@owf/eudi-tl 0.4.0-alpha-20260901082001

package/dist/index.mjs

@@ -0,0 +1,732 @@
+import { base64, compareBytes, hexEncode } from "@owf/identity-common";
+import { SubjectKeyIdentifierExtension, X509Certificate } from "@peculiar/x509";
+import { DOMParser, XMLSerializer } from "@xmldom/xmldom";
+import { z } from "zod";
+import * as xadesjs from "xadesjs";
+import * as xpath from "xpath";
+//#region src/constants.ts
+/**
+* Well-known ETSI TS 119 612 URIs.
+*
+* These are the standard values used by eIDAS national trusted lists. Profiled
+* lists may use their own profile-specific URIs (validated via a caller-supplied
+* {@link ProfileRule}); this library's parser is agnostic to both.
+*/
+/** Standard `TSLType` values (TS 119 612 clause 5.3.3). */
+const TSLType = {
+	EUgeneric: "http://uri.etsi.org/TrstSvc/TrustedList/TSLType/EUgeneric",
+	EUlistofthelists: "http://uri.etsi.org/TrstSvc/TrustedList/TSLType/EUlistofthelists"
+};
+/** Standard `ServiceStatus` values (TS 119 612 clause 5.5.4). */
+const ServiceStatus = {
+	Granted: "http://uri.etsi.org/TrstSvc/TrustedList/Svcstatus/granted",
+	Withdrawn: "http://uri.etsi.org/TrstSvc/TrustedList/Svcstatus/withdrawn",
+	UnderSupervision: "http://uri.etsi.org/TrstSvc/TrustedList/Svcstatus/undersupervision",
+	SupervisionCeased: "http://uri.etsi.org/TrstSvc/TrustedList/Svcstatus/supervisionceased",
+	SupervisionInCessation: "http://uri.etsi.org/TrstSvc/TrustedList/Svcstatus/supervisionincessation",
+	Accredited: "http://uri.etsi.org/TrstSvc/TrustedList/Svcstatus/accredited",
+	AccreditationCeased: "http://uri.etsi.org/TrstSvc/TrustedList/Svcstatus/accreditationceased",
+	AccreditationRevoked: "http://uri.etsi.org/TrstSvc/TrustedList/Svcstatus/accreditationrevoked",
+	SetByNationalLaw: "http://uri.etsi.org/TrstSvc/TrustedList/Svcstatus/setbynationallaw",
+	RecognisedAtNationalLevel: "http://uri.etsi.org/TrstSvc/TrustedList/Svcstatus/recognisedatnationallevel",
+	DeprecatedAtNationalLevel: "http://uri.etsi.org/TrstSvc/TrustedList/Svcstatus/deprecatedatnationallevel"
+};
+/**
+* Service statuses that denote a currently active / trustworthy service under
+* TS 119 612. Use as the `serviceStatus` filter when extracting trust anchors
+* from a standard eIDAS list; withdrawn/ceased services are excluded.
+*/
+const ACTIVE_SERVICE_STATUSES = [
+	ServiceStatus.Granted,
+	ServiceStatus.UnderSupervision,
+	ServiceStatus.Accredited,
+	ServiceStatus.SetByNationalLaw,
+	ServiceStatus.RecognisedAtNationalLevel
+];
+/** Common standard `ServiceTypeIdentifier` values (TS 119 612 Annex D). */
+const ServiceType = {
+	/** Qualified certificate CA. */
+	CA_QC: "http://uri.etsi.org/TrstSvc/Svctype/CA/QC",
+	/** Public key certificate CA. */
+	CA_PKC: "http://uri.etsi.org/TrstSvc/Svctype/CA/PKC",
+	/** Qualified timestamping authority. */
+	TSA_QTST: "http://uri.etsi.org/TrstSvc/Svctype/TSA/QTST",
+	/** Qualified electronic delivery service. */
+	EDS_Q: "http://uri.etsi.org/TrstSvc/Svctype/EDS/Q",
+	/** Qualified registered electronic mail delivery service. */
+	EDS_REM_Q: "http://uri.etsi.org/TrstSvc/Svctype/EDS/REM/Q",
+	/** Qualified preservation service for electronic signatures/seals. */
+	PSES_Q: "http://uri.etsi.org/TrstSvc/Svctype/PSES/Q",
+	/** Qualified validation service for qualified electronic signatures. */
+	QESValidation_Q: "http://uri.etsi.org/TrstSvc/Svctype/QESValidation/Q",
+	/** OCSP responder for qualified certificates. */
+	OCSP_QC: "http://uri.etsi.org/TrstSvc/Svctype/Certstatus/OCSP/QC"
+};
+//#endregion
+//#region src/eu-lotl-anchors.ts
+/**
+* The signing certificates published by the LOTL identified in
+* {@link EU_LOTL_ANCHORS_PROVENANCE}. Any of them may sign a future issue of the
+* list, so the whole published set is pinned, not just the current signer.
+*/
+const EU_LOTL_SIGNING_CERTIFICATES = [
+	{
+		certificate: "MIIIljCCBn6gAwIBAgIUMkdxaYjTAuT2WRKfmeup7zDClNgwDQYJKoZIhvcNAQENBQAwXzELMAkGA1UEBhMCUFQxKjAoBgNVBAoMIURpZ2l0YWxTaWduIENlcnRpZmljYWRvcmEgRGlnaXRhbDEkMCIGA1UEAwwbRElHSVRBTFNJR04gUVVBTElGSUVEIENBIEcxMB4XDTI1MTIxNzE0MzE1NFoXDTI5MTIxNzE0MzE1NFowggEMMQswCQYDVQQGEwJMVTFDMEEGA1UECww6Q2VydGlmaWNhdGUgUHJvZmlsZSAtIFF1YWxpZmllZCBDZXJ0aWZpY2F0ZSAtIE9yZ2FuaXphdGlvbjExMC8GA1UECwwoRGlyZWN0b3JhdGUtR2VuZXJhbCBmb3IgRGlnaXRhbCBTZXJ2aWNlczEjMCEGA1UEYQwaTEVJWEctMjU0OTAwWk5ZQTFGTFVROVUzOTMxHDAaBgNVBAoME0VVUk9QRUFOIENPTU1JU1NJT04xJDAiBgkqhkiG9w0BCQEWFUVVLVRSVVNUQGVjLmV1cm9wYS5ldTEcMBoGA1UEAwwTRVVST1BFQU4gQ09NTUlTU0lPTjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKJguyStfry/iDbqvGbthdtVqpIyQ3p04V5hVtzWWKERnp5zN4AU3E1ljqKzUFvEtUyzql6c30ntDIJS9LnbCqd7B+YVy+Ad/YXkSx1SNNcwrKMy9WiE/xxGBw3CgM4PI1Xe0wNtLEdV2Ds82ELVnE59vefFC1zN5gx7YLlI1Y433Lch7Koo7w0LGbjIYDaHVRmbT4n+WzbXxQddDJHaST1piFcWXR070JEehLUdoyGBlNX4s0e6APDoZL0pHQOmSbL9o0IhOT5zavza7t10B9QU7+kHoPKUiVRYtPiYgMMkeIyLcO+C9aMhYknxvLaO4TjKAlXsWyC37u58lLsSun4BdMA0e+YYAJa94fQyXNxAGrajV