@owf/eudi-jades 0.1.0

package/dist/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../src/constants.ts","../src/jades-exception.ts","../src/schemas.ts","../src/utils.ts","../src/token.ts","../src/verifier.ts"],"sourcesContent":["/**\n * JAdES Constants\n *\n * Algorithm definitions and OIDs as per ETSI TS 119 182-1.\n */\n\n/**\n * Supported signature algorithms with their hash algorithms.\n */\nexport const ALGORITHMS = {\n  // RSA PKCS#1 v1.5\n  RS256: { hash: 'SHA-256', family: 'RSA' },\n  RS384: { hash: 'SHA-384', family: 'RSA' },\n  RS512: { hash: 'SHA-512', family: 'RSA' },\n\n  // RSA-PSS\n  PS256: { hash: 'SHA-256', family: 'RSA-PSS' },\n  PS384: { hash: 'SHA-384', family: 'RSA-PSS' },\n  PS512: { hash: 'SHA-512', family: 'RSA-PSS' },\n\n  // ECDSA\n  ES256: { hash: 'SHA-256', family: 'ECDSA', namedCurve: 'P-256' },\n  ES384: { hash: 'SHA-384', family: 'ECDSA', namedCurve: 'P-384' },\n  ES512: { hash: 'SHA-512', family: 'ECDSA', namedCurve: 'P-521' },\n} as const\n\n/**\n * Commitment type OIDs as per RFC 5035.\n */\nexport enum CommitmentOIDs {\n  /** Proof of origin */\n  proofOfOrigin = '1.2.840.113549.1.9.16.6.1',\n  /** Proof of receipt */\n  proofOfReceipt = '1.2.840.113549.1.9.16.6.2',\n  /** Proof of delivery */\n  proofOfDelivery = '1.2.840.113549.1.9.16.6.3',\n  /** Proof of sender */\n  proofOfSender = '1.2.840.113549.1.9.16.6.4',\n  /** Proof of approval */\n  proofOfApproval = '1.2.840.113549.1.9.16.6.5',\n  /** Proof of creation */\n  proofOfCreation = '1.2.840.113549.1.9.16.6.6',\n}\n\n/**\n * JAdES baseline profiles as per ETSI TS 119 182-1.\n */\nexport enum JAdESProfile {\n  /** Basic - Baseline: basic signature format */\n  B_B = 'B-B',\n  /** Basic with Time: signatures with timestamp */\n  B_T = 'B-T',\n  /** Basic Long-Term: signatures with validation data for long-term preservation */\n  B_LT = 'B-LT',\n  /** Basic Long-Term with Archive timestamps */\n  B_LTA = 'B-LTA',\n}\n\n/**\n * Detached signature mechanism identifiers as per ETSI TS 119 182-1 Section 5.2.8.\n */\nexport const DETACHED_MECHANISM_IDS = {\n  /** HTTP Headers mechanism */\n  httpHeaders: 'http://uri.etsi.org/19182/HttpHeaders',\n  /** Object digest mechanism */\n  objectDigest: 'http://uri.etsi.org/19182/ObjectIdByURIHash',\n} as const\n\n/**\n * Critical header parameters that must be understood.\n * ETSI TS 119 182-1 specifies these parameters as critical.\n */\nexport const CRITICAL_PARAMETERS = [\n  'x5t#o',\n  'sigX5ts',\n  'sigT',\n  'sigD',\n  'sigPl',\n  'sigPId',\n  'srCms',\n  'srAts',\n  'adoTst',\n  'b64',\n] as const\n","/**\n * JAdES Exception\n *\n * Custom exception for JAdES-related errors.\n */\n\nexport class JAdESException extends Error {\n  constructor(message: string) {\n    super(message)\n    this.name = 'JAdESException'\n    Object.setPrototypeOf(this, JAdESException.prototype)\n  }\n}\n","/**\n * JAdES Zod Schemas\n *\n * Zod schemas for JAdES (JSON Advanced Electronic Signatures) as per ETSI TS 119 182-1.\n * Types are derived from these schemas via z.infer<>.\n *\n * @see https://www.etsi.org/deliver/etsi_ts/119100_119199/11918201/01.02.01_60/ts_11918201v010201p.pdf\n */\n\nimport { z } from 'zod'\nimport { ALGORITHMS } from './constants'\n\n// ============================================================================\n// Algorithm Schema\n// ============================================================================\n\n/**\n * Supported signature algorithms.\n */\nexport const SignAlgSchema = z.enum([\n  'ES256',\n  'ES384',\n  'ES512',\n  'RS256',\n  'RS384',\n  'RS512',\n  'PS256',\n  'PS384',\n  'PS512',\n])\n\n// ============================================================================\n// X.509 Certificate Schemas\n// ============================================================================\n\n/**\n * X.509 Certificate Thumbprint with algorithm specification.\n * ETSI TS 119 182-1 Section 5.2.2.2\n */\nexport const X5tOSchema = z.object({\n  /** Digest algorithm identifier (e.g., 'S384', 'S512') */\n  digAlg: z.string().min(1),\n  /** Base64url-encoded digest value */\n  digVal: z.string().min(1),\n})\n\n// ============================================================================\n// Commitment Reference Schema\n// ============================================================================\n\n/**\n * Commitment reference as per ETSI TS 119 182-1 Section 5.2.5.\n */\nexport const CommitmentReferenceSchema = z.object({\n  /** Commitment type identifier (OID or URI) */\n  commId: z.string().min(1),\n  /** Commitment qualifiers */\n  commQuals: z.array(z.object({}).passthrough()).optional(),\n})\n\n// ============================================================================\n// Signature Policy Schema\n// ============================================================================\n\n/**\n * Signature policy hash.\n */\nexport const SignaturePolicyHashSchema = z.object({\n  hashAlgo: z.string().min(1),\n  hashVal: z.string().min(1),\n})\n\n/**\n * Signature policy descriptor.\n * ETSI TS 119 182-1 Section 5.2.4\n */\nexport const SignaturePolicySchema = z.object({\n  /** Policy identifier */\n  sigPolicyId: z.string().optional(),\n  /** Policy hash */\n  sigPolicyHash: SignaturePolicyHashSchema.optional(),\n  /** Policy qualifiers */\n  sigPolicyQualifiers: z.array(z.object({}).passthrough()).optional(),\n})\n\n// ============================================================================\n// Signer Identifier Schema\n// ============================================================================\n\n/**\n * Issuer and serial number for signer identification.\n */\nexport const IssuerSerialSchema = z.object({\n  issuer: z.string().min(1),\n  serialNumber: z.string().min(1),\n})\n\n/**\n * Signer identifier.\n * ETSI TS 119 182-1 Section 5.2.3\n */\nexport const SignerIdentifierSchema = z.object({\n  /** Issuer and serial number */\n  issuerSerial: IssuerSerialSchema.optional(),\n  /** Subject key identifier */\n  subjectKeyIdentifier: z.string().optional(),\n})\n\n// ============================================================================\n// Detached Signature Descriptor Schema\n// ============================================================================\n\n/**\n * Detached signature descriptor.