@owf/eudi-wrprc 0.3.1 → 0.3.2-alpha-20260630211531

package/README.md

@@ -5,6 +5,9 @@
 
 Implementation of **ETSI TS 119 475 v1.2.1** - Wallet-Relying Party Registration Certificates (WRPRC) for [Identity Common TypeScript](https://github.com/openwallet-foundation-labs/identity-common-ts).
 
+**Info**
+The `provides_attestations` field in the WRPRC payload is now an array of strings (URIs) instead of an array of Credential objects. This is an upcoming change to the ETSI TS 119 475 standard, and this library has been updated to reflect that change.
+
 ## Overview
 
 This package provides:

package/dist/index.cjs

@@ -493,11 +493,11 @@ var WRPRCBuilder = class {
 		return this;
 	}
 	/**
-	* Add a credential the WRP provides (for attestation providers)
+	* Add a schema metadata that the WRP provides (for attestation providers)
 	*/
-	addProvidedAttestation(credential) {
+	addProvidedAttestation(schemaMetadata) {
 		this.payload.provides_attestations = this.payload.provides_attestations ?? [];
-		this.payload.provides_attestations.push(credential);
+		this.payload.provides_attestations.push(schemaMetadata);
 		return this;
 	}
 	/**

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs","names":["z","IdentityException"],"sources":["../src/entitlements.ts","../src/schemas.ts","../src/wrprc-exception.ts","../src/builders.ts","../src/validator.ts","../src/signer.ts"],"sourcesContent":["/**\n * WRPRC Entitlement Constants\n *\n * Entitlement identifiers as defined in ETSI TS 119 475 Annex A.\n * These identifiers define the roles and capabilities of Wallet-Relying Parties.\n *\n * @see https://www.etsi.org/deliver/etsi_ts/119400_119499/119475/01.02.01_60/ts_119475v010201p.pdf\n */\n\n// ============================================================================\n// OID Base\n// ============================================================================\n\n/**\n * Base OID for ETSI WRPA entitlements: 0.4.0.19475\n * id-etsi-wrpa OBJECT IDENTIFIER ::= { itu-t(0) identified-organization(4) etsi(0) 19475 }\n */\nexport const ETSI_WRPA_BASE_OID = '0.4.0.19475'\n\n/**\n * OID arc for entitlements: 0.4.0.19475.1\n */\nexport const ETSI_WRPA_ENTITLEMENT_ARC = `${ETSI_WRPA_BASE_OID}.1`\n\n// ============================================================================\n// WRP Entitlement URIs (A.2)\n// ============================================================================\n\n/**\n * Service_Provider - General service provider (A.2.1)\n * OID: id-etsi-wrpa-entitlement 1\n */\nexport const ENTITLEMENT_SERVICE_PROVIDER = 'https://uri.etsi.org/19475/Entitlement/Service_Provider'\n\n/**\n * QEAA_Provider - Qualified trust service provider issuing qualified electronic attestations of attributes (A.2.2)\n * OID: id-etsi-wrpa-entitlement 2\n */\nexport const ENTITLEMENT_QEAA_PROVIDER = 'https://uri.etsi.org/19475/Entitlement/QEAA_Provider'\n\n/**\n * Non_Q_EAA_Provider - Trust service provider issuing non-qualified electronic attestations of attributes (A.2.3)\n * OID: id-etsi-wrpa-entitlement 3\n */\nexport const ENTITLEMENT_NON_Q_EAA_PROVIDER = 'https://uri.etsi.org/19475/Entitlement/Non_Q_EAA_Provider'\n\n/**\n * PUB_EAA_Provider - Public sector body or its agent issuing electronic attestations of attributes from authentic sources (A.2.4)\n * OID: id-etsi-wrpa-entitlement 4\n */\nexport const ENTITLEMENT_PUB_EAA_PROVIDER = 'https://uri.etsi.org/19475/Entitlement/PUB_EAA_Provider'\n\n/**\n * PID_Provider - Provider of person identification data (A.2.5)\n * OID: id-etsi-wrpa-entitlement 5\n */\nexport const