4pXFUlZOtAI7GcuLHzSUy5kHvKNw6BeOX0dbrJz7HdKFKB6qz8xcv8Fs3FiZrbYH/Ov5NmocW5wxD4IFgSm3ZtRdCv90eGYbFhGgb9fuj90kxvSk902db52Srm7OTr3iuxEtiOhnubi+emaTeT74Q5lI2w6JIOhoQZeJw7diFDub3bdpsH0TTkFb4B1uMmiKAL8sE0h0ZtoYjCBTTWjgGCFBYDQNPCS1ITJEj/JHFSXaY0Y6kfqkBDjvdWnIapvcmy7Hkk2Hx6AzTITyxZ20HtRURiiKgGp8inZLB+Ffj358FF7m0xBWKvemjDBAgMBAAGjggKZMIIClTAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFHNJ8UAcFAR8mhJ/+i/NXGcjGOkUMIGGBggrBgEFBQcBAQR6MHgwRgYIKwYBBQUHMAKGOmh0dHBzOi8vcWNhLWcxLmRpZ2l0YWxzaWduLnB0L0RJR0lUQUxTSUdOUVVBTElGSUVEQ0FHMS5wN2IwLgYIKwYBBQUHMAGGImh0dHBzOi8vcWNhLWcxLmRpZ2l0YWxzaWduLnB0L29jc3AwIAYDVR0RBBkwF4EVRVUtVFJVU1RAZWMuZXVyb3BhLmV1MF8GA1UdIARYMFYwNwYLKwYBBAGBx3wEAQEwKDAmBggrBgEFBQcCARYaaHR0cHM6Ly9wa2kuZGlnaXRhbHNpZ24ucHQwEAYOKwYBBAGBx3wEAgEBAQYwCQYHBACL7EABAzAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwgbwGCCsGAQUFBwEDBIGvMIGsMBUGCCsGAQUFBwsCMAkGBwQAi+xJAQIwCAYGBACORgEBMAgGBgQAjkYBBDATBgYEAI5GAQYwCQYHBACORgEGAjBqBgYEAI5GAQUwYDAuFihodHRwczovL3FjYS1nMS5kaWdpdGFsc2lnbi5wdC9QRFNfZW4ucGRmEwJlbjAuFihodHRwczovL3FjYS1nMS5kaWdpdGFsc2lnbi5wdC9QRFNfcHQucGRmEwJwdDBLBgNVHR8ERDBCMECgPqA8hjpodHRwczovL3FjYS1nMS5kaWdpdGFsc2lnbi5wdC9ESUdJVEFMU0lHTlFVQUxJRklFRENBRzEuY3JsMB0GA1UdDgQWBBSHDNZJrZdGBhUl8nfHbH/C0pdKBTAOBgNVHQ8BAf8EBAMCBkAwDQYJKoZIhvcNAQENBQADggIBAJQhD5ZXFK6w/6ODzWs82K5E3JMqQBnHaMVXRI5mwsts3Y4h1pU0xTECqrRnn4IkwWLy5csHjJOO1RbXasI3s6LHV+WzVdebUVH92nsPs9c7msxTwohXweCX429nBVBY0h1JlpE41e/AaDHLOMBe3elrQF+3VUBnoFuTF+bDDROCw5B44ULYQ+yHvJg0LVygnhQb08l+YtRpQNTA/Q1Q9ALIuudEpL5vtAQVTBKPc0DyWGw1ElEFh++goqHAtCT76/8HOILjwC7gTNe3W7WGhT1y3ZzKfp4T3q+dpqo7+yJSHMEAjWArmuMwTF0rHZDCKVfxhKPaJaslcNww8Hwf6igaRYSbtajyWGD56ZLllRttks0yU0ZWVcPONQUbFpWRF8DU4+yVSSI5var0p2MiHzLqrrltSbZG+ykFr7Xz9rvpSKLzweRXELeuW/KcPL0qspUi/VWDZvqbun9sEoPhKG02ciNjpIKuB5L4A2vP3oH82GtTa+P5BnOmLLSDxKOHXFbFpTET7kirc3GLyxoppjwAfeV/a9Rqm+gdjpbrJuHnutj9xm2jAWThELxoNKmluSSf1uPsh3GrxIeH8gbmvKsOWG4CCU+MW+bLufFsx1ZRHzytphb6LNVHtgaJ7aUTuZHYBGI3SdZ+ogB/fjo9NM/unYnlfSRXesA8lJP+S5qt",
+		subject: "C=LU, OU=Certificate Profile - Qualified Certificate - Organization, OU=Directorate-General for Digital Services, 2.5.4.97=LEIXG-254900ZNYA1FLUQ9U393, O=EUROPEAN COMMISSION, E=EU-TRUST@ec.europa.eu, CN=EUROPEAN COMMISSION",
+		fingerprintSha256: "236103f03a8031ae8f47f9059bf8de38564cdbfebedde4a597d50f8980aa653b",
+		notAfter: "2029-12-17T14:31:54.000Z"
+	},
+	{
+		certificate: "MIIH9DCCBdygAwIBAgIUYymXhglnqt2gI4PHVh4juzinht8wDQYJKoZIhvcNAQENBQAwXzELMAkGA1UEBhMCUFQxKjAoBgNVBAoMIURpZ2l0YWxTaWduIENlcnRpZmljYWRvcmEgRGlnaXRhbDEkMCIGA1UEAwwbRElHSVRBTFNJR04gUVVBTElGSUVEIENBIEcxMB4XDTI0MDQyNjEyNDkyMloXDTI3MDQyNjEyNDkyMlowggFKMQswCQYDVQQGEwJHUjE9MDsGA1UECww0Q2VydGlmaWNhdGUgUHJvZmlsZSAtIFF1YWxpZmllZCBDZXJ0aWZpY2F0ZSAtIE1lbWJlcjEjMCEGA1UEYQwaTEVJWEctMjU0OTAwWk5ZQTFGTFVROVUzOTMxHDAaBgNVBAoME0VVUk9QRUFOIENPTU1JU1NJT04xKTAnBgNVBAsMIEVudGl0bGVtZW50IC0gRUMgU1RBVFVUT1JZIFNUQUZGMS0wKwYJKoZIhvcNAQkBFh5hcG9zdG9sb3MuYXBsYWRhc0BlYy5ldXJvcGEuZXUxEDAOBgNVBAQMB0FQTEFEQVMxEjAQBgNVBCoMCUFQT1NUT0xPUzEdMBsGA1UECwwUUmVtb3RlUVNDRE1hbmFnZW1lbnQxGjAYBgNVBAMMEUFQT1NUT0xPUyBBUExBREFTMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsILa9o3bgz0l/dR1R01MhItrd6BLkxakJxlqpnlc1hhT8R3uYGvSVwfsmjQei/YkbjMoNzakjo4voPhUIJBa907TJLGwZSghfkp0+vcg4yeCLodAQatG7iEsh5Fr5uZgwPpLXExil0234QRcw7kJsI4k7wd7YvXAj1kv5zLTFo6sOr8ZF9km2rU17gbdZisIH3/uR+JHkkhbljm+MspETNN+Nva7duhkz14llh/EJryTEPQLAdsgz+cRkBkyLQ1YYS6iR3pifrsMvXzHYlwJY9AzPNd3c0BS2Ov05kB6tRyOka+6MREWY9aU22K/Q0anyrNCns5N/UXs589TwrWp0QIDAQABo4ICuTCCArUwDAYDVR0TAQH/BAIwADAfBgNVHSMEGDAWgBRzSfFAHBQEfJoSf/ovzVxnIxjpFDCBhgYIKwYBBQUHAQEEejB4MEYGCCsGAQUFBzAChjpodHRwczovL3FjYS1nMS5kaWdpdGFsc2lnbi5wdC9ESUdJVEFMU0lHTlFVQUxJRklFRENBRzEucDdiMC4GCCsGAQUFBzABhiJodHRwczovL3FjYS1nMS5kaWdpdGFsc2lnbi5wdC9vY3NwMCkGA1UdEQQiMCCBHmFwb3N0b2xvcy5hcGxhZGFzQGVjLmV1cm9wYS5ldTBfBgNVHSAEWDBWMDcGCysGAQQBgcd8BAEBMCgwJgYIKwYBBQUHAgEWGmh0dHBzOi8vcGtpLmRpZ2l0YWxzaWduLnB0MBAGDisGAQQBgcd8BAIBAQEEMAkGBwQAi+xAAQIwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMEsGA1UdHwREMEIwQKA+oDyGOmh0dHBzOi8vcWNhLWcxLmRpZ2l0YWxzaWduLnB0L0RJR0lUQUxTSUdOUVVBTElGSUVEQ0FHMS5jcmwwHQYDVR0OBBYEFHG/mw4edY/tTzrYu+8+Up7LgWyGMA4GA1UdDwEB/wQEAwIGQDCB0wYIKwYBBQUHAQMEgcYwgcMwCAYGBACORgEBMAgGBgQAjkYBBDATBgYEAI5GAQYwCQYHBACORgEGATBqBgYEAI5GAQUwYDAuFihodHRwczovL3FjYS1nMS5kaWdpdGFsc2lnbi5wdC9QRFNfcHQucGRmEwJwdDAuFihodHRwczovL3FjYS1nMS5kaWdpdGFsc2lnbi5wdC9QRFNfZW4ucGRmEwJlbjAVBggrBgEFBQcLAjAJBgcEAIvsSQEBMBUGCCsGAQUFBwsCMAkGBwQAi+xJAQIwDQYJKoZIhvcNAQENBQADggIBALUt37pV7w5ZwRxBB5PdTGTC+XcWytkuyuRJlVu+hVD5yVC2E+4+EPB2mRUzkjeE2M/3iMpzdwaNHe2YU9lCkoUFtD7VLIEdilfGO0MnXde2BAQN1VAt0s8xLwr3DNATsrtYPbtkQ73WCNqQwuNlg4LCFXHHpzvsKzYmYz+hYgkA8daRZRJdnZx/eX05iYFtShbbz8VamNb+A1L/KmqSrt5iG8d9SLSSq9SbNrntxSLaYDJfOITjhW5KOwlXBJPA+sQDYPngHur1nLWUJg6QB8fo/YwMOTmyIciurp8QzktxfJU1wSZEpd/xZKoDWVDNjJa8p0RFbQs/l7DpP/s57p8PKcntDOvQkYCajpRFLKl/69gKdVkB6nOKHFQCTmAeCDapWsI9+jPCnriywN60ep+MMqedZ/lV8LecbJ/1E+kw6PhC6Rs4MlwmHHCe6BB/9oTK7SWW/CtIZh8ygtJ0+5JlDS/83b0F0JdnZUV2qhlZJlVOROcQljcWs7kYS8vWAqBbccAhYNpaaUh1rnKGqo2jpOo5HXhgSVHNRrC+CylNNDUGAhpgPsAD93ui6JQCjdlSzDkraWZA/GtmdpId0b7IR6HfRBs/QzeA4Rj7ChMMOFxDZPp2t6kEyPb1UOshC79fmoNRkBxmGKqMCPakQiiUoIg/BkLIUVYClIoQ8zsk",