\n * ETSI TS 119 182-1 Section 5.2.8\n */\nexport const SigDSchema = z.object({\n  /** Mechanism identifier */\n  mId: z.string().min(1),\n  /** Parameters (tuple of 2 strings) */\n  pars: z.tuple([z.string(), z.string()]),\n  /** Hash algorithm */\n  hashM: z.string().optional(),\n  /** Canonicalization algorithm */\n  ctM: z.string().optional(),\n})\n\n// ============================================================================\n// Timestamp Schemas (for B-T, B-LT, B-LTA profiles)\n// ============================================================================\n\n/**\n * Timestamp token value.\n */\nexport const TstTokenValueSchema = z.object({\n  val: z.string().min(1),\n})\n\n/**\n * Timestamp tokens container.\n */\nexport const TstTokensSchema = z.object({\n  tstTokens: z.array(TstTokenValueSchema).min(1),\n})\n\n/**\n * Signature timestamp container (for B-T profile).\n */\nexport const SigTstSchema = z.object({\n  sigTst: TstTokensSchema,\n})\n\n/**\n * X.509 certificate values (for B-LT profile).\n */\nexport const XValsSchema = z.object({\n  xVals: z.array(\n    z.object({\n      x509Cert: z.string().min(1),\n    })\n  ),\n})\n\n/**\n * Revocation values (for B-LT profile).\n */\nexport const RValsSchema = z.object({\n  rVals: z.object({\n    crlVals: z.array(z.string()),\n    ocspVals: z.array(z.string()),\n  }),\n})\n\n/**\n * Archive timestamp (for B-LTA profile).\n */\nexport const ArcTstSchema = z.object({\n  arcTst: TstTokensSchema.extend({\n    canonAlg: z.string().optional(),\n  }),\n})\n\n/**\n * ETSI Unsigned properties for different JAdES profiles.\n */\nexport const EtsiUSchema = z.union([\n  // B-T: Just timestamp\n  z.array(SigTstSchema),\n  // B-LT: timestamp + validation data\n  z.tuple([SigTstSchema, XValsSchema, RValsSchema]),\n  // B-LTA: timestamp + validation data + archive timestamp\n  z.tuple([SigTstSchema, XValsSchema, RValsSchema, ArcTstSchema]),\n])\n\n// ============================================================================\n// Protected Header Schema\n// ============================================================================\n\n/**\n * JAdES Protected Header parameters as per ETSI TS 119 182-1.\n */\nexport const ProtectedHeaderSchema = z\n  .object({\n    /** Signature algorithm (required for signing) */\n    alg: SignAlgSchema.optional(),\n\n    /** Content type */\n    cty: z.string().optional(),\n\n    /** Key ID - ETSI TS 119 182-1 Section 5.1.4 */\n    kid: z.string().optional(),\n\n    /** X.509 URL - ETSI TS 119 182-1 Section 5.1.5 */\n    x5u: z.string().url().optional(),\n\n    /** X.509 Certificate Chain - ETSI TS 119 182-1 Section 5.1.8 */\n    x5c: z.array(z.string().min(1)).min(1).optional(),\n\n    /** X.509 Certificate SHA-256 Thumbprint - ETSI TS 119 182-1 Section 5.1.7 */\n    'x5t#S256': z.string().min(1).optional(),\n\n    /** X.509 Certificate Thumbprint with Other Algorithm - ETSI TS 119 182-1 Section 5.2.2.2 */\n    'x5t#o': X5tOSchema.optional(),\n\n    /** X.509 Certificate Thumbprints for Chain - ETSI TS 119 182-1 Section 5.2.2.3 */\n    sigX5ts: z.array(X5tOSchema).min(2).optional(),\n\n    /** Signer's commitment reference - ETSI TS 119 182-1 Section 5.2.5 */\n    srCms: z.array(CommitmentReferenceSchema).optional(),\n\n    /** Signer's attributes reference */\n    srAts: z.array(z.object({}).passthrough()).optional(),\n\n    /** Signature policy - ETSI TS 119 182-1 Section 5.2.4 */\n    sigPl: SignaturePolicySchema.optional(),\n\n    /** Signer identifier */\n    sigPId: SignerIdentifierSchema.optional(),\n\n    /** Signing time - ETSI TS 119 182-1 Section 5.2.1 (ISO 8601) */\n    sigT: z.string().optional(),\n\n    /** Detached signature descriptor - ETSI TS 119 182-1 Section 5.2.8 */\n    sigD: SigDSchema.optional(),\n\n    /** Base64url encoding flag - RFC 7797 Section 3 */\n    b64: z.literal(false).optional(),\n\n    /** Critical headers */\n    crit: z.array(z.string()).optional(),\n\n    /** Issued at timestamp (Unix seconds) */\n    iat: z.number().int().positive().optional(),\n\n    /** Signed at timestamp (Unix seconds) */\n    signedAt: z.number().int().positive().optional(),\n\n    /** JWT ID */\n    jti: z.string().optional(),\n\n    /** Token type */\n    typ: z.string().optional(),\n\n    /** ADO timestamps */\n    adoTst: z.array(z.object({}).passthrough()).optional(),\n  })\n  .passthrough()\n\n/**\n * Protected header schema for signing (alg required).\n */\nexport const ProtectedHeaderForSigningSchema = ProtectedHeaderSchema.extend({\n  alg: SignAlgSchema,\n}).refine(\n  (header) => {\n    // At least one certificate header must be present\n    return !!(header['x5t#S256'] || header.x5c || header['x5t#o'] || header.sigX5ts)\n  },\n  {\n    message:\n      'JAdES signature requires at least one certificate header: x5t#S256, x5c, x5t#o, or sigX5ts',\n  }\n)\n\n// ============================================================================\n// Unprotected Header Schema\n// ============================================================================\n\n/**\n * JAdES Unprotected Header parameters.\n */\nexport const UnprotectedHeaderSchema = z\n  .object({\n    /** ETSI unsigned properties */\n    etsiU: EtsiUSchema.optional(),\n    /** Disclosures (for SD-JWT) */\n    disclosures: z.array(z.string()).optional(),\n    /** Key ID */\n    kid: z.string().optional(),\n    /** Key binding JWT */\n    kb_jwt: z.string().optional(),\n  })\n  .passthrough()\n\n// ============================================================================\n// JWS Serialization Schemas\n// ============================================================================\n\n/**\n * Signature entry in General JWS.\n */\nexport const JWSSignatureSchema = z.object({\n  /** Base64url-encoded protected header */\n  protected: z.string().min(1),\n  /** Base64url-encoded signature */\n  signature: z.string().min(1),\n  /** Unprotected header */\n  header: UnprotectedHeaderSchema.optional(),\n})\n\n/**\n * General JWS structure with multiple signatures.\n */\nexport const GeneralJWSSchema = z.object({\n  /** Base64url-encoded payload */\n  payload: z.string(),\n  /** Array of signature objects */\n  signatures: z.array(JWSSignatureSchema).min(1),\n})\n\n/**\n * Flattened JWS structure (single signature).\n */\nexport const FlattenedJWSSchema = z.object({\n  /** Base64url-encoded protected header */\n  protected: z.string().min(1),\n  /** Base64url-encoded payload */\n  payload: z.string(),\n  /** Base64url-encoded signature */\n  signature: z.string().min(1),\n  /** Unprotected header */\n  header: UnprotectedHeaderSchema.optional(),\n})\n\n/**\n * Compact JWS representation.