ENTITLEMENT_PID_PROVIDER = 'https://uri.etsi.org/19475/Entitlement/PID_Provider'\n\n/**\n * QCert_for_ESeal_Provider - QTSP issuing qualified certificates for electronic seals (A.2.6)\n * OID: id-etsi-wrpa-entitlement 6\n */\nexport const ENTITLEMENT_QCERT_FOR_ESEAL_PROVIDER = 'https://uri.etsi.org/19475/Entitlement/QCert_for_ESeal_Provider'\n\n/**\n * QCert_for_ESig_Provider - QTSP issuing qualified certificates for electronic signatures (A.2.7)\n * OID: id-etsi-wrpa-entitlement 7\n */\nexport const ENTITLEMENT_QCERT_FOR_ESIG_PROVIDER = 'https://uri.etsi.org/19475/Entitlement/QCert_for_ESig_Provider'\n\n/**\n * rQSealCDs_Provider - QTSP managing remote qualified electronic seal creation devices (A.2.8)\n * OID: id-etsi-wrpa-entitlement 8\n */\nexport const ENTITLEMENT_RQSEALCDS_PROVIDER = 'https://uri.etsi.org/19475/Entitlement/rQSealCDs_Provider'\n\n/**\n * rQSigCDs_Provider - QTSP managing remote qualified electronic signature creation devices (A.2.9)\n * OID: id-etsi-wrpa-entitlement 9\n */\nexport const ENTITLEMENT_RQSIGCDS_PROVIDER = 'https://uri.etsi.org/19475/Entitlement/rQSigCDs_Provider'\n\n/**\n * ESig_ESeal_Creation_Provider - Non-qualified provider for remote signature/seal creation (A.2.10)\n * OID: id-etsi-wrpa-entitlement 10\n */\nexport const ENTITLEMENT_ESIG_ESEAL_CREATION_PROVIDER =\n  'https://uri.etsi.org/19475/Entitlement/ESig_ESeal_Creation_Provider'\n\n// ============================================================================\n// Entitlement Collection\n// ============================================================================\n\n/**\n * All standard WRP entitlements defined in ETSI TS 119 475\n */\nexport const WRP_ENTITLEMENTS = {\n  SERVICE_PROVIDER: ENTITLEMENT_SERVICE_PROVIDER,\n  QEAA_PROVIDER: ENTITLEMENT_QEAA_PROVIDER,\n  NON_Q_EAA_PROVIDER: ENTITLEMENT_NON_Q_EAA_PROVIDER,\n  PUB_EAA_PROVIDER: ENTITLEMENT_PUB_EAA_PROVIDER,\n  PID_PROVIDER: ENTITLEMENT_PID_PROVIDER,\n  QCERT_FOR_ESEAL_PROVIDER: ENTITLEMENT_QCERT_FOR_ESEAL_PROVIDER,\n  QCERT_FOR_ESIG_PROVIDER: ENTITLEMENT_QCERT_FOR_ESIG_PROVIDER,\n  RQSEALCDS_PROVIDER: ENTITLEMENT_RQSEALCDS_PROVIDER,\n  RQSIGCDS_PROVIDER: ENTITLEMENT_RQSIGCDS_PROVIDER,\n  ESIG_ESEAL_CREATION_PROVIDER: ENTITLEMENT_ESIG_ESEAL_CREATION_PROVIDER,\n} as const\n\n/**\n * List of all standard entitlement URIs\n */\nexport const ALL_ENTITLEMENTS = Object.values(WRP_ENTITLEMENTS)\n\n/**\n * Entitlements for attestation providers (QEAA, Non-Q EAA, PUB EAA, PID)\n */\nexport const ATTESTATION_PROVIDER_ENTITLEMENTS = [\n  ENTITLEMENT_QEAA_PROVIDER,\n  ENTITLEMENT_NON_Q_EAA_PROVIDER,\n  ENTITLEMENT_PUB_EAA_PROVIDER,\n  ENTITLEMENT_PID_PROVIDER,\n] as const\n\n// ============================================================================\n// Service Provider Sub-entitlements (A.3)\n// ============================================================================\n\n/**\n * Payment Service Provider Sub-entitlements (A.3.1)\n * As defined in ETSI TS 119 495\n */\nexport const PSP_SUB_ENTITLEMENTS = {\n  /** Account Servicing Payment Service Provider */\n  ACCOUNT_SERVICING: 'https://uri.etsi.org/19475/SubEntitlement/psp/psp-as',\n  /** Payment Initiation Service Provider */\n  PAYMENT_INITIATION: 'https://uri.etsi.org/19475/SubEntitlement/psp/psp-pi',\n  /** Account Information Service Provider */\n  ACCOUNT_INFORMATION: 'https://uri.etsi.org/19475/SubEntitlement/psp/psp-ai',\n  /** Payment Service Provider issuing card-based payment instruments */\n  CARD_BASED: 'https://uri.etsi.org/19475/SubEntitlement/psp/psp-ic',\n  /** Unspecified