+		subject: "C=GR, OU=Certificate Profile - Qualified Certificate - Member, 2.5.4.97=LEIXG-254900ZNYA1FLUQ9U393, O=EUROPEAN COMMISSION, OU=Entitlement - EC STATUTORY STAFF, E=apostolos.apladas@ec.europa.eu, SN=APLADAS, G=APOSTOLOS, OU=RemoteQSCDManagement, CN=APOSTOLOS APLADAS",
+		fingerprintSha256: "b63d416744e7098bf9ec2caa596a93bc2468e37f8284ba65ecc061711bcbaa18",
+		notAfter: "2027-04-26T12:49:22.000Z"
+	},
+	{
+		certificate: "MIIIBDCCBeygAwIBAgIUcMz/PU9hyZj1+vaAghkzK31AkUswDQYJKoZIhvcNAQENBQAwXzELMAkGA1UEBhMCUFQxKjAoBgNVBAoMIURpZ2l0YWxTaWduIENlcnRpZmljYWRvcmEgRGlnaXRhbDEkMCIGA1UEAwwbRElHSVRBTFNJR04gUVVBTElGSUVEIENBIEcxMB4XDTI1MTEyNDA5NTY0MVoXDTI5MTEyMzA5NTY0MVowggFWMQswCQYDVQQGEwJHUjE9MDsGA1UECww0Q2VydGlmaWNhdGUgUHJvZmlsZSAtIFF1YWxpZmllZCBDZXJ0aWZpY2F0ZSAtIE1lbWJlcjEjMCEGA1UEYQwaTEVJWEctMjU0OTAwWk5ZQTFGTFVROVUzOTMxHDAaBgNVBAoME0VVUk9QRUFOIENPTU1JU1NJT04xKTAnBgNVBAsMIEVudGl0bGVtZW50IC0gRUMgU1RBVFVUT1JZIFNUQUZGMTEwLwYJKoZIhvcNAQkBFiJJb2FubmEuS0FMT0dFUk9QT1VMT1VAZWMuZXVyb3BhLmV1MRcwFQYDVQQEDA5LQUxPR0VST1BPVUxPVTEPMA0GA1UEKgwGSU9BTk5BMR0wGwYDVQQLDBRSZW1vdGVRU0NETWFuYWdlbWVudDEeMBwGA1UEAwwVSU9BTk5BIEtBTE9HRVJPUE9VTE9VMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAswjmtemrpGlPsoCM1tVfVICYiyK0eIodby6nK00KfkS8K9gEou+OZjJ5B85VmEC7u889RAG1DUr6k+7Setz9E/qYdFhz/3GJw10XsEuRcwdzafvKM9DrXFFkGYRqKSkJ67/sKq1JKE7bCkbMZ/B8SDRUJ2veSoRS/oC5GhufarAZOxXUwrzb723BTwQGkar/G0Y7co1eVQXX6hGy4mnPF36APvG941p/IuoMM5Ib610h/I1zB5DFIgAVEi0HnlCoLfQ6oqJcv01WfGKEIhppoephuhSE7EqQ0JLIuf8zdunyY/Mmvz4it2jFV/QQf1R87StpL7AicC5BSCWfiXyD7wIDAQABo4ICvTCCArkwDAYDVR0TAQH/BAIwADAfBgNVHSMEGDAWgBRzSfFAHBQEfJoSf/ovzVxnIxjpFDCBhgYIKwYBBQUHAQEEejB4MEYGCCsGAQUFBzAChjpodHRwczovL3FjYS1nMS5kaWdpdGFsc2lnbi5wdC9ESUdJVEFMU0lHTlFVQUxJRklFRENBRzEucDdiMC4GCCsGAQUFBzABhiJodHRwczovL3FjYS1nMS5kaWdpdGFsc2lnbi5wdC9vY3NwMC0GA1UdEQQmMCSBIklvYW5uYS5LQUxPR0VST1BPVUxPVUBlYy5ldXJvcGEuZXUwXwYDVR0gBFgwVjA3BgsrBgEEAYHHfAQBATAoMCYGCCsGAQUFBwIBFhpodHRwczovL3BraS5kaWdpdGFsc2lnbi5wdDAQBg4rBgEEAYHHfAQCAQEBBDAJBgcEAIvsQAECMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDBLBgNVHR8ERDBCMECgPqA8hjpodHRwczovL3FjYS1nMS5kaWdpdGFsc2lnbi5wdC9ESUdJVEFMU0lHTlFVQUxJRklFRENBRzEuY3JsMB0GA1UdDgQWBBQOe+jKZg/EC79WvQ/Ven54zd1YxDAOBgNVHQ8BAf8EBAMCBkAwgdMGCCsGAQUFBwEDBIHGMIHDMAgGBgQAjkYBATAIBgYEAI5GAQQwEwYGBACORgEGMAkGBwQAjkYBBgEwagYGBACORgEFMGAwLhYoaHR0cHM6Ly9xY2EtZzEuZGlnaXRhbHNpZ24ucHQvUERTX3B0LnBkZhMCcHQwLhYoaHR0cHM6Ly9xY2EtZzEuZGlnaXRhbHNpZ24ucHQvUERTX2VuLnBkZhMCZW4wFQYIKwYBBQUHCwIwCQYHBACL7EkBATAVBggrBgEFBQcLAjAJBgcEAIvsSQECMA0GCSqGSIb3DQEBDQUAA4ICAQBXav52/+LXYZAgA0MjuEI/+NacJC9E9VRIkIIvrLzAHcj2KQ2GLR1fL8C2UIJ6u2+LwG2mIyyK2F16erDoOWKDV40vxgGEfSwgin6GUhHmzuRDPBQhUW4C7btUFMoAr05UT+v03d9RrnlA5bpKSlKaf2J3EGAfGR1DvvFJ+ZCFaVo+8rtcLpySS3f8ZPCqz3axaO3KeyK4LuJbdZqGArKIF0vNKGR94rr7Pq7OIIHJBuOW9LGQG0r5e8kb/KRLZBsPlHpgPVZc8M3EimqYmIg6hgPf0k+Mxhw5/IC4rikFsMTNa43yBeGrk2pvM8cIZoenmQMgf/1L0+A9Pwol+7CUQfe4Bpj0fr1Acnx/4oPnAKmMDKvXnx91fMW2b7Uen2y11TcijxYuXftq03bx8w/ms/giXYLGciDcwCF7XCXNnGuATW/GxPvOxOwu56ZDrm/oG3zfa4l/tF/S5swoFrzmTDIIM05UzHDUuQAln103BGfEYKo7vw4bNfouHfS28qGWbotUSNzHfOEqeC4LrdN7JmE8q0hZRXLFOIsPtG/S0rEkuoNl3znZPmk8oAy/xa1+3XnH1nJCVmTK0XQYaTPinAAEnDbTqUjD97zmUFEd+ecOctica4DFhQoHtUDYUOzKEKfKHVEG0ApI3dpHzcLiuLXIQl0DBvfy3wspy6HL3A==",
+		subject: "C=GR, OU=Certificate Profile - Qualified Certificate - Member, 2.5.4.97=LEIXG-254900ZNYA1FLUQ9U393, O=EUROPEAN COMMISSION, OU=Entitlement - EC STATUTORY STAFF, E=Ioanna.KALOGEROPOULOU@ec.europa.eu, SN=KALOGEROPOULOU, G=IOANNA, OU=RemoteQSCDManagement, CN=IOANNA KALOGEROPOULOU",
+		fingerprintSha256: "c0641c4f7d56c431b1c924742db7fce9c1eef7d7fd212113a2768486b3abcdc5",
+		notAfter: "2029-11-23T09:56:41.000Z"
+	},
+	{
+		certificate: "MIIG7zCCBNegAwIBAgIQEAAAAAAAnuXHXttK9Tyf2zANBgkqhkiG9w0BAQsFADBkMQswCQYDVQQGEwJCRTERMA8GA1UEBxMIQnJ1c3NlbHMxHDAaBgNVBAoTE0NlcnRpcG9zdCBOLlYuL1MuQS4xEzARBgNVBAMTCkNpdGl6ZW4gQ0ExDzANBgNVBAUTBjIwMTgwMzAeFw0xODA2MDEyMjA0MTlaFw0yODA1MzAyMzU5NTlaMHAxCzAJBgNVBAYTAkJFMSMwIQYDVQQDExpQYXRyaWNrIEtyZW1lciAoU2lnbmF0dXJlKTEPMA0GA1UEBBMGS3JlbWVyMRUwEwYDVQQqEwxQYXRyaWNrIEplYW4xFDASBgNVBAUTCzcyMDIwMzI5OTcwMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAr7g7VriDY4as3R4LPOg7uPH5inHzaVMOwFb/8YOW+9IVMHz/V5dJAzeTKvhLG5S4Pk6Kd2E+h18FlRonp70Gv2+ijtkPk7ZQkfez0ycuAbLXiNx2S7fc5GG9LGJafDJgBgTQuQm1aDVLDQ653mqR5tAO+gEf6vs4zRESL3MkYXAUq+S/WocEaGpIheNVAF3iPSkvEe3LvUjF/xXHWF4aMvqGK6kXGseaTcn9hgTbceuW2PAiEr+eDTNczkwGBDFXwzmnGFPMRez3ONk/jIKhha8TylDSfI/MX3ODt0dU3jvJEKPIfUJixBPehxMJMwWxTjFbNu/CK7tJ8qT2i1S4VQIDAQABo4ICjzCCAoswHwYDVR0jBBgwFoAU2TQhPjpCJW3hu7++R0z4Aq3jL1QwcwYIKwYBBQUHAQEEZzBlMDkGCCsGAQUFBzAChi1odHRwOi8vY2VydHMuZWlkLmJlbGdpdW0uYmUvY2l0aXplbjIwMTgwMy5jcnQwKAYIKwYBBQUHMAGGHGh0dHA6Ly9vY3