\n */\nexport const CompactJWSSchema = z.object({\n  /** Base64url-encoded protected header */\n  protected: z.string().min(1),\n  /** Base64url-encoded payload */\n  payload: z.string(),\n  /** Base64url-encoded signature */\n  signature: z.string().min(1),\n})\n\n// ============================================================================\n// Sign/Verify Options Schemas\n// ============================================================================\n\n/**\n * Sign options for JAdES signing.\n */\nexport const SignOptionsSchema = z.object({\n  /** Signature algorithm */\n  alg: SignAlgSchema,\n  /** Key ID */\n  kid: z.string().optional(),\n  /** X.509 certificates (PEM or base64 DER) */\n  certificates: z.array(z.string()).optional(),\n})\n\n/**\n * Verify options for JAdES verification.\n */\nexport const VerifyOptionsSchema = z.object({\n  /** Whether to skip signature validation (decode only) */\n  skipSignatureValidation: z.boolean().optional(),\n})\n","/**\n * JAdES Utility Functions\n *\n * Helper functions for certificate handling and header generation.\n */\n\nimport { base64urlEncode, base64urlDecode } from '@owf/identity-common'\nimport { parseCertificate, parseCertificateChain, sha256 } from '@owf/crypto'\nimport { JAdESException } from './jades-exception'\nimport type { X5tO } from './types'\n\n/**\n * Parse PEM-encoded certificate chain and return base64 DER strings.\n *\n * @param pem - One or more PEM-encoded certificates\n * @returns Array of base64-encoded DER certificate strings\n */\nexport function parseCerts(pem: string): string[] {\n  return parseCertificateChain(pem)\n}\n\n/**\n * Generate x5c header value from PEM certificates.\n * The certificates are converted to base64-encoded DER format.\n *\n * ETSI TS 119 182-1 Section 5.1.8\n *\n * @param certs - PEM-encoded certificate(s) or array of base64 DER certs\n * @returns Array of base64-encoded DER certificate strings\n */\nexport function generateX5c(certs: string | string[]): string[] {\n  if (typeof certs === 'string') {\n    return parseCertificateChain(certs)\n  }\n  return certs\n}\n\n/**\n * Generate x5t#S256 header value (SHA-256 thumbprint of certificate).\n *\n * ETSI TS 119 182-1 Section 5.1.7\n *\n * @param certDer - Base64-encoded DER certificate\n * @returns Base64url-encoded SHA-256 thumbprint\n */\nexport async function generateX5tS256(certDer: string): Promise<string> {\n  const certBytes = base64ToUint8Array(certDer)\n  const hashBuffer = await globalThis.crypto.subtle.digest('SHA-256', certBytes)\n  return uint8ArrayToBase64Url(new Uint8Array(hashBuffer))\n}\n\n/**\n * Generate x5t#o header value (certificate thumbprint with specified algorithm).\n *\n * ETSI TS 119 182-1 Section 5.2.2.2\n *\n * @param certDer - Base64-encoded DER certificate\n * @param algorithm - Hash algorithm ('SHA-384' or 'SHA-512')\n * @returns X5tO object with algorithm identifier and digest value\n */\nexport async function generateX5tO(\n  certDer: string,\n  algorithm: 'SHA-384' | 'SHA-512' = 'SHA-512'\n): Promise<X5tO> {\n  const algMap = {\n    'SHA-384': 'S384',\n    'SHA-512': 'S512',\n  } as const\n\n  const certBytes = base64ToUint8Array(certDer)\n  const hashBuffer = await globalThis.crypto.subtle.digest(algorithm, certBytes)\n\n  return {\n    digAlg: algMap[algorithm],\n    digVal: uint8ArrayToBase64Url(new Uint8Array(hashBuffer)),\n  }\n}\n\n/**\n * Generate sigX5ts header value (certificate chain thumbprints).\n *\n * ETSI TS 119 182-1 Section 5.2.2.3\n *\n * @param certsDer - Array of base64-encoded DER certificates\n * @param algorithm - Hash algorithm ('SHA-384' or 'SHA-512')\n * @returns Array of X5tO objects\n */\nexport async function generateSigX5ts(\n  certsDer: string[],\n  algorithm: 'SHA-384' | 'SHA-512' = 'SHA-512'\n): Promise<X5tO[]> {\n  if (certsDer.length < 2) {\n    throw new JAdESException('sigX5ts requires at least 2 certificates')\n  }\n\n  return Promise.all(certsDer.map((cert) => generateX5tO(cert, algorithm)))\n}\n\n/**\n * Generate a JAdES-compliant kid from X.509 certificate.\n *\n * According to ETSI TS 119 182-1 Section 5.1.4, the kid should be\n * the base64 encoding of DER-encoded IssuerSerial sequence.\n *\n * This implementation generates a SHA-256 thumbprint of the certificate\n * as a simpler approach that uniquely identifies the certificate.\n *\n * @param certDer - Base64-encoded DER certificate\n * @returns Base64url-encoded key identifier\n */\nexport async function generateKid(certDer: string): Promise<string> {\n  // Use SHA-256 thumbprint as kid for simplicity\n  return generateX5tS256(certDer)\n}\n\n/**\n * Encode an object as a base64url JSON string.\n *\n * @param obj - Object to encode\n * @returns Base64url-encoded JSON string\n */\nexport function encodeJSON(obj: object): string {\n  return base64urlEncode(JSON.stringify(obj))\n}\n\n/**\n * Decode a base64url JSON string to an object.\n *\n * @param encoded - Base64url-encoded JSON string\n * @returns Decoded object\n */\nexport function decodeJSON<T = unknown>(encoded: string): T {\n  return JSON.parse(base64urlDecode(encoded)) as T\n}\n\n/**\n * Get current ISO 8601 timestamp for sigT header.\n *\n * @returns ISO 8601 timestamp string\n */\nexport function getSigningTime(): string {\n  return new Date().toISOString().replace(/\\.\\d{3}Z$/, 'Z')\n}\n\n/**\n * Validate that the protected header has at least one certificate header.\n * As per ETSI TS 119 182-1 Section 5.1.7, a JAdES signature shall have\n * at least one of: x5t#S256, x5c, x5t#o, sigX5ts.\n *\n * @param header - Protected header object\n * @returns true if valid\n * @throws JAdESException if no certificate header is present\n */\nexport function validateCertificateHeaders(header: Record<string, unknown>): boolean {\n  const hasCertHeader = !!