Payment Service Provider */\n  UNSPECIFIED: 'https://uri.etsi.org/19475/SubEntitlement/psp/unspecified',\n} as const\n\n/**\n * All PSP sub-entitlement URIs\n */\nexport const ALL_PSP_SUB_ENTITLEMENTS = Object.values(PSP_SUB_ENTITLEMENTS)\n\n// ============================================================================\n// Identifier Type URIs (B.2.5 Class Identifier)\n// ============================================================================\n\n/**\n * Identifier type URIs for legal person semantic identifiers\n */\nexport const IDENTIFIER_TYPES = {\n  /** Economic Operator Registration and Identification Number (EORI-No) */\n  EORI: 'http://data.europa.eu/eudi/id/EORI-No',\n  /** Legal Entity Identifier (LEI) */\n  LEI: 'http://data.europa.eu/eudi/id/LEI',\n  /** European Unique Identifier (EUID) */\n  EUID: 'http://data.europa.eu/eudi/id/EUID',\n  /** Value Added Tax Identification Number (VATIN) */\n  VATIN: 'http://data.europa.eu/eudi/id/VATIN',\n  /** Taxpayer Identification Number (TIN) */\n  TIN: 'http://data.europa.eu/eudi/id/TIN',\n  /** Excise Number */\n  EXCISE: 'http://data.europa.eu/eudi/id/Excise',\n} as const\n\n/**\n * Mapping from identifier type URIs to semantic identifier prefixes\n * as defined in ETSI EN 319 412-1\n */\nexport const IDENTIFIER_TYPE_TO_PREFIX: Record<string, string> = {\n  [IDENTIFIER_TYPES.EORI]: 'EOR',\n  [IDENTIFIER_TYPES.LEI]: 'LEI',\n  [IDENTIFIER_TYPES.EUID]: 'NTR',\n  [IDENTIFIER_TYPES.VATIN]: 'VAT',\n  [IDENTIFIER_TYPES.TIN]: 'TIN',\n  [IDENTIFIER_TYPES.EXCISE]: 'EXC',\n}\n\n// ============================================================================\n// Policy Type URIs (B.2.8 Class Policy)\n// ============================================================================\n\n/**\n * Policy type URIs\n */\nexport const POLICY_TYPES = {\n  /** Privacy Policy */\n  PRIVACY_POLICY: 'http://data.europa.eu/eudi/policy/privacy-policy',\n} as const\n\n// ============================================================================\n// Certificate Policy OIDs (clause 6.1.3)\n// ============================================================================\n\n/**\n * Base OID for WRPRC policies: 0.4.0.19475.3\n */\nexport const WRPRC_POLICY_BASE_OID = `${ETSI_WRPA_BASE_OID}.3`\n\n/**\n * WRPRC Policy OIDs\n */\nexport const WRPRC_POLICIES = {\n  /** WRPRC provider policy identifier */\n  WRPRC_PROVIDER: `${WRPRC_POLICY_BASE_OID}.1`,\n} as const\n\n// ============================================================================\n// Type Guards and Helpers\n// ============================================================================\n\n/**\n * Check if a given URI is a valid WRP entitlement\n */\nexport function isValidEntitlement(uri: string): boolean {\n  return ALL_ENTITLEMENTS.includes(uri as (typeof ALL_ENTITLEMENTS)[number])\n}\n\n/**\n * Check if a given URI is a PSP sub-entitlement\n */\nexport function isPSPSubEntitlement(uri: string): boolean {\n  return ALL_PSP_SUB_ENTITLEMENTS.includes(uri as (typeof ALL_PSP_SUB_ENTITLEMENTS)[number])\n}\n\n/**\n * Check if entitlements include an attestation provider role\n */\nexport function hasAttestationProviderEntitlement(entitlements: string[]): boolean {\n  return entitlements.some((e) =>\n    ATTESTATION_PROVIDER_ENTITLEMENTS.includes(e as (typeof ATTESTATION_PROVIDER_ENTITLEMENTS)[number])\n  )\n}\n\n/**\n * Get the semantic identifier prefix for a given identifier type URI\n */\nexport function getIdentifierPrefix(typeUri: string): string | undefined {\n  return IDENTIFIER_TYPE_TO_PREFIX[typeUri]\n}\n","/**\n * WRPRC Zod Schemas\n *\n * Zod schemas for ETSI TS 119 475 (Wallet-Relying Party Registration Certificates).