NwLmVpZC5iZWxnaXVtLmJlLzIwggEjBgNVHSAEggEaMIIBFjCCAQcGB2A4DAEBAgEwgfswLAYIKwYBBQUHAgEWIGh0dHA6Ly9yZXBvc2l0b3J5LmVpZC5iZWxnaXVtLmJlMIHKBggrBgEFBQcCAjCBvQyBukdlYnJ1aWsgb25kZXJ3b3JwZW4gYWFuIGFhbnNwcmFrZWxpamtoZWlkc2JlcGVya2luZ2VuLCB6aWUgQ1BTIC0gVXNhZ2Ugc291bWlzIMOgIGRlcyBsaW1pdGF0aW9ucyBkZSByZXNwb25zYWJpbGl0w6ksIHZvaXIgQ1BTIC0gVmVyd2VuZHVuZyB1bnRlcmxpZWd0IEhhZnR1bmdzYmVzY2hyw6Rua3VuZ2VuLCBnZW3DpHNzIENQUzAJBgcEAIvsQAECMDkGA1UdHwQyMDAwLqAsoCqGKGh0dHA6Ly9jcmwuZWlkLmJlbGdpdW0uYmUvZWlkYzIwMTgwMy5jcmwwDgYDVR0PAQH/BAQDAgZAMBMGA1UdJQQMMAoGCCsGAQUFBwMEMGwGCCsGAQUFBwEDBGAwXjAIBgYEAI5GAQEwCAYGBACORgEEMDMGBgQAjkYBBTApMCcWIWh0dHBzOi8vcmVwb3NpdG9yeS5laWQuYmVsZ2l1bS5iZRMCZW4wEwYGBACORgEGMAkGBwQAjkYBBgEwDQYJKoZIhvcNAQELBQADggIBACBY+OLhM7BryzXWklDUh9UK1+cDVboPg+lN1Et1lAEoxV4y9zuXUWLco9t8M5WfDcWFfDxyhatLedku2GurSJ1t8O/knDwLLyoJE1r2Db9VrdG+jtST+j/TmJHAX3yNWjn/9dsjiGQQuTJcce86rlzbGdUqjFTt5mGMm4zy4l/wKy6XiDKiZT8cFcOTevsl+l/vxiLiDnghOwTztVZhmWExeHG9ypqMFYmIucHQ0SFZre8mv3c7Df+VhqV/sY9xLERK3Ffk4l6B5qRPygImXqGzNSWiDISdYeUf4XoZLXJBEP7/36r4mlnP2NWQ+c1ORjesuDAZ8tD/yhMvR4DVG95EScjpTYv1wOmVB2lQrWnEtygZIi60HXfozo8uOekBnqWyDc1kuizZsYRfVNlwhCu7RsOq4zN8gkael0fejuSNtBf2J9A+rc9LQeu6AcdPauWmbxtJV93H46pFptsR8zXo+IJn5m2P9QPZ3mvDkzldNTGLG+ukhN7IF2CCcagt/WoVZLq3qKC35WVcqeoSMEE/XeSrf3/mIJ1OyFQm+tsfhTceOFDXuUgl3E86bR/f8Ur/bapwXpWpFxGIpXLGaJXbzQGSTtyNEYrdENlh71I3OeYdw3xmzU2B3tbaWREOXtj2xjyW2tIv+vvHG6sloR1QkIkGMFfzsT7W5U6ILetv",
+		subject: "C=BE, CN=Patrick Kremer (Signature), SN=Kremer, G=Patrick Jean, 2.5.4.5=72020329970",
+		fingerprintSha256: "d2064fdd70f6982dcc516b86d9d5c56aea939417c624b2e478c0b29de54f8474",
+		notAfter: "2028-05-30T23:59:59.000Z"
+	},
+	{
+		certificate: "MIIICDCCBfCgAwIBAgIUSOnGJxOHWc5N+Nk12eZPPCwr7ZYwDQYJKoZIhvcNAQENBQAwXzELMAkGA1UEBhMCUFQxKjAoBgNVBAoMIURpZ2l0YWxTaWduIENlcnRpZmljYWRvcmEgRGlnaXRhbDEkMCIGA1UEAwwbRElHSVRBTFNJR04gUVVBTElGSUVEIENBIEcxMB4XDTI0MDUwNjEyNDUxNloXDTI3MDUwNjEyNDUxNlowggFZMQswCQYDVQQGEwJFUzE9MDsGA1UECww0Q2VydGlmaWNhdGUgUHJvZmlsZSAtIFF1YWxpZmllZCBDZXJ0aWZpY2F0ZSAtIE1lbWJlcjEjMCEGA1UEYQwaTEVJWEctMjU0OTAwWk5ZQTFGTFVROVUzOTMxHDAaBgNVBAoME0VVUk9QRUFOIENPTU1JU1NJT04xKTAnBgNVBAsMIEVudGl0bGVtZW50IC0gRUMgU1RBVFVUT1JZIFNUQUZGMTIwMAYJKoZIhvcNAQkBFiN2aWNlbnRlLmFuZHJldS1uYXZhcnJvQGVjLmV1cm9wYS5ldTEXMBUGA1UEBAwOQU5EUkVVIE5BVkFSUk8xEDAOBgNVBCoMB1ZJQ0VOVEUxHTAbBgNVBAsMFFJlbW90ZVFTQ0RNYW5hZ2VtZW50MR8wHQYDVQQDDBZWSUNFTlRFIEFORFJFVSBOQVZBUlJPMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAveJV7goW3mvqJq2kMT0cnrkFAnT/lyzbgaHVvd5jEMHy6RyoI1Af4JTlOWSjC+6fsNzApFR1Tv3w8/WuSgjHTWfDnpqs20iJh979A5WwvfXuzcuUqeFFptdR/tJm/08TsTAD+CeA+rQo6K23B1xMYRwX/BNt/EL03Q/TOQj5V4uV3Kyf0945yu5gOhmrMs/RZCZ8M+iahwTaVktf+ZvhocSsPt+a2OuPI8IpTU+xIWAXWuQ+27Q7zzD0d6sqBdruDr16clFtZXWNRikm9q6pCOAOKG/myszeUuy++TPtQnI3+OQlTuyDXsz9UNKboQCF2SNmfRoeBxcx02tS/zUgPwIDAQABo4ICvjCCArowDAYDVR0TAQH/BAIwADAfBgNVHSMEGDAWgBRzSfFAHBQEfJoSf/ovzVxnIxjpFDCBhgYIKwYBBQUHAQEEejB4MEYGCCsGAQUFBzAChjpodHRwczovL3FjYS1nMS5kaWdpdGFsc2lnbi5wdC9ESUdJVEFMU0lHTlFVQUxJRklFRENBRzEucDdiMC4GCCsGAQUFBzABhiJodHRwczovL3FjYS1nMS5kaWdpdGFsc2lnbi5wdC9vY3NwMC4GA1UdEQQnMCWBI3ZpY2VudGUuYW5kcmV1LW5hdmFycm9AZWMuZXVyb3BhLmV1MF8GA1UdIARYMFYwNwYLKwYBBAGBx3wEAQEwKDAmBggrBgEFBQcCARYaaHR0cHM6Ly9wa2kuZGlnaXRhbHNpZ24ucHQwEAYOKwYBBAGBx3wEAgEBAQQwCQYHBACL7EABAjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cHM6Ly9xY2EtZzEuZGlnaXRhbHNpZ24ucHQvRElHSVRBTFNJR05RVUFMSUZJRURDQUcxLmNybDAdBgNVHQ4EFgQUjueweY4PI0KGjetMh84vTsEnxQcwDgYDVR0PAQH/BAQDAgZAMIHTBggrBgEFBQcBAwSBxjCBwzAIBgYEAI5GAQEwCAYGBACORgEEMBMGBgQAjkYBBjAJBgcEAI5GAQYBMGoGBgQAjkYBBTBgMC4WKGh0dHBzOi8vcWNhLWcxLmRpZ2l0YWxzaWduLnB0L1BEU19wdC5wZGYTAnB0MC4WKGh0dHBzOi8vcWNhLWcxLmRpZ2l0YWxzaWduLnB0L1BEU19lbi5wZGYTAmVuMBUGCCsGAQUFBwsCMAkGBwQAi+xJAQEwFQYIKwYBBQUHCwIwCQYHBACL7EkBAjANBgkqhkiG9w0BAQ0FAAOCAgEAHBjW4N8NKNCiJot414m/L76pB/15LKiGDi1/2V7MHe8u2GcplR1IjESrSEhhwUAW1hwDIK9xJrJ/hdDUMIQcKScSiJCqTCb0Yk39yj/gfOYaN/3fqw8Pjh9k++3Ox7KnvY3R/foFvGJlyiuqaai/JgBmc4qDBHSIDyo5gRw6v70osRPDR5sJs4Xh3FOJn9Y0JZPLF/skYtLrNVysL/4A4bbAxB2DcJ5MpoIegh/fnJ5s2BOVq2Xq8ADpeJoLFYbtlbP7NwsGgew2wKiDW963MlJL/Xa2AqcPVE/UnXFkIBCwZH+covxSEQH2iVcF8cEDHBiYHGERaSmL/uHK/F8soDO9VQwtKNxsiIKAWsQHTYcKfEgVuweyLj7TsCmh6T4pIHqaNDqWvrgEIo0ZwuBmfXVEd+JMSzSgIcJ2bPR2KNoJ14MO4FFYdAAnVlfdhipErsK6R23hlto7b3XKiMRUt9xrvPUjuEJdGI5hPm9CqGK1GxlRoKLewyX7A+OIcPMPu1KfuuUTUn+3hLJJZO5H9k4uVMJ/FOhwzc2VhRpyvNjfmFZksFvseFGvMl5EWIqp3JCo0ItkOBG59ulBwg/99Y0pT6LW9cviTzKIwDtHmQrIgYLa+lCYwWdGhIidXynvLpWiVRZJvYrPIGpzQCRcw9V2i8zT7nksj7QF9v88kto=",
+		subject: "C=ES, OU=Certificate Profile - Qualified Certificate - Member, 2.5.4.97=LEIXG-254900ZNYA1FLUQ9U393, O=EUROPEAN COMMISSION, OU=Entitlement - EC STATUTORY STAFF, E=vicente.andreu-navarro@ec.europa.eu, SN=ANDREU NAVARRO, G=VICENTE, OU=RemoteQSCDManagement, CN=VICENTE ANDREU NAVARRO",
+		fingerprintSha256: "df7e29360c34b2b8d6d5f40325c1d4d12c9922cecd33b7407674a74b2b3ca1e5",
+		notAfter: "2027-05-06T12:45:16.000Z"
+	},
+	{