(header['x5t#S256'] || header.x5c || header['x5t#o'] || header.sigX5ts)\n\n  if (!hasCertHeader) {\n    throw new JAdESException(\n      'JAdES signature requires at least one certificate header: x5t#S256, x5c, x5t#o, or sigX5ts'\n    )\n  }\n\n  return true\n}\n\n// Helper functions for base64/base64url conversion\n\nfunction base64ToUint8Array(base64: string): Uint8Array {\n  // Handle both standard base64 and base64url\n  const normalized = base64.replace(/-/g, '+').replace(/_/g, '/')\n  const padded = normalized.padEnd(normalized.length + ((4 - (normalized.length % 4)) % 4), '=')\n  const binaryString = atob(padded)\n  const bytes = new Uint8Array(binaryString.length)\n  for (let i = 0; i < binaryString.length; i++) {\n    bytes[i] = binaryString.charCodeAt(i)\n  }\n  return bytes\n}\n\nfunction uint8ArrayToBase64Url(bytes: Uint8Array): string {\n  let binary = ''\n  for (let i = 0; i < bytes.length; i++) {\n    binary += String.fromCharCode(bytes[i])\n  }\n  return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=/g, '')\n}\n","/**\n * JAdES Token\n *\n * Main class for creating JAdES-compliant signatures.\n * Implements ETSI TS 119 182-1 standard for JSON Advanced Electronic Signatures.\n *\n * @example\n * ```typescript\n * import { Token, parseCerts, generateX5c } from '@owf/eudi-jades'\n * import { ES256 } from '@owf/crypto'\n *\n * const payload = { hello: 'world' }\n * const token = new Token(payload)\n *\n * const certs = parseCerts(pemCertificate)\n * token.setProtectedHeader({\n *   alg: 'ES256',\n *   x5c: generateX5c(certs),\n * })\n *\n * const signer = await ES256.getSigner(privateKey)\n * await token.sign(signer)\n *\n * const compactJws = token.toString()\n * const generalJws = token.toJSON()\n * ```\n */\n\nimport { base64urlEncode } from '@owf/identity-common'\nimport { CRITICAL_PARAMETERS, DETACHED_MECHANISM_IDS } from './constants'\nimport { JAdESException } from './jades-exception'\nimport {\n  ProtectedHeaderForSigningSchema,\n  ProtectedHeaderSchema,\n  SignAlgSchema,  \n} from './schemas'\nimport type {\n  GeneralJWS,\n  ProtectedHeaderParams,\n  SigD,\n  UnprotectedHeaderParams,\n  X5tO,\n} from './types'\nimport { encodeJSON } from './utils'\n\n/**\n * JAdES Token class for creating conformant JAdES signatures.\n */\nexport class Token<T extends Record<string, unknown> = Record<string, unknown>> {\n  private protectedHeader: ProtectedHeaderParams = {}\n  private unprotectedHeader: UnprotectedHeaderParams = {}\n  private readonly payload: T | undefined\n  private encodedPayload: string\n  private signature: string | undefined\n\n  /**\n   * Create a new JAdES Token.\n   *\n   * @param payload - The payload to sign. If undefined, creates a detached signature.\n   */\n  constructor(payload?: T) {\n    this.payload = payload\n    this.encodedPayload =\n      payload === undefined ? '' : base64urlEncode(JSON.stringify(payload))\n  }\n\n  /**\n   * Set the protected header parameters.\n   *\n   * @param header - Protected header parameters\n   * @returns this for method chaining\n   */\n  setProtectedHeader(header: ProtectedHeaderParams): this {\n    // Validate algorithm if provided\n    if (header.alg) {\n      const algResult = SignAlgSchema.safeParse(header.alg)\n      if (!algResult.success) {\n        throw new JAdESException(`Invalid algorithm: ${header.alg}`)\n      }\n    }\n\n    // Validate header structure\n    const result = ProtectedHeaderSchema.safeParse(header)\n    if (!result.success) {\n      const errors = result.error.issues.map((e) => e.message).join(', ')\n      throw new JAdESException(`Invalid protected header: ${errors}`)\n    }\n\n    this.protectedHeader = { ...this.protectedHeader, ...header }\n    return this\n  }\n\n  /**\n   * Set the unprotected header parameters.\n   *\n   * @param header - Unprotected header parameters\n   * @returns this for method chaining\n   */\n  setUnprotectedHeader(header: UnprotectedHeaderParams): this {\n    this.unprotectedHeader = { ...this.unprotectedHeader, ...header }\n    return this\n  }\n\n  /**\n   * Set X.509 certificate chain (x5c header).\n   *\n   * ETSI TS 119 182-1 Section 5.1.8\n   *\n   * @param certs - Array of base64-encoded DER certificates\n   * @returns this for method chaining\n   */\n  setX5c(certs: string[]): this {\n    this.protectedHeader.x5c = certs\n    return this\n  }\n\n  /**\n   * Set X.509 certificate URL (x5u header).\n   *\n   * ETSI TS 119 182-1 Section 5.1.5\n   *\n   * @param uri - URI to certificate resource\n   * @returns this for method chaining\n   */\n  setX5u(uri: string): this {\n    this.protectedHeader.x5u = uri\n    return this\n  }\n\n  /**\n   * Set X.509 certificate SHA-256 thumbprint (x5t#S256 header).\n   *\n   * ETSI TS 119 182-1 Section 5.1.7\n   *\n   * @param thumbprint - Base64url-encoded SHA-256 thumbprint\n   * @returns this for method chaining\n   */\n  setX5tS256(thumbprint: string): this {\n    this.protectedHeader['x5t#S256'] = thumbprint\n    return this\n  }\n\n  /**\n   * Set X.509 certificate thumbprint with other algorithm (x5t#o header).\n   *\n   * ETSI TS 119 182-1 Section 5.2.2.2\n   *\n   * @param x5tO - X5tO object with algorithm and digest value\n   * @returns this for method chaining\n   */\n  setX5tO(x5tO: X5tO): this {\n    this.protectedHeader['x5t#o'] = x5tO\n    return this\n  }\n\n  /**\n   * Set signing time (sigT header).\n   *\n   * ETSI TS 119 182-1 Section 5.2.1\n   *\n   * @param time - ISO 8601 timestamp (defaults to current time)\n   * @returns this for method chaining\n   */\n  setSigningTime(time?: string): this {\n    this.protectedHeader.sigT = time ?? new Date().toISOString().replace(/\\.\\d{3}Z$/, 'Z')\n    return this\n  }\n\n  /**\n   * Set signedAt timestamp in protected header.\n   *\n   * @param sec - Unix timestamp in seconds (defaults to current time)\n   * @returns this for method chaining\n   */\n  setSignedAt(sec?: number): this {\n    this.protectedHeader.signedAt = sec ?? Math.floor(Date.now() / 1000)\n    return this\n  }\n\n  /**\n   * Set issued at timestamp (iat) in protected header.\n   *\n   * @param sec - Unix timestamp in seconds (defaults to current time)\n   * @returns this for method chaining\n   */\n  setIssuedAt(sec?: number): this {\n    this.protectedHeader.iat = sec ?? Math.floor(Date.now() / 1000)\n    return this\n  }\n\n  /**\n   * Set key ID (kid header).\n   *\n   * @param kid - Key identifier\n   * @returns this for method chaining\n   */\n  setKid(kid: string): this {\n    this.protectedHeader.kid = kid\n    return this\n  }\n\n  /**\n   * Set content type (cty header).\n   *\n   * @param cty - Content type\n   * @returns this for method chaining\n   */\n  setContentType(cty: string): this {\n    this.protectedHeader.cty = cty\n    return this\n  }\n\n  /**\n   * Set token type (typ header).