\n * Types are derived from these schemas via z.infer<>.\n *\n * @see https://www.etsi.org/deliver/etsi_ts/119400_119499/119475/01.02.01_60/ts_119475v010201p.pdf\n */\n\nimport { z } from 'zod'\n\n// ============================================================================\n// Multilingual Value Schemas\n// ============================================================================\n\n/**\n * Multilingual string schema (B.2.6 Class MultiLangString)\n */\nexport const MultiLangStringSchema = z.object({\n  /** Language code per BCP47/RFC 5646 */\n  lang: z.string().min(2),\n  /** Localized string value */\n  content: z.string().min(1),\n})\n\n// ============================================================================\n// Identity Schemas\n// ============================================================================\n\n/**\n * Supervisory Authority schema for Data Protection Authority\n */\nexport const SupervisoryAuthoritySchema = z.object({\n  /** Email address of the Data Protection Authority */\n  email: z.email().optional(),\n  /** Telephone number of the Data Protection Authority */\n  phone: z.string().optional(),\n  /** URL of web form provided by the Data Protection Authority */\n  uri: z.url().optional(),\n})\n\n/**\n * Claim schema for credential attribute specification (B.2.10 Class Claim)\n */\nexport const ClaimSchema = z.object({\n  /** Path pointer that specifies the path to a claim within the Credential */\n  path: z.array(z.string()).min(1),\n  /** Array of expected values of the claim */\n  values: z.array(z.union([z.string(), z.number(), z.boolean()])).optional(),\n})\n\n/**\n * Credential schema for attestations (B.2.9 Class Credential)\n */\nexport const CredentialSchema = z.object({\n  /** Format of the attestation (e.g., \"dc+sd-jwt\", \"mso_mdoc\") */\n  format: z.string().min(1),\n  /** Object defining additional properties per Credential Format */\n  meta: z.record(z.string(), z.unknown()),\n  /** Array of claim objects specifying requestable attributes */\n  claim: z.array(ClaimSchema).optional(),\n})\n\n/**\n * Status list reference for certificate validity\n */\nexport const StatusListSchema = z.object({\n  /** Index in the status list */\n  idx: z.number().int().nonnegative(),\n  /** URI to the status list */\n  uri: z.url(),\n})\n\n/**\n * Status schema for WRPRC validity\n */\nexport const StatusSchema = z.object({\n  status_list: StatusListSchema,\n})\n\n/**\n * Intermediary information when WRP acts through an intermediary\n */\nexport const IntermediarySchema = z.object({\n  /** Identifier of the intermediary */\n  sub: z.string().min(1),\n  /** Name of the intermediary */\n  name: z.string().min(1),\n})\n\n// ============================================================================\n// WRPRC Payload Schema\n// ============================================================================\n\n/**\n * WRPRC Payload schema according to ETSI TS 119 475 clause 5.2.4\n */\nexport const WRPRCPayloadSchema = z.object({\n  /** The subject trade name of the WRPRC (B.2.1 tradeName) */\n  name: z.string().min(1),\n\n  /** Legal name for legal person (B.2.3 legalName) */\n  sub_ln: z.string().optional(),\n\n  /** Given name for natural person (B.2.4 givenName) */\n  sub_gn: z.string().optional(),\n\n  /** Family name for natural person (B.2.4 familyName) */\n  sub_fn: z.string().optional(),\n\n  /** WRP identifier following semantic identifier