+		certificate: "MIIIoDCCBoigAwIBAgIUc8IcSUtVEKAMMvHm9QWU05kXsPUwDQYJKoZIhvcNAQENBQAwXzELMAkGA1UEBhMCUFQxKjAoBgNVBAoMIURpZ2l0YWxTaWduIENlcnRpZmljYWRvcmEgRGlnaXRhbDEkMCIGA1UEAwwbRElHSVRBTFNJR04gUVVBTElGSUVEIENBIEcxMB4XDTIzMTExNzEwMTE0NloXDTI3MTExNzEwMTE0NlowggEVMQswCQYDVQQGEwJMVTFDMEEGA1UECww6Q2VydGlmaWNhdGUgUHJvZmlsZSAtIFF1YWxpZmllZCBDZXJ0aWZpY2F0ZSAtIE9yZ2FuaXphdGlvbjE5MDcGA1UECwwwRGlyZWN0b3JhdGUtR2VuZXJhbCBmb3IgRGlnaXRhbCBTZXJ2aWNlcyAoRElHSVQpMSMwIQYDVQRhDBpMRUlYRy0yNTQ5MDBaTllBMUZMVVE5VTM5MzEcMBoGA1UECgwTRVVST1BFQU4gQ09NTUlTU0lPTjElMCMGCSqGSIb3DQEJARYWZGlnaXQtZG1vQGVjLmV1cm9wYS5ldTEcMBoGA1UEAwwTRVVST1BFQU4gQ09NTUlTU0lPTjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKWYeBA9kYARElGnHoJRNpbby44G+TSJcgHI9QtyXlYjB234hSAYyJvW+gKvoownskrogfUP6GOmQgEFZX335Y0sBwfppVemEoe9H9Aj/cpT14IqdB05V4a88ASRfR0Va1xmQJrDsBZWqZHx0EEHBctIF5BjyTMAcQybha+4AOIotp3dF/7ZA3Cu4GYbN9BuQyyqfqrjMduDzzDjVwKC17aEsLev60C1FnIJ/FVEda3lJSGilD5JyUceTaRcot1rw6gjKrOVhwP/UHfevJ3JCsQsuAzkf7ivzHzYuPPPR9Ussecwr7O95Fr4wbPYIyX2AOTlieAC7GMVXHN1/+4LH74ndvoJYEScXwmN9Skib3+G6TquOCQxvNXzHPZb95btCoSnVprCn14O3CXUTZMEKkhPuKW8dI6pR2JSGbtT+xBkcc1wYVlUnzE3d+YK5SSevUT2COwJM+AcjSoUaRTBINsD/ezDDvv7vtbF1XccaJjoCNkurzayTsMszGDvAF171LY69lNY6yK0uzrS+3c/hEHctXa5KIC3PpWrBGQ5mw73KerRvnAhzDZemVquPk1D59aJNfHoHXmy1bS52rHWYOwHH+2qbODdh8GkHwHXBzSpFit1Kg2brpavhztNaGlj6GsLFAbr8okCUJllOOLQ8Tfy9Vnn5Rq0+7VTdd8dAxg9AgMBAAGjggKaMIICljAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFHNJ8UAcFAR8mhJ/+i/NXGcjGOkUMIGGBggrBgEFBQcBAQR6MHgwRgYIKwYBBQUHMAKGOmh0dHBzOi8vcWNhLWcxLmRpZ2l0YWxzaWduLnB0L0RJR0lUQUxTSUdOUVVBTElGSUVEQ0FHMS5wN2IwLgYIKwYBBQUHMAGGImh0dHBzOi8vcWNhLWcxLmRpZ2l0YWxzaWduLnB0L29jc3AwIQYDVR0RBBowGIEWZGlnaXQtZG1vQGVjLmV1cm9wYS5ldTBfBgNVHSAEWDBWMDcGCysGAQQBgcd8BAEBMCgwJgYIKwYBBQUHAgEWGmh0dHBzOi8vcGtpLmRpZ2l0YWxzaWduLnB0MBAGDisGAQQBgcd8BAIBAQEGMAkGBwQAi+xAAQMwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMIG8BggrBgEFBQcBAwSBrzCBrDAVBggrBgEFBQcLAjAJBgcEAIvsSQECMAgGBgQAjkYBATAIBgYEAI5GAQQwEwYGBACORgEGMAkGBwQAjkYBBgIwagYGBACORgEFMGAwLhYoaHR0cHM6Ly9xY2EtZzEuZGlnaXRhbHNpZ24ucHQvUERTX2VuLnBkZhMCZW4wLhYoaHR0cHM6Ly9xY2EtZzEuZGlnaXRhbHNpZ24ucHQvUERTX3B0LnBkZhMCcHQwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cHM6Ly9xY2EtZzEuZGlnaXRhbHNpZ24ucHQvRElHSVRBTFNJR05RVUFMSUZJRURDQUcxLmNybDAdBgNVHQ4EFgQUlO5hwcl9/63issm59r+TIHeJSZwwDgYDVR0PAQH/BAQDAgZAMA0GCSqGSIb3DQEBDQUAA4ICAQCn8qjJhTe3SsD7cB8S8kDzt+CBnJJm7bOFc9t9IU6iKntVtjPU4T+cYiPk8TnT+/w7dBphRzjZCL1sDfSJGQ5JPBw+hBPuvzEqP4xVi5i4Jhg/GpYSaa2+dkFXlKe6Sd+ii/RnwBSnfqVfNZtasj7yX+oujGau5LSUPIkQxDrMie8KjsNtlkFjQDoioGAx8b0u6WyhAuqwEacCznft20Dim3sC7XJw8GHumrnW52rUzl4sbXoTBAt8F1zPCbEbjU0oc8SbFNPIChh+9sHUorEmHIlcg30LBHihkDCx4mK8J60Jybk57D4U2RO29VsJfDmnvNxfJZxfLHEJ2tkh+AMqlJXPDlvXQ+rZ1NmLHrbXkcHOlqR3F8BakTi2Mi5AZZfkfjZjkigEStN6Enaq6gwF7EsslqEKmhSQ8XlhxWSRqljK/cnEUw+NhrvR4WuKlvYmxlCLQj6q89Hh121aUGUhL2L2WCVBjVXqux7s4mvECDzrucl5ilaVT32HO3g8qNLGD5lum53U5v/Nv68ItyHH96unztwBebmgox8giVRdzPhmPrpSfbmeNNDKj1p9SCeOvd3P9jCUvChVvH2P2ZUjc24tWe+tzclsCJi7GbKr6kjHc1jFudjehflAbm1IZAYdDNrhXamnsRVsz7iSH20eygCArlwSQ//WIQZPFrRffg==",
+		subject: "C=LU, OU=Certificate Profile - Qualified Certificate - Organization, OU=Directorate-General for Digital Services (DIGIT), 2.5.4.97=LEIXG-254900ZNYA1FLUQ9U393, O=EUROPEAN COMMISSION, E=digit-dmo@ec.europa.eu, CN=EUROPEAN COMMISSION",
+		fingerprintSha256: "e0a620fbb6747362bb933ac44169d676a553444716cf5f31605f12a22b8396b1",
+		notAfter: "2027-11-17T10:11:46.000Z"
+	}
+];
+/** Where this set came from, so the pin can be audited without re-running the script. */
+const EU_LOTL_ANCHORS_PROVENANCE = {
+	/** The list the certificates were read from. */
+	source: "https://ec.europa.eu/tools/lotl/eu-lotl.xml",
+	/** The Official Journal act the LOTL itself references for its signers. */
+	officialJournal: "https://eur-lex.europa.eu/eli/C/2026/1944/oj",
+	/** `TSLSequenceNumber` of that list. */
+	tslSequenceNumber: 390,
+	/** `ListIssueDateTime` of that list. */
+	listIssueDateTime: "2026-08-03T13:16:38Z",
+	/** Earliest expiry in the set: refresh before this date. */
+	earliestNotAfter: "2027-04-26T12:49:22.000Z"
+};
+//#endregion
+//#region src/trusted-list-exception.ts
+/**
+* Base exception for all trusted-list processing failures.
+*/
+var TrustedListException = class extends Error {
+	constructor(message, options) {
+		super(message);
+		this.name = "TrustedListException";
+		this.cause = options?.cause;
+	}
+};
+/**
+* The XML could not be parsed as an ETSI TS 119 612 `TrustServiceStatusList`.
+*/
+var TrustedListParseException = class extends TrustedListException {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "TrustedListParseException";
+	}
+};
+/**
+* The trusted list's own XAdES/XMLDSig signature is missing, invalid, or does
+* not match a configured trust anchor. Callers MUST treat this as fail-closed:
+* a trusted list whose authenticity cannot be established must not be used to
+* trust credentials.