\n   *\n   * @param typ - Token type\n   * @returns this for method chaining\n   */\n  setType(typ: string): this {\n    this.protectedHeader.typ = typ\n    return this\n  }\n\n  /**\n   * Set b64 header parameter.\n   *\n   * ETSI TS 119 182-1 Section 5.1.10\n   * RFC 7797 Section 3\n   *\n   * @param b64 - If true (default), payload is base64url encoded. If false, payload is unencoded.\n   * @returns this for method chaining\n   */\n  setB64(b64: boolean): this {\n    if (b64) {\n      delete this.protectedHeader.b64\n    } else {\n      this.protectedHeader.b64 = false\n    }\n    return this\n  }\n\n  /**\n   * Configure detached signature mode.\n   *\n   * ETSI TS 119 182-1 Section 5.2.8\n   *\n   * @param sigD - Detached signature descriptor\n   * @returns this for method chaining\n   */\n  setDetached(sigD: SigD): this {\n    this.protectedHeader.sigD = sigD\n    this.encodedPayload = ''\n\n    // If using HttpHeaders mechanism, b64 must be false\n    if (sigD.mId === DETACHED_MECHANISM_IDS.httpHeaders) {\n      this.setB64(false)\n    }\n\n    return this\n  }\n\n  /**\n   * Get the signing input (data to be signed).\n   *\n   * @returns The signing input string (header.payload)\n   */\n  getSigningInput(): string {\n    const encodedHeader = this.getEncodedProtectedHeader()\n    return `${encodedHeader}.${this.encodedPayload}`\n  }\n\n  /**\n   * Get the hash of the signing input for external signing.\n   *\n   * @param algorithm - Hash algorithm (defaults to algorithm from header)\n   * @returns Promise resolving to hash bytes\n   */\n  async getHash(algorithm?: string): Promise<Uint8Array> {\n    const alg = algorithm ?? this.getHashAlgorithm()\n    const signingInput = this.getSigningInput()\n    const encoder = new TextEncoder()\n    const hashBuffer = await globalThis.crypto.subtle.digest(alg, encoder.encode(signingInput))\n    return new Uint8Array(hashBuffer)\n  }\n\n  /**\n   * Set the signature (for external signing).\n   *\n   * @param signature - Base64url-encoded signature\n   * @returns this for method chaining\n   */\n  setSignature(signature: string): this {\n    this.signature = signature\n    return this\n  }\n\n  /**\n   * Sign the token using the provided signer function.\n   *\n   * @param signer - Async function that signs data and returns base64url signature\n   * @returns Promise resolving to this for method chaining\n   */\n  async sign(signer: (data: string) => Promise<string>): Promise<this> {\n    this.validateBeforeSign()\n    const signingInput = this.getSigningInput()\n    this.signature = await signer(signingInput)\n    return this\n  }\n\n  /**\n   * Export to compact JWS serialization.\n   *\n   * @returns Compact JWS string (header.payload.signature)\n   */\n  toString(): string {\n    if (!this.signature) {\n      throw new JAdESException('Token not signed yet')\n    }\n    return `${this.getEncodedProtectedHeader()}.${this.encodedPayload}.${this.signature}`\n  }\n\n  /**\n   * Export to General JWS JSON serialization.\n   *\n   * @returns GeneralJWS object\n   */\n  toJSON(): GeneralJWS {\n    if (!this.signature) {\n      throw new JAdESException('Token not signed yet')\n    }\n\n    const result: GeneralJWS = {\n      payload: this.encodedPayload,\n      signatures: [\n        {\n          protected: this.getEncodedProtectedHeader(),\n          signature: this.signature,\n        },\n      ],\n    }\n\n    // Add unprotected header if present\n    if (Object.keys(this.unprotectedHeader).length > 0) {\n      result.signatures[0].header = this.unprotectedHeader\n    }\n\n    return result\n  }\n\n  /**\n   * Export to flattened JWS JSON serialization.\n   *\n   * @returns Flattened JWS object\n   */\n  toFlattenedJSON(): {\n    protected: string\n    payload: string\n    signature: string\n    header?: UnprotectedHeaderParams\n  } {\n    if (!this.signature) {\n      throw new JAdESException('Token not signed yet')\n    }\n\n    const result: {\n      protected: string\n      payload: string\n      signature: string\n      header?: UnprotectedHeaderParams\n    } = {\n      protected: this.getEncodedProtectedHeader(),\n      payload: this.encodedPayload,\n      signature: this.signature,\n    }\n\n    if (Object.keys(this.unprotectedHeader).length > 0) {\n      result.header = this.unprotectedHeader\n    }\n\n    return result\n  }\n\n  /**\n   * Get the protected header object.\n   */\n  getProtectedHeader(): ProtectedHeaderParams {\n    return { ...this.protectedHeader }\n  }\n\n  /**\n   * Get the unprotected header object.\n   */\n  getUnprotectedHeader(): UnprotectedHeaderParams {\n    return { ...this.unprotectedHeader }\n  }\n\n  /**\n   * Get the payload.\n   */\n  getPayload(): T | undefined {\n    return this.payload\n  }\n\n  // Private methods\n\n  private getEncodedProtectedHeader(): string {\n    const header = this.buildFinalHeader()\n    return encodeJSON(header)\n  }\n\n  private buildFinalHeader(): ProtectedHeaderParams {\n    const header = { ...this.protectedHeader }\n\n    // Add critical parameters\n    const critParams = CRITICAL_PARAMETERS.filter((param) => param in header)\n    if (critParams.length > 0) {\n      header.crit = critParams\n    }\n\n    return header\n  }\n\n  private validateBeforeSign(): void {\n    // Validate complete header for signing (alg required + certificate headers)\n    const result = ProtectedHeaderForSigningSchema.safeParse(this.protectedHeader)\n    if (!result.success) {\n      const errors = result.error.issues.map((e) => e.message).join(', ')\n      throw new JAdESException(`Invalid protected header for signing: ${errors}`)\n    }\n  }\n\n  private getHashAlgorithm(): string {\n    const algMap: Record<string, string> = {\n      RS256: 'SHA-256',\n      RS384: 'SHA-384',\n      RS512: 'SHA-512',\n      PS256: 'SHA-256',\n      PS384: 'SHA-384',\n      PS512: 'SHA-512',\n      ES256: 'SHA-256',\n      ES384: 'SHA-384',\n      ES512: 'SHA-512',\n    }\n\n    const alg = this.protectedHeader.alg\n    if (!alg || !algMap[alg as string]) {\n      throw new JAdESException(`Unsupported algorithm: ${alg as string}`)\n    }\n\n    return algMap[alg as string]\n  }\n}\n","/**\n * JAdES Verifier\n *\n * Functions for verifying JAdES signatures.\n */\n\nimport { base64urlDecode } from '@owf/identity-common'\nimport { JAdESException } from './jades-exception'\nimport { GeneralJWSSchema, ProtectedHeaderSchema } from './schemas'\nimport type { GeneralJWS, ProtectedHeaderParams, UnprotectedHeaderParams } from './types'\n\n/**\n * Result of JAdES signature verification.