rules */\n  sub: z.string().min(1),\n\n  /** Country code (ISO 3166-1 Alpha-2) */\n  country: z.string().length(2),\n\n  /** URL pointing to the national registry API endpoint */\n  registry_uri: z.url(),\n\n  /** Descriptions of the services provided by the WRP */\n  srv_description: z.array(z.array(MultiLangStringSchema)).optional(),\n\n  /** List of entitlements assigned to the WRP */\n  entitlements: z.array(z.url()).min(1),\n\n  /** URL to the WRP's privacy policy */\n  privacy_policy: z.url().optional(),\n\n  /** URL general-purpose web address */\n  info_uri: z.url().optional(),\n\n  /** URL or email for data deletion/portability requests */\n  support_uri: z.url().or(z.email()).optional(),\n\n  /** Data Protection Authority supervising the WRP */\n  supervisory_authority: SupervisoryAuthoritySchema.optional(),\n\n  /** Policy identifier as defined in clause 6.1.3 */\n  policy_id: z.array(z.string()).optional(),\n\n  /** URL to the certificate policy and practice statement */\n  certificate_policy: z.url().optional(),\n\n  /** Unix timestamp indicating when the WRPRC was issued */\n  iat: z.number().int().positive(),\n\n  /** Status list for WRPRC validity */\n  status: StatusSchema.optional(),\n\n  /** Purpose of the intended data processing */\n  purpose: z.array(MultiLangStringSchema).optional(),\n\n  /** Set of credentials intended to be requested by the WRP */\n  credentials: z.array(CredentialSchema).optional(),\n\n  /** Set of credentials issued by the WRP (for attestation providers) */\n  provides_attestations: z.array(CredentialSchema).optional(),\n\n  /** Intermediary information when WRP acts through an intermediary */\n  intermediary: IntermediarySchema.optional(),\n})\n\n// ============================================================================\n// WRPRC Header Schemas\n// ============================================================================\n\n/**\n * JWT Header schema according to ETSI TS 119 475 clause 5.2.2\n */\nexport const WRPRCJWTHeaderSchema = z.object({\n  /** Type of the Web Token - must be \"rc-wrp+jwt\" for JWT */\n  typ: z.literal('rc-wrp+jwt'),\n  /** Algorithm used to sign the JWT */\n  alg: z.enum(['ES256', 'ES384', 'ES512', 'RS256', 'RS384', 'RS512']),\n  /** Certificate chain to verify the JWT */\n  x5c: z.array(z.string()).min(1),\n  /** Key ID */\n  kid: z.string().optional(),\n})\n\n/**\n * CWT Header schema according to ETSI TS 119 475 clause 5.2.3\n */\nexport const WRPRCCWTHeaderSchema = z.object({\n  /** Type of the Web Token - must be \"rc-wrp+cwt\" for CWT */\n  typ: z.literal('rc-wrp+cwt'),\n  /** Algorithm used to sign the CWT per RFC 9052 */\n  alg: z.number().int(),\n  /** Certificate chain to verify the CWT per RFC 9360 */\n  x5chain: z.array(z.instanceof(Uint8Array)).min(1),\n})\n\n// ============================================================================\n// Complete WRPRC Document Schemas\n// ============================================================================\n\n/**\n * Complete JWT WRPRC schema\n */\nexport const WRPRCJWTSchema = z.object({\n  header: WRPRCJWTHeaderSchema,\n  payload: WRPRCPayloadSchema,\n})\n\n/**\n * Complete CWT WRPRC schema\n */\nexport const WRPRCCWTSchema = z.object({\n  header: WRPRCCWTHeaderSchema,\n  payload: WRPRCPayloadSchema,\n})\n\n// ============================================================================\n// Legal Person Subject Schema (for validation)\n// ============================================================================\n\n/**\n * Schema for legal person WRPRC subject\n */\nexport const LegalPersonSubjectSchema = WRPRCPayloadSchema.extend({\n  sub_ln: z.string().min(1),\n}).omit({\n  sub_gn: true,\n  sub_fn: true,\n})\n\n/**\n * Schema for natural person WRPRC subject\n */\nexport const NaturalPersonSubjectSchema = WRPRCPayloadSchema.extend({\n  sub_gn: z.string().min(1),\n  sub_fn: z.string().min(1),\n}).omit({\n  sub_ln: true,\n})\n","import { IdentityException } from '@owf/identity-common'\n\n/**\n * WRPRCException is a custom error class for WRPRC-related exceptions.