+*/
+var TrustedListSignatureException = class extends TrustedListException {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "TrustedListSignatureException";
+	}
+};
+//#endregion
+//#region src/types.ts
+/**
+* A service's digital identity (TS 119 612 `ServiceDigitalIdentity`): the
+* `DigitalId` children (X509Certificate, X509SubjectName, X509SKI) that describe
+* one entity are merged here. A standard list may identify a service by subject
+* name and/or key identifier without embedding the full certificate.
+*/
+const DigitalIdentitySchema = z.object({
+	/** base64-encoded DER of the certificate, when embedded (`X509Certificate`). */
+	certificate: z.string().optional(),
+	/** `X509SubjectName`, when present. */
+	subjectName: z.string().optional(),
+	/**
+	* Lowercase-hex SubjectKeyIdentifier — derived from the certificate when one
+	* is embedded, otherwise from the `X509SKI` element. This is the value a
+	* verifier sends to a wallet as an `aki` trusted authority (HAIP).
+	*/
+	subjectKeyIdentifier: z.string().optional()
+});
+/** A past status entry for a service (`ServiceHistoryInstance`). */
+const ServiceHistoryInstanceSchema = z.object({
+	serviceTypeIdentifier: z.string().optional(),
+	serviceStatus: z.string(),
+	statusStartingTime: z.string().optional()
+});
+/**
+* A trust service (TSPService) entry: its type, status, digital identities,
+* qualifiers, and status history.
+*/
+const TrustedListServiceSchema = z.object({
+	/** `ServiceTypeIdentifier` URI. */
+	serviceTypeIdentifier: z.string(),
+	/** Current `ServiceStatus` URI. */
+	serviceStatus: z.string(),
+	/** Human-readable service name, if present. */
+	serviceName: z.string().optional(),
+	/** One entry per `ServiceDigitalIdentity`. */
+	digitalIdentities: z.array(DigitalIdentitySchema),
+	/** Qualifier URIs from `Qualifications/QualificationElement/Qualifiers`. */
+	qualifiers: z.array(z.string()).optional(),
+	/** Prior status entries from `ServiceHistory`. */
+	history: z.array(ServiceHistoryInstanceSchema).optional()
+});
+/** A Trust Service Provider (TSP) and the services it operates. */
+const TrustServiceProviderSchema = z.object({
+	name: z.string().optional(),
+	services: z.array(TrustedListServiceSchema)
+});
+/** A pointer to another trusted list (`OtherTSLPointer`), e.g. the EU LOTL. */
+const TrustedListPointerSchema = z.object({
+	/** `TSLLocation` URL. */
+	location: z.string(),
+	/** Pointed-to list `TSLType`, when advertised. */
+	tslType: z.string().optional(),
+	/** `SchemeTerritory` (country code), when advertised. */
+	schemeTerritory: z.string().optional(),
+	/**
+	* The pointer's `ServiceDigitalIdentities`: the certificates with which the
+	* pointed-to list is signed. This is how a list distributes the trust anchors
+	* of the lists it points to — the EU LOTL carries, for every national list,
+	* the certificate(s) of its scheme operator, so a verifier that trusts the
+	* LOTL does not need to pin each national list separately.
+	*/
+	digitalIdentities: z.array(DigitalIdentitySchema).default([])
+});
+/** A parsed ETSI TS 119 612 Trusted List (`TrustServiceStatusList`). */
+const TrustedListSchema = z.object({
+	/** `TSLType` URI. */
+	tslType: z.string().optional(),
+	/** `SchemeOperatorName` (English name when available). */
+	schemeOperatorName: z.string().optional(),
+	/** `TSLSequenceNumber`. */
+	sequenceNumber: z.number().optional(),
+	/** `ListIssueDateTime` (ISO 8601). */
+	listIssueDateTime: z.string().optional(),
+	/** `NextUpdate` (ISO 8601), when present. */
+	nextUpdate: z.string().optional(),
+	providers: z.array(TrustServiceProviderSchema),
+	/** `PointersToOtherTSL` entries (e.g. the EU LOTL). Not followed by v1. */
+	pointersToOtherLists: z.array(TrustedListPointerSchema).optional()
+});
+/**
+* A flattened trust anchor: one digital identity with the service context it was
+* published under. The normalized unit both certificate-chain validation and AKI
+* emission consume — the ETSI TS 119 612 counterpart of a `@owf/eudi-lote`
+* TrustedEntity service certificate.
+*/
+const TrustAnchorSchema = z.object({
+	/** base64 DER certificate, when the identity embeds one. */
+	certificate: z.string().optional(),
+	subjectName: z.string().optional(),
+	subjectKeyIdentifier: z.string().optional(),
+	serviceTypeIdentifier: z.string(),
+	serviceStatus: z.string(),
+	providerName: z.string().optional()
+});
+//#endregion
+//#region src/validate.ts
+function fromZodError(error) {
+	return error.issues.map((issue) => ({
+		path: issue.path.map((p) => String(p)).join("."),
+		message: issue.message
+	}));
+}
+/**
+* Structurally validate an object against the ETSI TS 119 612 trusted-list
+* schema (the same zod-based approach `@owf/eudi-lote` uses for TS 119 602).
+* For XML input, parse it first with `parseTrustedList` (XML → object), then
+* validate the object here.
+*/
+function validateTrustedList(value) {
+	const result = TrustedListSchema.safeParse(value);
+	return result.success ? {
+		valid: true,
+		errors: []
+	} : {
+		valid: false,
+		errors: fromZodError(result.error)
+	};
+}
+/**
+* Structurally validate and return the typed trusted list, throwing
+* {@link TrustedListParseException} when it does not conform to the schema.
+*/
+function assertValidTrustedList(value) {
+	const result = TrustedListSchema.safeParse(value);
+	if (!result.success) throw new TrustedListParseException(`Invalid trusted list: ${fromZodError(result.error).map((e) => `${e.path}: ${e.message}`).join("; ")}`);
+	return result.data;
+}
+/**
+* Compare ETSI URIs scheme-insensitively: deployed lists have published the
+* same URI over both `http` and `https`. Internal helper, not part of the
+* package's public API.
+*/
+const stripScheme = (uri) => (uri ?? "").replace(/^https?:\/\//, "");
+function profileErrors(trustedList, rule) {
+	const label = rule.name ?? "profile";
+	const errors = [];
+	if (stripScheme(trustedList.tslType) !== stripScheme(rule.tslType)) errors.push({
+		path: "tslType",
+		message: `[${label}] expected TSLType ${rule.tslType}, got ${trustedList.tslType ?? "none"}`
+	});
+	const allowedTypes = new Set(rule.serviceTypes.map(stripScheme));
+	const allowedStatuses = new Set(rule.serviceStatuses.map(stripScheme));
+	trustedList.providers.forEach((provider, pi) => {
+		provider.services.forEach((service, si) => {
+			if (!allowedTypes.has(stripScheme(service.serviceTypeIdentifier))) errors.push({
+				path: `providers.${pi}.services.${si}.serviceTypeIdentifier`,
+				message: `[${label}] unexpected service type ${service.serviceTypeIdentifier}`
+			});
+			if (!allowedStatuses.has(stripScheme(service.serviceStatus))) errors.push({
+				path: `providers.${pi}.services.${si}.serviceStatus`,
+				message: `[${label}] unexpected service status ${service.serviceStatus}`
+			});
+		});
+	});
+	return errors;
+}
+/**
+* Validate that a trusted list conforms to one (or any, given several) of the
+* supplied profile rules — structural schema first, then profile-specific
+* constraints. Mirrors `@owf/eudi-lote`'s profile validation.
+*/
+function validateTrustedListProfile(value, rule) {
+	const structural = validateTrustedList(value);
+	if (!structural.valid) return structural;
+	const trustedList = value;
+	const perRule = (Array.isArray(rule) ? rule : [rule]).map((r) => profileErrors(trustedList, r));
+	if (perRule.some((errors) => errors.length === 0)) return {
+		valid: true,
+		errors: []
+	};
+	return {
+		valid: false,
+		errors: perRule.flat()
+	};
+}
+//#endregion
+//#region src/parse.ts
+const TSL_NS = "http://uri.etsi.org/02231/v2#";
+const SIE_NS = "http://uri.etsi.org/TrstSvc/SvcInfoExt/eSigDir-1999-93-EC-TrustedList/#";
+function descendants(el, name, ns = TSL_NS) {
+	return Array.from(el.getElementsByTagNameNS(ns, name));
+}
+function firstDescendant(el, name, ns = TSL_NS) {
+	return descendants(el, name, ns)[0];
+}
+function textOf(el) {
+	const t = el?.textContent?.trim();
+	return t ? t : void 0;
+}
+/**
+* Localized `Name`: prefer the English entry, else the first, searched only
+* among the direct `Name` children of the given parent.
+*/
+function localizedName(parent) {
+	if (!parent) return void 0;
+	const names = Array.from(parent.childNodes).filter((n) => n.namespaceURI === TSL_NS && n.localName === "Name");
+	if (names.length === 0) return void 0;
+	return textOf(names.find((n) => n.getAttribute("xml:lang") === "en") ?? names[0]);
+}
+/** Lowercase-hex SubjectKeyIdentifier from a certificate, best-effort. */
+function skiFromCertificate(certBase64) {
+	try {
+		const ext = new X509Certificate(certBase64).getExtension(SubjectKeyIdentifierExtension);
+		if (ext?.keyId) return ext.keyId.toLowerCase();
+	} catch {}
+}
+/**
+* One {@link DigitalIdentity} per `ServiceDigitalIdentity`, merging its
+* `DigitalId` children (X509Certificate / X509SubjectName / X509SKI) — a
+* standard list may identify a service without embedding the full certificate.