\n */\nexport interface VerifyResult<T = unknown> {\n  /** Decoded protected header */\n  header: ProtectedHeaderParams\n  /** Decoded payload */\n  payload: T\n  /** Unprotected header (if present) */\n  unprotectedHeader?: UnprotectedHeaderParams\n  /** Whether the signature is valid */\n  valid: boolean\n}\n\n/**\n * Verify a JAdES signature in compact serialization.\n *\n * @param jws - Compact JWS string\n * @param verifier - Async function that verifies signature\n * @returns Promise resolving to verification result\n */\nexport async function verifyCompact<T = unknown>(\n  jws: string,\n  verifier: (data: string, signature: string) => Promise<boolean>\n): Promise<VerifyResult<T>> {\n  const parts = jws.split('.')\n\n  if (parts.length !== 3) {\n    throw new JAdESException('Invalid JWS format: expected 3 parts')\n  }\n\n  const [encodedHeader, encodedPayload, signature] = parts\n  const signingInput = `${encodedHeader}.${encodedPayload}`\n\n  const valid = await verifier(signingInput, signature)\n\n  if (!valid) {\n    throw new JAdESException('Invalid signature')\n  }\n\n  // Parse and validate header with Zod\n  const rawHeader = JSON.parse(base64urlDecode(encodedHeader))\n  const headerResult = ProtectedHeaderSchema.safeParse(rawHeader)\n  if (!headerResult.success) {\n    const errors = headerResult.error.issues.map((e) => e.message).join(', ')\n    throw new JAdESException(`Invalid protected header: ${errors}`)\n  }\n  const header = headerResult.data as ProtectedHeaderParams\n\n  const payload = encodedPayload ? (JSON.parse(base64urlDecode(encodedPayload)) as T) : ({} as T)\n\n  return {\n    header,\n    payload,\n    valid,\n  }\n}\n\n/**\n * Verify a JAdES signature in General JWS JSON serialization.\n *\n * @param generalJws - General JWS object\n * @param verifier - Async function that verifies signature\n * @param signatureIndex - Index of signature to verify (default: 0)\n * @returns Promise resolving to verification result\n */\nexport async function verifyGeneral<T = unknown>(\n  generalJws: GeneralJWS,\n  verifier: (data: string, signature: string) => Promise<boolean>,\n  signatureIndex = 0\n): Promise<VerifyResult<T>> {\n  // Validate General JWS structure with Zod\n  const jwsResult = GeneralJWSSchema.safeParse(generalJws)\n  if (!jwsResult.success) {\n    const errors = jwsResult.error.issues.map((e) => e.message).join(', ')\n    throw new JAdESException(`Invalid General JWS structure: ${errors}`)\n  }\n\n  const sig = generalJws.signatures[signatureIndex]\n\n  if (!sig) {\n    throw new JAdESException(`Signature at index ${signatureIndex} not found`)\n  }\n\n  const signingInput = `${sig.protected}.${generalJws.payload}`\n  const valid = await verifier(signingInput, sig.signature)\n\n  if (!valid) {\n    throw new JAdESException('Invalid signature')\n  }\n\n  // Parse and validate header with Zod\n  const rawHeader = JSON.parse(base64urlDecode(sig.protected))\n  const headerResult = ProtectedHeaderSchema.safeParse(rawHeader)\n  if (!headerResult.success) {\n    const errors = headerResult.error.issues.map((e) => e.message).join(', ')\n    throw new JAdESException(`Invalid protected header: ${errors}`)\n  }\n  const header = headerResult.data as ProtectedHeaderParams\n\n  const payload = generalJws.payload\n    ? (JSON.parse(base64urlDecode(generalJws.payload)) as T)\n    : ({} as T)\n\n  return {\n    header,\n    payload,\n    unprotectedHeader: sig.header,\n    valid,\n  }\n}\n\n/**\n * Verify a JAdES signature (auto-detects format).\n *\n * @param jws - JWS string or GeneralJWS object\n * @param verifier - Async function that verifies signature\n * @returns Promise resolving to verification result\n */\nexport async function verify<T = unknown>(\n  jws: string | GeneralJWS,\n  verifier: (data: string, signature: string) => Promise<boolean>\n): Promise<VerifyResult<T>> {\n  if (typeof jws === 'string') {\n    // Try to parse as JSON first (General JWS)\n    try {\n      const parsed = JSON.parse(jws) as GeneralJWS\n      if (parsed.signatures && Array.isArray(parsed.signatures)) {\n        return verifyGeneral<T>(parsed, verifier)\n      }\n    } catch {\n      // Not JSON, treat as compact\n    }\n    return verifyCompact<T>(jws, verifier)\n  }\n\n  return verifyGeneral<T>(jws, verifier)\n}\n\n/**\n * Decode a JWS without verifying the signature.\n * Use this only for inspection - always verify before trusting the content.\n *\n * @param jws - JWS string or GeneralJWS object\n * @returns Decoded header and payload\n */\nexport function decode<T = unknown>(jws: string | GeneralJWS): {\n  header: ProtectedHeaderParams\n  payload: T\n  unprotectedHeader?: UnprotectedHeaderParams\n} {\n  if (typeof jws === 'string') {\n    // Try JSON first\n    try {\n      const parsed = JSON.parse(jws) as GeneralJWS\n      if (parsed.signatures && Array.isArray(parsed.signatures)) {\n        const sig = parsed.signatures[0]\n        return {\n          header: JSON.parse(base64urlDecode(sig.protected)) as ProtectedHeaderParams,\n          payload: parsed.payload\n            ? (JSON.parse(base64urlDecode(parsed.payload)) as T)\n            : ({} as T),\n          unprotectedHeader: sig.header,\n        }\n      }\n    } catch {\n      // Compact format\n    }\n\n    const parts = jws.split('.')\n    if (parts.length !== 3) {\n      throw new JAdESException('Invalid JWS format')\n    }\n\n    return {\n      header: JSON.parse(base64urlDecode(parts[0])) as ProtectedHeaderParams,\n      payload: parts[1] ? (JSON.parse(base64urlDecode(parts[1])) as T) : ({} as T),\n    }\n  }\n\n  const sig = jws.signatures[0]\n  return {\n    header: JSON.parse(base64urlDecode(sig.protected)) as ProtectedHeaderParams,\n    payload: jws.payload ? (JSON.parse(base64urlDecode(jws.payload)) as T) : ({} as T),\n    unprotectedHeader: sig.header,\n  }\n}\n"],"mappings":";;;;;;;;;;;;AASA,MAAa,aAAa;CAExB,OAAO;EAAE,MAAM;EAAW,QAAQ;EAAO;CACzC,OAAO;EAAE,MAAM;EAAW,QAAQ;EAAO;CACzC,OAAO;EAAE,MAAM;EAAW,QAAQ;EAAO;CAGzC,OAAO;EAAE,MAAM;EAAW,QAAQ;EAAW;CAC7C,OAAO;EAAE,MAAM;EAAW,QAAQ;EAAW;CAC7C,OAAO;EAAE,MAAM;EAAW,QAAQ;EAAW;CAG7C,OAAO;EAAE,MAAM;EAAW,QAAQ;EAAS,YAAY;EAAS;CAChE,OAAO;EAAE,MAAM;EAAW,QAAQ;EAAS,YAAY;EAAS;CAChE,OAAO;EAAE,MAAM;EAAW,QAAQ;EAAS,YAAY;EAAS;CACjE;;;;AAKD,IAAY,iBAAL,yBAAA,gBAAA;;AAEL,gBAAA,mBAAA;;AAEA,gBAAA,oBAAA;;AAEA,gBAAA,qBAAA;;AAEA,gBAAA,mBAAA;;AAEA,gBAAA,qBAAA;;AAEA,gBAAA,qBAAA;;KACD;;;;AAKD,IAAY,eAAL,yBAAA,cAAA;;AAEL,cAAA,SAAA;;AAEA,cAAA,SAAA;;AAEA,cAAA,UAAA;;AAEA,cAAA,WAAA;;KACD;;;;AAKD,MAAa,yBAAyB;CAEpC,aAAa;CAEb,cAAc;CACf;;;;;AAMD,MAAa,sBAAsB;CACjC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD;;;;;;;;AC7ED,IAAa,iBAAb,MAAa,uBAAuB,MAAM;CACxC,YAAY,SAAiB;AAC3B,QAAM,QAAQ;AACd,OAAK,OAAO;AACZ,SAAO,eAAe,MAAM,eAAe,UAAU;;;;;;;;;;;;;;;;ACSzD,MAAa,gBAAgB,EAAE,KAAK;CAClC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD,CAAC;;;;;AAUF,MAAa,aAAa,EAAE,OAAO;CAEjC,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE;CAEzB,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC1B,CAAC;;;;AASF,MAAa,4BAA4B,EAAE,OAAO;CAEhD,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE;CAEzB,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,UAAU;CAC1D,CAAC;;;;AASF,MAAa,4BAA4B,EAAE,OAAO;CAChD,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC3B,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC3B,CAAC;;;;;AAMF,MAAa,wBAAwB,EAAE,OAAO;CAE5C,aAAa,EAAE,QAAQ,CAAC,UAAU;CAElC,eAAe,0BAA0B,UAAU;CAEnD,qBAAqB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,UAAU;CACpE,CAAC;;;;AASF,MAAa,qBAAqB,EAAE,OAAO;CACzC,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE;CACzB,cAAc,EAAE,QAAQ,CAAC,IAAI,EAAE;CAChC,CAAC;;;;;AAMF,MAAa,yBAAyB,EAAE,OAAO;CAE7C,cAAc,mBAAmB,UAAU;CAE3C,sBAAsB,EAAE,QAAQ,CAAC,UAAU;CAC5C,CAAC;;;;;AAUF,MAAa,aAAa,EAAE,OAAO;CAEjC,KAAK,EAAE,QAAQ,CAAC,IAAI,EAAE;CAEtB,MAAM,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC;CAEvC,OAAO,EAAE,QAAQ,CAAC,UAAU;CAE5B,KAAK,EAAE,QAAQ,CAAC,UAAU;CAC3B,CAAC;;;;AASF,MAAa,sBAAsB,EAAE,OAAO,EAC1C,KAAK,EAAE,QAAQ,CAAC,IAAI,EAAE,EACvB,CAAC;;;;AAKF,MAAa,kBAAkB,EAAE,OAAO,EACtC,WAAW,EAAE,MAAM,oBAAoB,CAAC,IAAI,EAAE,EAC/C,CAAC;;;;AAKF,MAAa,eAAe,EAAE,OAAO,EACnC,QAAQ,iBACT,CAAC;;;;AAKF,MAAa,cAAc,EAAE,OAAO,EAClC,OAAO,EAAE,MACP,EAAE,OAAO,EACP,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,EAC5B,CAAC,CACH,EACF,CAAC;;;;AAKF,MAAa,cAAc,EAAE,OAAO,EAClC,OAAO,EAAE,OAAO;CACd,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC;CAC5B,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC;CAC9B,CAAC,EACH,CAAC;;;;AAKF,MAAa,eAAe,EAAE,OAAO,EACnC,QAAQ,gBAAgB,OAAO,EAC7B,UAAU,EAAE,QAAQ,CAAC,UAAU,EAChC,CAAC,EACH,CAAC;;;;AAKF,MAAa,cAAc,EAAE,MAAM;CAEjC,EAAE,MAAM,aAAa;CAErB,EAAE,MAAM;EAAC;EAAc;EAAa;EAAY,CAAC;CAEjD,EAAE,MAAM;EAAC;EAAc;EAAa;EAAa;EAAa,CAAC;CAChE,CAAC;;;;AASF,MAAa,wBAAwB,EAClC,OAAO;CAEN,KAAK,cAAc,UAAU;CAG7B,KAAK,EAAE,QAAQ,CAAC,UAAU;CAG1B,KAAK,EAAE,QAAQ,CAAC,UAAU;CAG1B,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU;CAGhC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU;CAGjD,YAAY,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;CAGxC,SAAS,WAAW,UAAU;CAG9B,SAAS,EAAE,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC,UAAU;CAG9C,OAAO,EAAE,MAAM,0BAA0B,CAAC,UAAU;CAGpD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,UAAU;CAGrD,OAAO,sBAAsB,UAAU;CAGvC,QAAQ,uBAAuB,UAAU;CAGzC,MAAM,EAAE,QAAQ,CAAC,UAAU;CAG3B,MAAM,WAAW,UAAU;CAG3B,KAAK,EAAE,QAAQ,MAAM,CAAC,UAAU;CAGhC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CAGpC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU;CAG3C,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU;CAGhD,KAAK,EAAE,QAAQ,CAAC,UAAU;CAG1B,KAAK,EAAE,QAAQ,CAAC,UAAU;CAG1B,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,UAAU;CACvD,CAAC,CACD,aAAa;;;;AAKhB,MAAa,kCAAkC,sBAAsB,OAAO,EAC1E,KAAK,eACN,CAAC,CAAC,QACA,WAAW;AAEV,QAAO,CAAC,EAAE,OAAO,eAAe,OAAO,OAAO,OAAO,YAAY,OAAO;GAE1E,EACE,SACE,8FACH,CACF;;;;AASD,MAAa,0BAA0B,EACpC,OAAO;CAEN,OAAO,YAAY,UAAU;CAE7B,aAAa,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CAE3C,KAAK,EAAE,QAAQ,CAAC,UAAU;CAE1B,QAAQ,EAAE,QAAQ,CAAC,UAAU;CAC9B,CAAC,CACD,aAAa;;;;AAShB,MAAa,qBAAqB,EAAE,OAAO;CAEzC,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE;CAE5B,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE;CAE5B,QAAQ,wBAAwB,UAAU;CAC3C,CAAC;;;;AAKF,MAAa,mBAAmB,EAAE,OAAO;CAEvC,SAAS,EAAE,QAAQ;CAEnB,YAAY,EAAE,MAAM,mBAAmB,CAAC,IAAI,EAAE;CAC/C,CAAC;;;;AAKF,MAAa,qBAAqB,EAAE,OAAO;CAEzC,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE;CAE5B,SAAS,EAAE,QAAQ;CAEnB,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE;CAE5B,QAAQ,wBAAwB,UAAU;CAC3C,CAAC;;;;AAKF,MAAa,mBAAmB,EAAE,OAAO;CAEvC,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE;CAE5B,SAAS,EAAE,QAAQ;CAEnB,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC7B,CAAC;;;;AASF,MAAa,oBAAoB,EAAE,OAAO;CAExC,KAAK;CAEL,KAAK,EAAE,QAAQ,CAAC,UAAU;CAE1B,cAAc,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CAC7C,CAAC;AAKiC,EAAE,OAAO,EAE1C,yBAAyB,EAAE,SAAS,CAAC,UAAU,EAChD,CAAC;;;;;;;;;;;;;;ACzWF,SAAgB,WAAW,KAAuB;AAChD,QAAO,sBAAsB,IAAI;;;;;;;;;;;AAYnC,SAAgB,YAAY,OAAoC;AAC9D,KAAI,OAAO,UAAU,SACnB,QAAO,sBAAsB,MAAM;AAErC,QAAO;;;;;;;;;;AAWT,eAAsB,gBAAgB,SAAkC;CACtE,MAAM,YAAY,mBAAmB,QAAQ;CAC7C,MAAM,aAAa,MAAM,WAAW,OAAO,OAAO,OAAO,WAAW,UAAU;AAC9E,QAAO,sBAAsB,IAAI,WAAW,WAAW,CAAC;;;;;;;;;;;AAY1D,eAAsB,aACpB,SACA,YAAmC,WACpB;CACf,MAAM,SAAS;EACb,WAAW;EACX,WAAW;EACZ;CAED,MAAM,YAAY,mBAAmB,QAAQ;CAC7C,MAAM,aAAa,MAAM,WAAW,OAAO,OAAO,OAAO,WAAW,UAAU;AAE9E,QAAO;EACL,QAAQ,OAAO;EACf,QAAQ,sBAAsB,IAAI,WAAW,WAAW,CAAC;EAC1D;;;;;;;;;;;AAYH,eAAsB,gBACpB,UACA,YAAmC,WAClB;AACjB,KAAI,SAAS,SAAS,EACpB,OAAM,IAAI,eAAe,2CAA2C;AAGtE,QAAO,QAAQ,IAAI,SAAS,KAAK,SAAS,aAAa,MAAM,UAAU,CAAC,CAAC;;;;;;;;;;;;;;AAe3E,eAAsB,YAAY,SAAkC;AAElE,QAAO,gBAAgB,QAAQ;;;;;;;;AASjC,SAAgB,WAAW,KAAqB;AAC9C,QAAO,gBAAgB,KAAK,UAAU,IAAI,CAAC;;;;;;;;AAS7C,SAAgB,WAAwB,SAAoB;AAC1D,QAAO,KAAK,MAAM,gBAAgB,QAAQ,CAAC;;;;;;;AAQ7C,SAAgB,iBAAyB;AACvC,yBAAO,IAAI,MAAM,EAAC,aAAa,CAAC,QAAQ,aAAa,IAAI;;;;;;;;;;;AAY3D,SAAgB,2BAA2B,QAA0C;AAGnF,KAAI,CAFkB,CAAC,EAAE,OAAO,eAAe,OAAO,OAAO,OAAO,YAAY,OAAO,SAGrF,OAAM,IAAI,eACR,6FACD;AAGH,QAAO;;AAKT,SAAS,mBAAmB,QAA4B;CAEtD,MAAM,aAAa,OAAO,QAAQ,MAAM,IAAI,CAAC,QAAQ,MAAM,IAAI;CAC/D,MAAM,SAAS,WAAW,OAAO,WAAW,UAAW,IAAK,WAAW,SAAS,KAAM,GAAI,IAAI;CAC9F,MAAM,eAAe,KAAK,OAAO;CACjC,MAAM,QAAQ,IAAI,WAAW,aAAa,OAAO;AACjD,MAAK,IAAI,IAAI,GAAG,IAAI,aAAa,QAAQ,IACvC,OAAM,KAAK,aAAa,WAAW,EAAE;AAEvC,QAAO;;AAGT,SAAS,sBAAsB,OAA2B;CACxD,IAAI,SAAS;AACb,MAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,IAChC,WAAU,OAAO,aAAa,MAAM,GAAG;AAEzC,QAAO,KAAK,OAAO,CAAC,QAAQ,OAAO,IAAI,CAAC,QAAQ,OAAO,IAAI,CAAC,QAAQ,MAAM,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACxI/E,IAAa,QAAb,MAAgF;;;;;;CAY9E,YAAY,SAAa;yBAXwB,EAAE;2BACE,EAAE;AAWrD,OAAK,UAAU;AACf,OAAK,iBACH,YAAY,KAAA,IAAY,KAAK,gBAAgB,KAAK,UAAU,QAAQ,CAAC;;;;;;;