the DCQL wire-level format string\n * as defined by OpenID4VP 1.0 final. The internal `sd-jwt-vc` value predates\n * the DCQL `dc+sd-jwt` identifier; we translate here so the parser contract\n * stays stable.\n */\nconst INTERNAL_TO_DCQL_FORMAT: Record<CredentialFormat, string> = {\n    'sd-jwt-vc': 'dc+sd-jwt',\n    mdoc: 'mso_mdoc',\n};\n\n/**\n * Replicates `@openeudi/dcql@0.1.1`'s internal `matchCredentialQuery`\n * precedence to restore a specific `UnmatchedReason` that the public\n * `matchQuery` API collapses to `'no_credential_found'`.\n *\n * The outer `matchQuery` preserves the inner `detail` JSON-pointer when the\n * inner reason is `missing_claims`, which we use as the only available\n * signal to distinguish claim-path rejections from category rejections.\n *\n * TODO: remove this workaround once @openeudi/dcql surfaces specific\n * reasons at its public API.\n */\nfunction classifyMismatch(\n    query: CredentialQuery,\n    decoded: DecodedCredential,\n    hasDetail: boolean\n): UnmatchedReason {\n    if (decoded.format !== query.format) return 'format_mismatch';\n\n    if (query.format === 'dc+sd-jwt') {\n        const allowed = query.meta?.vct_values;\n        if (allowed && allowed.length > 0 && !allowed.includes(decoded.vct ?? '')) {\n            return 'vct_mismatch';\n        }\n    }\n\n    if (query.format === 'mso_mdoc') {\n        const expected = query.meta?.doctype_value;\n        if (expected && expected !== decoded.doctype) return 'doctype_mismatch';\n    }\n\n    if (query.trusted_authorities && query.trusted_authorities.length > 0) {\n        const decodedAuthIds = decoded.trusted_authority_ids ?? [];\n        const anyMatch = query.trusted_authorities.some((ta) =>\n            ta.values.some((v) => decodedAuthIds.includes(v))\n        );\n        if (!anyMatch) return 'trusted_authority_mismatch';\n    }\n\n    if (hasDetail) return 'missing_claims';\n    return 'no_credential_found';\n}\n\n/**\n * Post-processes `DcqlMatchResult.unmatched` to replace the collapsed\n * `'no_credential_found'` reason that `@openeudi/dcql@0.1.1` returns with a\n * specific `UnmatchedReason` from {@link classifyMismatch}. Fast-path return\n * when there is nothing to refine (happy path), so this costs nothing on\n * successful verifications.\n */\nfunction refineUnmatched(\n    query: DcqlQuery,\n    decoded: DecodedCredential,\n    match: DcqlMatchResult\n): DcqlMatchResult {\n    if (match.unmatched.length === 0) return match;\n\n    const refined = match.unmatched.map((entry) => {\n        const credentialQuery = query.credentials.find((c) => c.id === entry.queryId);\n        if (!credentialQuery) return entry;\n        const specific = classifyMismatch(credentialQuery, decoded, entry.detail !== undefined);\n        return { ...entry, reason: specific };\n    });\n\n    return { ...match, unmatched: refined };\n}\n\n/**\n * Parses a VP token, then matches it against a DCQL query.\n *\n * Cryptographic / structural parser failures still throw (via `parsePresentation`).\n * Query-level mismatches are surfaced as `match.unmatched` entries so callers can\n * show per-claim diagnostics.\n *\n * @param vpToken raw VP token (SD-JWT string or mDOC Uint8Array)\n * @param query  DCQL query describing the required credential(s)\n * @param options parse + verify options (nonce, trusted issuers, etc.)\n */\nexport async function verifyPresentation(\n    vpToken: unknown,\n    query: DcqlQuery,\n    options: VerifyOptions\n): Promise<VerifyResult> {\n    const parsed = await parsePresentation(vpToken, options);\n\n    const dcqlFormat = INTERNAL_TO_DCQL_FORMAT[parsed.format] ?? parsed.format;\n\n    // For mDOC, DCQL claim paths address namespace-grouped values (e.g. ['ns', 'attr']).\n    // For SD-JWT, the flat claim bag is addressed directly.\n    const decodedClaims: Record<string, unknown> =\n        parsed.format === 'mdoc' && parsed.namespacedClaims !== undefined\n            ? (parsed.namespacedClaims as Record<string, unknown>)\n            : (parsed.claims as unknown as Record<string, unknown>);\n\n    const decoded: DecodedCredential = {\n        id: query.credentials[0]?.id ?? 'presented',\n        format: dcqlFormat,\n        claims: decodedClaims,\n    };\n\n    if (parsed.format === 'sd-jwt-vc' && typeof parsed.vct === 'string') {\n        decoded.vct = parsed.vct;\n    }\n    if (parsed.format === 'mdoc' && typeof parsed.docType === 'string') {\n        decoded.doctype = parsed.docType;\n    }\n\n    const rawMatch = matchQuery(query, [decoded]);\n    const match = refineUnmatched(query, decoded, rawMatch);\n    const submission = match.satisfied ? buildSubmission(query, match) : null;\n\n    return {\n        parsed,\n        match,\n        submission,\n        valid: parsed.valid && match.satisfied,\n    };\n}\n","export const VERSION = '0.4.0';\n\n// Builders\nexport { createAuthorizationRequest } from './authorization.js';\nexport {\n    buildHaipQuery,\n    validateHaipQuery,\n    isHaipQuery,\n    HAIP_DOCTYPE_NAMESPACES,\n} from './haip.js';\n\n// Parsers / verifiers\nexport { parsePresentation } from './presentation.js';\nexport { verifyPresentation } from './verify.js';\nexport { SdJwtParser } from './parsers/sd-jwt.parser.js';\nexport { MdocParser } from './parsers/mdoc.parser.js';\nexport type { ICredentialParser, ParseOptions } from './parsers/parser.interface.js';\n\n// Own errors\nexport {\n    InvalidSignatureError,\n    ExpiredCredentialError,\n    UnsupportedFormatError,\n    MalformedCredentialError,\n    NonceValidationError,\n    HaipValidationError,\n} from './errors.js';\nexport type { HaipValidationCode } from './errors.js';\n\n// Re-exports from @openeudi/dcql\nexport { DcqlValidationError, DcqlMatchError } from '@openeudi/dcql';\nexport type { DcqlValidationErrorCode } from '@openeudi/dcql';\nexport type { DcqlQuery, DcqlMatchResult, DcqlSubmission } from '@openeudi/dcql';\n\n// Own types\nexport type {\n    CredentialFormat,\n    CredentialClaims,\n    PresentationResult,\n    IssuerInfo,\n    AuthorizationRequestInput,\n    AuthorizationRequest,\n    VerifyOptions,\n    VerifyResult,\n    HaipQueryInput,\n} from './types/index.js';\n"]}