+*/
+function parseDigitalIdentities(container) {
+	const identities = [];
+	for (const sdi of descendants(container, "ServiceDigitalIdentity")) {
+		let certificate;
+		let subjectName;
+		let x509SkiHex;
+		for (const digitalId of descendants(sdi, "DigitalId")) {
+			certificate ??= textOf(firstDescendant(digitalId, "X509Certificate"))?.replace(/\s/g, "");
+			subjectName ??= textOf(firstDescendant(digitalId, "X509SubjectName"));
+			const ski = textOf(firstDescendant(digitalId, "X509SKI"));
+			if (ski && !x509SkiHex) x509SkiHex = hexEncode(base64.decode(ski.replace(/\s/g, "")));
+		}
+		if (!certificate && !subjectName && !x509SkiHex) continue;
+		identities.push({
+			certificate,
+			subjectName,
+			subjectKeyIdentifier: certificate ? skiFromCertificate(certificate) ?? x509SkiHex : x509SkiHex
+		});
+	}
+	return identities;
+}
+function parseQualifiers(serviceInfo) {
+	const uris = descendants(serviceInfo, "Qualifier", SIE_NS).map((q) => q.getAttribute("uri") ?? "").filter((u) => u.length > 0);
+	return uris.length > 0 ? uris : void 0;
+}
+function parseHistory(service) {
+	const history = [];
+	for (const instance of descendants(service, "ServiceHistoryInstance")) {
+		const serviceStatus = textOf(firstDescendant(instance, "ServiceStatus"));
+		if (!serviceStatus) continue;
+		history.push({
+			serviceTypeIdentifier: textOf(firstDescendant(instance, "ServiceTypeIdentifier")),
+			serviceStatus,
+			statusStartingTime: textOf(firstDescendant(instance, "StatusStartingTime"))
+		});
+	}
+	return history.length > 0 ? history : void 0;
+}
+function parsePointers(schemeInfo) {
+	const pointers = [];
+	for (const pointer of descendants(schemeInfo, "OtherTSLPointer")) {
+		const location = textOf(firstDescendant(pointer, "TSLLocation"));
+		if (!location) continue;
+		pointers.push({
+			location,
+			tslType: textOf(firstDescendant(pointer, "TSLType")),
+			schemeTerritory: textOf(firstDescendant(pointer, "SchemeTerritory")),
+			digitalIdentities: parseDigitalIdentities(pointer)
+		});
+	}
+	return pointers.length > 0 ? pointers : void 0;
+}
+/**
+* Parse an ETSI TS 119 612 `TrustServiceStatusList` XML into a normalized
+* {@link TrustedList}. This does NOT verify the list signature — call
+* {@link verifyTrustedListSignature} first (or use {@link loadTrustedList}).
+*/
+function parseTrustedList(xml) {
+	const root = new DOMParser().parseFromString(xml, "application/xml").documentElement;
+	if (root?.localName !== "TrustServiceStatusList") throw new TrustedListParseException("Root element is not a TS 119 612 TrustServiceStatusList");
+	const schemeInfo = firstDescendant(root, "SchemeInformation");
+	const sequenceText = textOf(schemeInfo && firstDescendant(schemeInfo, "TSLSequenceNumber"));
+	const nextUpdate = schemeInfo && firstDescendant(schemeInfo, "NextUpdate");
+	const providers = [];
+	for (const tsp of descendants(root, "TrustServiceProvider")) {
+		const services = [];
+		for (const service of descendants(tsp, "TSPService")) {
+			const info = firstDescendant(service, "ServiceInformation");
+			if (!info) continue;
+			const serviceTypeIdentifier = textOf(firstDescendant(info, "ServiceTypeIdentifier"));
+			const serviceStatus = textOf(firstDescendant(info, "ServiceStatus"));
+			if (!serviceTypeIdentifier || !serviceStatus) continue;
+			services.push({
+				serviceTypeIdentifier,
+				serviceStatus,
+				serviceName: localizedName(firstDescendant(info, "ServiceName")),
+				digitalIdentities: parseDigitalIdentities(info),
+				qualifiers: parseQualifiers(info),
+				history: parseHistory(service)
+			});
+		}
+		providers.push({
+			name: localizedName(firstDescendant(tsp, "TSPName")),
+			services
+		});
+	}
+	return assertValidTrustedList({
+		tslType: textOf(schemeInfo && firstDescendant(schemeInfo, "TSLType")),
+		schemeOperatorName: localizedName(schemeInfo && firstDescendant(schemeInfo, "SchemeOperatorName")),
+		sequenceNumber: sequenceText ? Number(sequenceText) : void 0,
+		listIssueDateTime: textOf(schemeInfo && firstDescendant(schemeInfo, "ListIssueDateTime")),
+		nextUpdate: textOf(nextUpdate && firstDescendant(nextUpdate, "dateTime")),
+		providers,
+		pointersToOtherLists: schemeInfo ? parsePointers(schemeInfo) : void 0
+	});
+}
+/**
+* The DER-encoded certificates a list publishes for the lists it points to —
+* i.e. the trust anchors with which those lists are signed, ready to be passed
+* as `trustAnchors` to `verifyTrustedListSignature`.
+*
+* This is the mechanism by which a trusted list distributes trust downwards: a
+* verifier that has established trust in one list (for the EU LOTL, by pinning
+* its signing certificates out of band) obtains the anchors of every list it
+* points to without pinning them individually.
+*
+* ```ts
+* const lotl = await loadTrustedList(lotlXml, { trustAnchors: getEuLotlTrustAnchors() })
+* const esAnchors = getPointerSigningCertificates(lotl, { schemeTerritory: 'ES' })
+* const esList = await loadTrustedList(esXml, { trustAnchors: esAnchors })
+* ```
+*
+* Passing `{ tslType: TSLType.EUlistofthelists }` returns the LOTL's own
+* currently published signing certificates (from its self-pointer), which is
+* how a deployment refreshes its pinned set as the scheme operator rotates keys.
+*/
+function getPointerSigningCertificates(trustedList, filter = {}) {
+	const certificates = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const pointer of trustedList.pointersToOtherLists ?? []) {
+		if (filter.location && pointer.location !== filter.location) continue;
+		if (filter.schemeTerritory && pointer.schemeTerritory?.toUpperCase() !== filter.schemeTerritory.toUpperCase()) continue;
+		if (filter.tslType && stripScheme(pointer.tslType) !== stripScheme(filter.tslType)) continue;
+		for (const identity of pointer.digitalIdentities) {
+			if (!identity.certificate || seen.has(identity.certificate)) continue;
+			seen.add(identity.certificate);
+			certificates.push(base64.decode(identity.certificate));
+		}
+	}
+	return certificates;
+}
+/**
+* Flatten a {@link TrustedList} into individual {@link TrustAnchor} entries —
+* the normalized unit consumed by certificate-chain validation and AKI
+* emission.
+*/
+function getTrustAnchors(trustedList, filter = {}) {
+	const anchors = [];
+	for (const provider of trustedList.providers) for (const service of provider.services) {
+		if (filter.serviceStatus && !filter.serviceStatus.includes(service.serviceStatus)) continue;
+		if (filter.serviceTypeIdentifier && !filter.serviceTypeIdentifier.includes(service.serviceTypeIdentifier)) continue;
+		for (const identity of service.digitalIdentities) {
+			if (filter.requireCertificate && !identity.certificate) continue;
+			anchors.push({
+				certificate: identity.certificate,
+				subjectName: identity.subjectName,
+				subjectKeyIdentifier: identity.subjectKeyIdentifier,
+				serviceTypeIdentifier: service.serviceTypeIdentifier,
+				serviceStatus: service.serviceStatus,
+				providerName: provider.name
+			});
+		}
+	}
+	return anchors;
+}
+//#endregion
+//#region src/profiles.ts
+/** Every standard TS 119 612 service status (clause 5.5.4). */
+const ALL_SERVICE_STATUSES = Object.values(ServiceStatus);
+/** The standard qualified `ServiceTypeIdentifier` values (Annex D). */
+const QUALIFIED_SERVICE_TYPES = Object.values(ServiceType);
+/**
+* Ready-made {@link ProfileRule}s for common ETSI ecosystems, so callers don't
+* have to hand-write the URIs. The engine ({@link validateTrustedListProfile})
+* stays profile-agnostic; these are just convenience constants you pass into it.
+*
+* A profile is an allowlist: the structural schema is checked first, then the
+* list's `TSLType` must match and every service's type/status must be permitted.
+* That fits homogeneous, curated lists well (e.g. Age Verification). For a full
+* eIDAS national list — which legitimately carries withdrawn/ceased services and
+* a broad mix of qualified service types — {@link euGeneric} therefore permits
+* all standard ETSI statuses and qualified service types: it asserts "this is a
+* well-formed EU generic list using standard ETSI URIs", not "only currently
+* active CAs". Narrow further with your own {@link ProfileRule} when you need to.
+*/
+const TrustedListProfiles = {
+	/**
+	* EU List of Trusted Lists (LOTL). Its `TSLType` is `EUlistofthelists` and it
+	* carries pointers to national lists rather than trust-service providers, so
+	* no service type/status is permitted (a conforming LOTL has no TSP services).