;CASzE,mBAAmB,QAAqC;AAEtD,MAAI,OAAO;OAEL,CADc,cAAc,UAAU,OAAO,IAAI,CACtC,QACb,OAAM,IAAI,eAAe,sBAAsB,OAAO,MAAM;;EAKhE,MAAM,SAAS,sBAAsB,UAAU,OAAO;AACtD,MAAI,CAAC,OAAO,QAEV,OAAM,IAAI,eAAe,6BADV,OAAO,MAAM,OAAO,KAAK,MAAM,EAAE,QAAQ,CAAC,KAAK,KAAK,GACJ;AAGjE,OAAK,kBAAkB;GAAE,GAAG,KAAK;GAAiB,GAAG;GAAQ;AAC7D,SAAO;;;;;;;;CAST,qBAAqB,QAAuC;AAC1D,OAAK,oBAAoB;GAAE,GAAG,KAAK;GAAmB,GAAG;GAAQ;AACjE,SAAO;;;;;;;;;;CAWT,OAAO,OAAuB;AAC5B,OAAK,gBAAgB,MAAM;AAC3B,SAAO;;;;;;;;;;CAWT,OAAO,KAAmB;AACxB,OAAK,gBAAgB,MAAM;AAC3B,SAAO;;;;;;;;;;CAWT,WAAW,YAA0B;AACnC,OAAK,gBAAgB,cAAc;AACnC,SAAO;;;;;;;;;;CAWT,QAAQ,MAAkB;AACxB,OAAK,gBAAgB,WAAW;AAChC,SAAO;;;;;;;;;;CAWT,eAAe,MAAqB;AAClC,OAAK,gBAAgB,OAAO,yBAAQ,IAAI,MAAM,EAAC,aAAa,CAAC,QAAQ,aAAa,IAAI;AACtF,SAAO;;;;;;;;CAST,YAAY,KAAoB;AAC9B,OAAK,gBAAgB,WAAW,OAAO,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;AACpE,SAAO;;;;;;;;CAST,YAAY,KAAoB;AAC9B,OAAK,gBAAgB,MAAM,OAAO,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;AAC/D,SAAO;;;;;;;;CAST,OAAO,KAAmB;AACxB,OAAK,gBAAgB,MAAM;AAC3B,SAAO;;;;;;;;CAST,eAAe,KAAmB;AAChC,OAAK,gBAAgB,MAAM;AAC3B,SAAO;;;;;;;;CAST,QAAQ,KAAmB;AACzB,OAAK,gBAAgB,MAAM;AAC3B,SAAO;;;;;;;;;;;CAYT,OAAO,KAAoB;AACzB,MAAI,IACF,QAAO,KAAK,gBAAgB;MAE5B,MAAK,gBAAgB,MAAM;AAE7B,SAAO;;;;;;;;;;CAWT,YAAY,MAAkB;AAC5B,OAAK,gBAAgB,OAAO;AAC5B,OAAK,iBAAiB;AAGtB,MAAI,KAAK,QAAQ,uBAAuB,YACtC,MAAK,OAAO,MAAM;AAGpB,SAAO;;;;;;;CAQT,kBAA0B;AAExB,SAAO,GADe,KAAK,2BAA2B,CAC9B,GAAG,KAAK;;;;;;;;CASlC,MAAM,QAAQ,WAAyC;EACrD,MAAM,MAAM,aAAa,KAAK,kBAAkB;EAChD,MAAM,eAAe,KAAK,iBAAiB;EAC3C,MAAM,UAAU,IAAI,aAAa;EACjC,MAAM,aAAa,MAAM,WAAW,OAAO,OAAO,OAAO,KAAK,QAAQ,OAAO,aAAa,CAAC;AAC3F,SAAO,IAAI,WAAW,WAAW;;;;;;;;CASnC,aAAa,WAAyB;AACpC,OAAK,YAAY;AACjB,SAAO;;;;;;;;CAST,MAAM,KAAK,QAA0D;AACnE,OAAK,oBAAoB;AAEzB,OAAK,YAAY,MAAM,OADF,KAAK,iBAAiB,CACA;AAC3C,SAAO;;;;;;;CAQT,WAAmB;AACjB,MAAI,CAAC,KAAK,UACR,OAAM,IAAI,eAAe,uBAAuB;AAElD,SAAO,GAAG,KAAK,2BAA2B,CAAC,GAAG,KAAK,eAAe,GAAG,KAAK;;;;;;;CAQ5E,SAAqB;AACnB,MAAI,CAAC,KAAK,UACR,OAAM,IAAI,eAAe,uBAAuB;EAGlD,MAAM,SAAqB;GACzB,SAAS,KAAK;GACd,YAAY,CACV;IACE,WAAW,KAAK,2BAA2B;IAC3C,WAAW,KAAK;IACjB,CACF;GACF;AAGD,MAAI,OAAO,KAAK,KAAK,kBAAkB,CAAC,SAAS,EAC/C,QAAO,WAAW,GAAG,SAAS,KAAK;AAGrC,SAAO;;;;;;;CAQT,kBAKE;AACA,MAAI,CAAC,KAAK,UACR,OAAM,IAAI,eAAe,uBAAuB;EAGlD,MAAM,SAKF;GACF,WAAW,KAAK,2BAA2B;GAC3C,SAAS,KAAK;GACd,WAAW,KAAK;GACjB;AAED,MAAI,OAAO,KAAK,KAAK,kBAAkB,CAAC,SAAS,EAC/C,QAAO,SAAS,KAAK;AAGvB,SAAO;;;;;CAMT,qBAA4C;AAC1C,SAAO,EAAE,GAAG,KAAK,iBAAiB;;;;;CAMpC,uBAAgD;AAC9C,SAAO,EAAE,GAAG,KAAK,mBAAmB;;;;;CAMtC,aAA4B;AAC1B,SAAO,KAAK;;CAKd,4BAA4C;AAE1C,SAAO,WADQ,KAAK,kBAAkB,CACb;;CAG3B,mBAAkD;EAChD,MAAM,SAAS,EAAE,GAAG,KAAK,iBAAiB;EAG1C,MAAM,aAAa,oBAAoB,QAAQ,UAAU,SAAS,OAAO;AACzE,MAAI,WAAW,SAAS,EACtB,QAAO,OAAO;AAGhB,SAAO;;CAGT,qBAAmC;EAEjC,MAAM,SAAS,gCAAgC,UAAU,KAAK,gBAAgB;AAC9E,MAAI,CAAC,OAAO,QAEV,OAAM,IAAI,eAAe,yCADV,OAAO,MAAM,OAAO,KAAK,MAAM,EAAE,QAAQ,CAAC,KAAK,KAAK,GACQ;;CAI/E,mBAAmC;EACjC,MAAM,SAAiC;GACrC,OAAO;GACP,OAAO;GACP,OAAO;GACP,OAAO;GACP,OAAO;GACP,OAAO;GACP,OAAO;GACP,OAAO;GACP,OAAO;GACR;EAED,MAAM,MAAM,KAAK,gBAAgB;AACjC,MAAI,CAAC,OAAO,CAAC,OAAO,KAClB,OAAM,IAAI,eAAe,0BAA0B,MAAgB;AAGrE,SAAO,OAAO;;;;;;;;;;;;;;;;;ACjalB,eAAsB,cACpB,KACA,UAC0B;CAC1B,MAAM,QAAQ,IAAI,MAAM,IAAI;AAE5B,KAAI,MAAM,WAAW,EACnB,OAAM,IAAI,eAAe,uCAAuC;CAGlE,MAAM,CAAC,eAAe,gBAAgB,aAAa;CAGnD,MAAM,QAAQ,MAAM,SAFC,GAAG,cAAc,GAAG,kBAEE,UAAU;AAErD,KAAI,CAAC,MACH,OAAM,IAAI,eAAe,oBAAoB;CAI/C,MAAM,YAAY,KAAK,MAAM,gBAAgB,cAAc,CAAC;CAC5D,MAAM,eAAe,sBAAsB,UAAU,UAAU;AAC/D,KAAI,CAAC,aAAa,QAEhB,OAAM,IAAI,eAAe,6BADV,aAAa,MAAM,OAAO,KAAK,MAAM,EAAE,QAAQ,CAAC,KAAK,KAAK,GACV;AAMjE,QAAO;EACL,QALa,aAAa;EAM1B,SAJc,iBAAkB,KAAK,MAAM,gBAAgB,eAAe,CAAC,GAAU,EAAE;EAKvF;EACD;;;;;;;;;;AAWH,eAAsB,cACpB,YACA,UACA,iBAAiB,GACS;CAE1B,MAAM,YAAY,iBAAiB,UAAU,WAAW;AACxD,KAAI,CAAC,UAAU,QAEb,OAAM,IAAI,eAAe,kCADV,UAAU,MAAM,OAAO,KAAK,MAAM,EAAE,QAAQ,CAAC,KAAK,KAAK,GACF;CAGtE,MAAM,MAAM,WAAW,WAAW;AAElC,KAAI,CAAC,IACH,OAAM,IAAI,eAAe,sBAAsB,eAAe,YAAY;CAI5E,MAAM,QAAQ,MAAM,SADC,GAAG,IAAI,UAAU,GAAG,WAAW,WACT,IAAI,UAAU;AAEzD,KAAI,CAAC,MACH,OAAM,IAAI,eAAe,oBAAoB;CAI/C,MAAM,YAAY,KAAK,MAAM,gBAAgB,IAAI,UAAU,CAAC;CAC5D,MAAM,eAAe,sBAAsB,UAAU,UAAU;AAC/D,KAAI,CAAC,aAAa,QAEhB,OAAM,IAAI,eAAe,6BADV,aAAa,MAAM,OAAO,KAAK,MAAM,EAAE,QAAQ,CAAC,KAAK,KAAK,GACV;AAQjE,QAAO;EACL,QAPa,aAAa;EAQ1B,SANc,WAAW,UACtB,KAAK,MAAM,gBAAgB,WAAW,QAAQ,CAAC,GAC/C,EAAE;EAKL,mBAAmB,IAAI;EACvB;EACD;;;;;;;;;AAUH,eAAsB,OACpB,KACA,UAC0B;AAC1B,KAAI,OAAO,QAAQ,UAAU;AAE3B,MAAI;GACF,MAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,OAAI,OAAO,cAAc,MAAM,QAAQ,OAAO,WAAW,CACvD,QAAO,cAAiB,QAAQ,SAAS;UAErC;AAGR,SAAO,cAAiB,KAAK,SAAS;;AAGxC,QAAO,cAAiB,KAAK,SAAS;;;;;;;;;AAUxC,SAAgB,OAAoB,KAIlC;AACA,KAAI,OAAO,QAAQ,UAAU;AAE3B,MAAI;GACF,MAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,OAAI,OAAO,cAAc,MAAM,QAAQ,OAAO,WAAW,EAAE;IACzD,MAAM,MAAM,OAAO,WAAW;AAC9B,WAAO;KACL,QAAQ,KAAK,MAAM,gBAAgB,IAAI,UAAU,CAAC;KAClD,SAAS,OAAO,UACX,KAAK,MAAM,gBAAgB,OAAO,QAAQ,CAAC,GAC3C,EAAE;KACP,mBAAmB,IAAI;KACxB;;UAEG;EAIR,MAAM,QAAQ,IAAI,MAAM,IAAI;AAC5B,MAAI,MAAM,WAAW,EACnB,OAAM,IAAI,eAAe,qBAAqB;AAGhD,SAAO;GACL,QAAQ,KAAK,MAAM,gBAAgB,MAAM,GAAG,CAAC;GAC7C,SAAS,MAAM,KAAM,KAAK,MAAM,gBAAgB,MAAM,GAAG,CAAC,GAAU,EAAE;GACvE;;CAGH,MAAM,MAAM,IAAI,WAAW;AAC3B,QAAO;EACL,QAAQ,KAAK,MAAM,gBAAgB,IAAI,UAAU,CAAC;EAClD,SAAS,IAAI,UAAW,KAAK,MAAM,gBAAgB,IAAI,QAAQ,CAAC,GAAU,EAAE;EAC5E,mBAAmB,IAAI;EACxB"}

package/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "@owf/eudi-jades",
+  "version": "0.1.0",
+  "description": "JAdES (JSON Advanced Electronic Signatures) implementation based on ETSI TS 119 182-1 standard",
+  "files": [
+    "dist"
+  ],
+  "license": "Apache-2.0",
+  "exports": "./src/index.ts",
+  "homepage": "https://github.com/openwallet-foundation-labs/identity-common-ts/tree/main/packages/eudi-jades",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/openwallet-foundation-labs/identity-common-ts",
+    "directory": "packages/eudi-jades"
+  },
+  "publishConfig": {
+    "access": "public",
+    "module": "./dist/index.mjs",
+    "types": "./dist/index.d.mts",
+    "exports": {
+      ".": "./dist/index.mjs",
+      "./package.json": "./package.json"
+    }
+  },
+  "keywords": [
+    "jades",
+    "etsi",
+    "electronic-signature",
+    "jws",
+    "jwt",
+    "eudi",
+    "ts-119-182"
+  ],
+  "scripts": {
+    "build": "tsdown src/index.ts --format esm --dts --sourcemap"
+  },
+  "dependencies": {
+    "@owf/crypto": "workspace:*",
+    "@owf/identity-common": "workspace:*",
+    "zod": "^4.3.6"
+  },
+  "devDependencies": {}
+}