package/dist/index.d.cts

@@ -1,3 +1,36 @@
+import { DcqlQuery, TrustedAuthoritiesQuery, DcqlMatchResult, DcqlSubmission } from '@openeudi/dcql';
+export { DcqlMatchError, DcqlMatchResult, DcqlQuery, DcqlSubmission, DcqlValidationError, DcqlValidationErrorCode } from '@openeudi/dcql';
+
+interface AuthorizationRequestInput {
+    clientId: string;
+    responseUri: string;
+    nonce: string;
+    state?: string;
+    responseMode?: 'direct_post' | 'direct_post.jwt';
+}
+interface AuthorizationRequest {
+    uri: string;
+    dcqlQuery: DcqlQuery;
+    nonce: string;
+    state: string;
+}
+
+declare function createAuthorizationRequest(input: AuthorizationRequestInput, query: DcqlQuery): AuthorizationRequest;
+
+interface HaipQueryInput {
+    credentialId: string;
+    format: 'dc+sd-jwt' | 'mso_mdoc';
+    vctValues?: string[];
+    doctypeValue?: string;
+    claims: string[];
+    trustedAuthorities?: TrustedAuthoritiesQuery[];
+}
+
+declare const HAIP_DOCTYPE_NAMESPACES: Record<string, string>;
+declare function buildHaipQuery(input: HaipQueryInput): DcqlQuery;
+declare function validateHaipQuery(query: DcqlQuery): void;
+declare function isHaipQuery(query: DcqlQuery): boolean;
+
 interface IssuerInfo {
     certificate: Uint8Array;
     country: string;
@@ -20,21 +53,15 @@ interface PresentationResult {
     claims: CredentialClaims;
     issuer: IssuerInfo;
     error?: string;
-}
-
-interface AuthorizationRequestInput {
-    requestedAttributes: string[];
-    acceptedFormats: CredentialFormat[];
-    responseUri: string;
-    nonce: string;
-    clientId: string;
-    state?: string;
-}
-interface AuthorizationRequest {
-    uri: string;
-    presentationDefinition: object;
-    nonce: string;
-    state: string;
+    /** SD-JWT type (Verifiable Credential Type URI). Populated for `sd-jwt-vc` format. */
+    vct?: string;
+    /** mDOC docType (ISO 18013-5). Populated for `mdoc` format. */
+    docType?: string;
+    /**
+     * mDOC claims grouped by namespace. Populated for `mdoc` format.
+     * DCQL claim paths address this shape: `['org.iso.18013.5.1', 'age_over_18']`.
+     */
+    namespacedClaims?: Record<string, Record<string, unknown>>;
 }
 