\n */\nexport class WRPRCException extends IdentityException {\n  constructor(message: string, details?: unknown) {\n    super(message, details)\n    Object.setPrototypeOf(this, WRPRCException.prototype)\n    this.name = 'WRPRCException'\n  }\n}\n","/**\n * WRPRC Builders\n *\n * Fluent builders for creating ETSI TS 119 475 Wallet-Relying Party Registration Certificates.\n *\n * @see https://www.etsi.org/deliver/etsi_ts/119400_119499/119475/01.02.01_60/ts_119475v010201p.pdf\n */\n\nimport { ENTITLEMENT_SERVICE_PROVIDER, type WRP_ENTITLEMENTS } from './entitlements'\nimport { WRPRCPayloadSchema } from './schemas'\nimport type {\n  Claim,\n  Credential,\n  Intermediary,\n  LegalPersonWRPRCInput,\n  MultiLangString,\n  NaturalPersonWRPRCInput,\n  Status,\n  SupervisoryAuthority,\n  WRPRCPayload,\n} from './types'\nimport { WRPRCException } from './wrprc-exception'\n\n// ============================================================================\n// Partial Payload Type\n// ============================================================================\n\n/**\n * A partial WRPRC payload used during building\n */\ninterface PartialWRPRCPayload {\n  name?: string\n  sub_ln?: string\n  sub_gn?: string\n  sub_fn?: string\n  sub?: string\n  country?: string\n  registry_uri?: string\n  srv_description?: MultiLangString[][]\n  entitlements?: string[]\n  privacy_policy?: string\n  info_uri?: string\n  support_uri?: string\n  supervisory_authority?: SupervisoryAuthority\n  policy_id?: string[]\n  certificate_policy?: string\n  iat?: number\n  status?: Status\n  purpose?: MultiLangString[]\n  credentials?: Credential[]\n  provides_attestations?: Credential[]\n  intermediary?: Intermediary\n}\n\n// ============================================================================\n// WRPRC Payload Builder\n// ============================================================================\n\n/**\n * Builder for creating WRPRC payloads with a fluent API\n */\nexport class WRPRCBuilder {\n  private payload: PartialWRPRCPayload = {}\n\n  /**\n   * Set the trade name (display name) of the WRP\n   */\n  name(value: string): this {\n    this.payload.name = value\n    return this\n  }\n\n  /**\n   * Set the legal name for a legal person WRP\n   */\n  legalName(value: string): this {\n    this.payload.sub_ln = value\n    return this\n  }\n\n  /**\n   * Set the given name for a natural person WRP\n   */\n  givenName(value: string): this {\n    this.payload.sub_gn = value\n    return this\n  }\n\n  /**\n   * Set the family name for a natural person WRP\n   */\n  familyName(value: string): this {\n    this.payload.sub_fn = value\n    return this\n  }\n\n  /**\n   * Set the WRP identifier (semantic identifier)\n   *\n   * @param identifier - The semantic identifier following ETSI EN 319 412-1\n   *                     Format: PREFIX (3 chars) + COUNTRY (2 chars) + \"-\" + ID\n   *                     Examples: \"LEIXG-529900T8BM49AURSDO55\", \"TINIT-RSSMRA85T10A562S\"\n   */\n  identifier(identifier: string): this {\n    this.payload.sub = identifier\n    return this\n  }\n\n  /**\n   * Set the country code (ISO 3166-1 Alpha-2)\n   */\n  country(code: string): this {\n    this.payload.country = code\n    return this\n  }\n\n  /**\n   * Set the URL to the national registry API endpoint\n   */\n  registryUri(uri: string): this {\n    this.payload.registry_uri = uri\n    return this\n  }\n\n  /**\n   * Add a service description in a specific language\n   */\n  serviceDescription(description: string, lang = 'en'): this {\n    this.payload.srv_description = this.payload.srv_description ?? []\n    // Each service description is an array of localized strings\n    const existing = this.payload.srv_description.find((group) => group.some((d) => d.lang === lang))\n    if (existing) {\n      existing.push({ lang, content: description })\n    } else {\n      this.payload.srv_description.push([{ lang, content: description }])\n    }\n    return this\n  }\n\n  /**\n   * Add multiple service descriptions (one array per service, with multiple languages)\n   */\n  addServiceDescriptions(descriptions: MultiLangString[]): this {\n    this.payload.srv_description = this.payload.srv_description ?? []\n    this.payload.srv_description.push(descriptions)\n    return this\n  }\n\n  /**\n   * Add an entitlement\n   *\n   * @param entitlement - The entitlement URI or key from WRP_ENTITLEMENTS\n   */\n  addEntitlement(entitlement: string | (typeof WRP_ENTITLEMENTS)[keyof typeof WRP_ENTITLEMENTS]): this {\n    this.payload.entitlements = this.payload.entitlements ?? []\n    if (!this.payload.entitlements.includes(entitlement)) {\n      this.payload.entitlements.push(entitlement)\n    }\n    return this\n  }\n\n  /**\n   * Set all entitlements (replaces existing)\n   */\n  entitlements(entitlements: string[]): this {\n    this.payload.entitlements = [...entitlements]\n    return this\n  }\n\n  /**\n   * Set the privacy policy URL\n   */\n  privacyPolicy(uri: string): this {\n    this.payload.privacy_policy = uri\n    return this\n  }\n\n  /**\n   * Set the info URI (general-purpose web address)\n   */\n  infoUri(uri: string): this {\n    this.payload.info_uri = uri\n    return this\n  }\n\n  /**\n   * Set the support URI for data requests\n   */\n  supportUri(uri: string): this {\n    this.payload.support_uri = uri\n    return this\n  }\n\n  /**\n   * Set the supervisory authority (Data Protection Authority)\n   */\n  supervisoryAuthority(authority: SupervisoryAuthority): this {\n    this.payload.supervisory_authority = authority\n    return this\n  }\n\n  /**\n   * Set the policy ID(s)\n   */\n  policyId(ids: string[]): this {\n    this.payload.policy_id = ids\n    return this\n  }\n\n  /**\n   * Set the certificate policy URL\n   */\n  certificatePolicy(uri: string): this {\n    this.payload.certificate_policy = uri\n    return this\n  }\n\n  /**\n   * Set the issued-at timestamp (Unix timestamp)\n   * If not set, will default to current time when building\n   */\n  issuedAt(timestamp: number | Date): this {\n    this.payload.iat = typeof timestamp === 'number' ? timestamp : Math.floor(timestamp.getTime() / 1000)\n    return this\n  }\n\n  /**\n   * Set the status reference for certificate validity\n   */\n  status(status: Status): this {\n    this.payload.status = status\n    return this\n  }\n\n  /**\n   * Add a purpose description\n   */\n  addPurpose(description: string, lang = 'en'): this {\n    this.payload.purpose = this.payload.purpose ?? []\n    this.payload.purpose.push({ lang, content: description })\n    return this\n  }\n\n  /**\n   * Set