+	*/
+	euLotl: {
+		name: "eu-lotl",
+		tslType: TSLType.EUlistofthelists,
+		serviceTypes: [],
+		serviceStatuses: []
+	},
+	/**
+	* A generic EU (eIDAS national) trusted list: `TSLType` `EUgeneric`, any
+	* standard qualified service type, any standard service status (including
+	* withdrawn/ceased entries that national lists retain for history).
+	*/
+	euGeneric: {
+		name: "eu-generic",
+		tslType: TSLType.EUgeneric,
+		serviceTypes: QUALIFIED_SERVICE_TYPES,
+		serviceStatuses: ALL_SERVICE_STATUSES
+	},
+	/**
+	* EU Age Verification trusted list, per the European Commission's "AV Trusted
+	* List Specifications" (DIGIT.B.3). The `TSLType` (clause 5.3.3), the single
+	* Proof of Age Attestation service type (`paa`, clause 5.5.1) and the two
+	* permitted service statuses (clause 5.5.4) are fixed by that specification —
+	* which states the statuses "may be used to the exclusion of any other", so
+	* the allowlist model captures the AV profile exactly. Deployed lists have
+	* used `https` for the `TSLType`; the profile compares scheme-insensitively.
+	*/
+	ageVerification: {
+		name: "eu-age-verification",
+		tslType: "http://trust.tech.ec.europa.eu/lists/age-verification/tsl-type",
+		serviceTypes: ["http://trust.tech.ec.europa.eu/lists/age-verification/service-type/paa"],
+		serviceStatuses: ["http://trust.tech.ec.europa.eu/lists/age-verification/service-status/recognized", "http://trust.tech.ec.europa.eu/lists/age-verification/service-status/deprecated"]
+	}
+};
+//#endregion
+//#region src/verify.ts
+const XMLDSIG_NS = "http://www.w3.org/2000/09/xmldsig#";
+let nodeDependenciesInitialized = false;
+let installedCrypto;
+/**
+* Outside the browser, xml-core resolves DOM/XPath implementations through
+* `setNodeDependencies`. Set lazily and once, so importing this package has no
+* side effects until a signature is actually processed.
+*/
+function ensureNodeDependencies() {
+	if (nodeDependenciesInitialized) return;
+	xadesjs.setNodeDependencies({
+		DOMParser,
+		XMLSerializer,
+		xpath
+	});
+	nodeDependenciesInitialized = true;
+}
+/**
+* Install the WebCrypto implementation used to verify trusted list signatures
+* ("bring your own crypto"), for callers that must route verification through a
+* reviewed or policy-constrained engine. Call it once during start-up, before
+* verifying; without it, the global Web Crypto API (`globalThis.crypto`,
+* available in Node >= 20 and browsers) is used.
+*
+* Process-wide by necessity, not by design: xadesjs exposes a single global
+* crypto engine rather than a per-call context
+* (see {@link https://github.com/PeculiarVentures/xmldsigjs/issues/119}).
+* A per-invocation option would look isolated while still swapping that global,
+* so concurrent verifications with different engines would race; it is
+* deliberately not offered. Should upstream gain per-call crypto, accepting it
+* as a verification option is an additive, non-breaking change.
+*/
+function setTrustedListCrypto(crypto) {
+	ensureNodeDependencies();
+	xadesjs.Application.setEngine("eudi-tl", crypto);
+	installedCrypto = crypto;
+}
+/**
+* Make sure a crypto engine is installed before verifying. A caller-installed
+* engine is never replaced — falling back to `globalThis.crypto` on every call
+* that does not opt in would silently undo {@link setTrustedListCrypto}.
+*/
+function ensureXmlSignatureEngine() {
+	ensureNodeDependencies();
+	if (!installedCrypto) setTrustedListCrypto(globalThis.crypto);
+}
+/**
+* Verify the enveloped XAdES/XMLDSig signature of an ETSI TS 119 612 Trusted
+* List. Throws {@link TrustedListSignatureException} when the signature is
+* missing, invalid, or (with `trustAnchors`) not signed by a pinned scheme
+* operator.
+*
+* Verified against a standard eIDAS national trusted list (RSA-SHA512,
+* exclusive C14N, XAdES SignedProperties).
+*
+* Verification runs on the global Web Crypto API unless another implementation
+* was installed with {@link setTrustedListCrypto}.
+*/
+async function verifyTrustedListSignature(xml, options = {}) {
+	ensureXmlSignatureEngine();
+	const doc = new DOMParser().parseFromString(xml, "application/xml");
+	const signatures = doc.getElementsByTagNameNS(XMLDSIG_NS, "Signature");
+	if (signatures.length === 0) throw new TrustedListSignatureException("No ds:Signature found in the trusted list");
+	const signedXml = new xadesjs.SignedXml(doc);
+	signedXml.LoadXml(signatures[0]);
+	let valid;
+	try {
+		valid = await signedXml.Verify();
+	} catch (error) {
+		throw new TrustedListSignatureException(`Trusted list signature could not be verified: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+	}
+	if (!valid) throw new TrustedListSignatureException("Trusted list signature is invalid");
+	const signerCertEl = signatures[0].getElementsByTagNameNS(XMLDSIG_NS, "X509Certificate")[0];
+	if (!signerCertEl?.textContent) throw new TrustedListSignatureException("Trusted list signature has no X509Certificate in KeyInfo");
+	const signerCertificateBase64 = signerCertEl.textContent.replace(/\s/g, "");
+	if (options.trustAnchors && options.trustAnchors.length > 0) {
+		const signerDer = base64.decode(signerCertificateBase64);
+		if (!options.trustAnchors.some((anchor) => compareBytes(anchor, signerDer))) throw new TrustedListSignatureException("Trusted list signer certificate is not among the configured trust anchors");
+	}
+	return { signerCertificateBase64 };
+}
+//#endregion
+//#region src/eu-lotl.ts
+/**
+* The LOTL signing certificates shipped with this package, as DER bytes ready
+* to pass as `trustAnchors`.
+*
+* This pinned set is the root of the eIDAS trusted-list hierarchy and cannot be
+* bootstrapped from the LOTL itself — a forged list would carry a forged
+* self-pointer. It is published by the European Commission in the Official
+* Journal; see {@link EU_LOTL_ANCHORS_PROVENANCE} for the exact act, list issue
+* and expiry of the shipped set.
+*
+* Certificates rotate (historically every 6–24 months), so a deployment has
+* three ways to stay current without waiting for a release of this package:
+*
+* 1. pass its own `trustAnchors`, e.g. from configuration;
+* 2. after verifying a LOTL, read the currently published set from its own
+*    self-pointer with `getPointerSigningCertificates(lotl, { tslType:
+*    TSLType.EUlistofthelists })` and persist it — rotation is announced in a
+*    list still signed by the previous generation of keys;
+* 3. follow the pivot LOTLs advertised in the list's `SchemeInformationURI`
+*    when the pinned set has fallen behind entirely.
+*/
+function getEuLotlTrustAnchors() {
+	return EU_LOTL_SIGNING_CERTIFICATES.map((entry) => base64.decode(entry.certificate));
+}
+/**
+* Verify the signature of the EU List of Trusted Lists against the shipped
+* signing certificates. Identical to {@link verifyTrustedListSignature} except
+* that `trustAnchors` defaults to {@link getEuLotlTrustAnchors} instead of to
+* "integrity only" — pass your own to override.
+*/
+function verifyEuLotlSignature(xml, options = {}) {
+	return verifyTrustedListSignature(xml, {
+		...options,
+		trustAnchors: options.trustAnchors ?? getEuLotlTrustAnchors()
+	});
+}
+/**
+* Verify, parse and profile-check the EU List of Trusted Lists in one step: the
+* safe entry point for the top of the hierarchy. The returned list carries the
+* `PointersToOtherTSL` entries from which national list anchors are derived
+* with `getPointerSigningCertificates`.
+*/
+async function loadEuLotl(xml, options = {}) {
+	await verifyEuLotlSignature(xml, options);
+	const lotl = parseTrustedList(xml);
+	const profile = validateTrustedListProfile(lotl, TrustedListProfiles.euLotl);
+	if (!profile.valid) throw new TrustedListParseException(`Not a conforming EU List of Trusted Lists: ${profile.errors.map((error) => `${error.path}: ${error.message}`).join("; ")}`);
+	return lotl;
+}
+//#endregion
+//#region src/index.ts
+/**
+* Verify the trusted list signature and, only if it is valid, parse it. This is
+* the safe entry point: it never returns a {@link TrustedList} whose
+* authenticity has not been established.
+*/
+async function loadTrustedList(xml, options = {}) {
+	await verifyTrustedListSignature(xml, options);
+	return parseTrustedList(xml);
+}
+//#endregion
+export { ACTIVE_SERVICE_STATUSES, DigitalIdentitySchema, EU_LOTL_ANCHORS_PROVENANCE, EU_LOTL_SIGNING_CERTIFICATES, ServiceHistoryInstanceSchema, ServiceStatus, ServiceType, TSLType, TrustAnchorSchema, TrustServiceProviderSchema, TrustedListException, TrustedListParseException, TrustedListPointerSchema, TrustedListProfiles, TrustedListSchema, TrustedListServiceSchema, TrustedListSignatureException, assertValidTrustedList, getEuLotlTrustAnchors, getPointerSigningCertificates, getTrustAnchors, loadEuLotl, loadTrustedList, parseTrustedList, setTrustedListCrypto, validateTrustedList, validateTrustedListProfile, verifyEuLotlSignature, verifyTrustedListSignature };
+
+//# sourceMappingURL=index.mjs.map