 interface ParseOptions {
@@ -65,6 +92,29 @@ interface ICredentialParser {
     parse(vpToken: unknown, options: ParseOptions): Promise<PresentationResult>;
 }
 
+declare function parsePresentation(vpToken: unknown, options: ParseOptions): Promise<PresentationResult>;
+
+type VerifyOptions = ParseOptions;
+interface VerifyResult {
+    parsed: PresentationResult;
+    match: DcqlMatchResult;
+    submission: DcqlSubmission | null;
+    valid: boolean;
+}
+
+/**
+ * Parses a VP token, then matches it against a DCQL query.
+ *
+ * Cryptographic / structural parser failures still throw (via `parsePresentation`).
+ * Query-level mismatches are surfaced as `match.unmatched` entries so callers can
+ * show per-claim diagnostics.
+ *
+ * @param vpToken raw VP token (SD-JWT string or mDOC Uint8Array)
+ * @param query  DCQL query describing the required credential(s)
+ * @param options parse + verify options (nonce, trusted issuers, etc.)
+ */
+declare function verifyPresentation(vpToken: unknown, query: DcqlQuery, options: VerifyOptions): Promise<VerifyResult>;
+
 /**
  * SD-JWT VC credential parser.
  *
@@ -124,11 +174,13 @@ declare class MalformedCredentialError extends Error {
 declare class NonceValidationError extends Error {
     constructor(message?: string);
 }
+type HaipValidationCode = 'EMPTY_QUERY' | 'UNSUPPORTED_FORMAT' | 'MISSING_SDJWT_META' | 'MISSING_MDOC_META' | 'NO_CLAIMS' | 'CLAIM_SETS_DISALLOWED' | 'CREDENTIAL_SETS_DISALLOWED';
+declare class HaipValidationError extends Error {
+    readonly code: HaipValidationCode;
+    readonly credentialId?: string;
+    constructor(code: HaipValidationCode, message: string, credentialId?: string);
+}
 
-declare function createAuthorizationRequest(input: AuthorizationRequestInput): AuthorizationRequest;
-
-declare function parsePresentation(vpToken: unknown, options: ParseOptions): Promise<PresentationResult>;
-
-declare const VERSION = "0.3.0";
+declare const VERSION = "0.4.0";
 
-export { type AuthorizationRequest, type AuthorizationRequestInput, type CredentialClaims, type CredentialFormat, ExpiredCredentialError, type ICredentialParser, InvalidSignatureError, type IssuerInfo, MalformedCredentialError, MdocParser, NonceValidationError, type ParseOptions, type PresentationResult, SdJwtParser, UnsupportedFormatError, VERSION, createAuthorizationRequest, parsePresentation };
+export { type AuthorizationRequest, type AuthorizationRequestInput, type CredentialClaims, type CredentialFormat, ExpiredCredentialError, HAIP_DOCTYPE_NAMESPACES, type HaipQueryInput, type HaipValidationCode, HaipValidationError, type ICredentialParser, InvalidSignatureError, type IssuerInfo, MalformedCredentialError, MdocParser, NonceValidationError, type ParseOptions, type PresentationResult, SdJwtParser, UnsupportedFormatError, VERSION, type VerifyOptions, type VerifyResult, buildHaipQuery, createAuthorizationRequest, isHaipQuery, parsePresentation, validateHaipQuery, verifyPresentation };