all purposes (replaces existing)\n   */\n  purposes(purposes: MultiLangString[]): this {\n    this.payload.purpose = purposes\n    return this\n  }\n\n  /**\n   * Add a credential that the WRP intends to request\n   */\n  addCredential(credential: Credential): this {\n    this.payload.credentials = this.payload.credentials ?? []\n    this.payload.credentials.push(credential)\n    return this\n  }\n\n  /**\n   * Add a credential the WRP provides (for attestation providers)\n   */\n  addProvidedAttestation(credential: Credential): this {\n    this.payload.provides_attestations = this.payload.provides_attestations ?? []\n    this.payload.provides_attestations.push(credential)\n    return this\n  }\n\n  /**\n   * Set intermediary information\n   */\n  intermediary(intermediary: Intermediary): this {\n    this.payload.intermediary = intermediary\n    return this\n  }\n\n  /**\n   * Build the WRPRC payload\n   *\n   * @throws WRPRCException if the payload is invalid\n   */\n  build(): WRPRCPayload {\n    // Set default iat if not provided\n    if (!this.payload.iat) {\n      this.payload.iat = Math.floor(Date.now() / 1000)\n    }\n\n    const result = WRPRCPayloadSchema.safeParse(this.payload)\n\n    if (!result.success) {\n      const messages = result.error.issues.map((i) => `${i.path.join('.')}: ${i.message}`).join('\\n')\n      throw new WRPRCException(`Invalid WRPRC payload:\\n${messages}`, result.error.issues)\n    }\n\n    return result.data\n  }\n}\n\n// ============================================================================\n// Credential Builder\n// ============================================================================\n\n/**\n * Builder for creating Credential objects\n */\nexport class CredentialBuilder {\n  private credential: Partial<Credential> = {}\n\n  /**\n   * Set the credential format\n   *\n   * @param format - The format identifier (e.g., \"dc+sd-jwt\", \"mso_mdoc\")\n   */\n  format(format: string): this {\n    this.credential.format = format\n    return this\n  }\n\n  /**\n   * Set the credential metadata\n   *\n   * @param meta - Metadata object per credential format specification\n   */\n  meta(meta: Record<string, unknown>): this {\n    this.credential.meta = meta\n    return this\n  }\n\n  /**\n   * Set SD-JWT credential metadata (vct_values)\n   */\n  sdJwtMeta(vctValues: string[]): this {\n    this.credential.format = 'dc+sd-jwt'\n    this.credential.meta = { vct_values: vctValues }\n    return this\n  }\n\n  /**\n   * Set mDL/mDoc credential metadata (doctype_value)\n   */\n  mdocMeta(doctypeValue: string): this {\n    this.credential.format = 'mso_mdoc'\n    this.credential.meta = { doctype_value: doctypeValue }\n    return this\n  }\n\n  /**\n   * Add a claim to request\n   */\n  addClaim(claim: Claim): this {\n    this.credential.claim = this.credential.claim ?? []\n    this.credential.claim.push(claim)\n    return this\n  }\n\n  /**\n   * Add a simple path claim\n   */\n  addPathClaim(...path: string[]): this {\n    this.credential.claim = this.credential.claim ?? []\n    this.credential.claim.push({ path })\n    return this\n  }\n\n  /**\n   * Build the Credential object\n   */\n  build(): Credential {\n    if (!this.credential.format) {\n      throw new WRPRCException('Credential format is required')\n    }\n    if (!this.credential.meta) {\n      throw new WRPRCException('Credential meta is required')\n    }\n    return this.credential as Credential\n  }\n}\n\n// ============================================================================\n// Factory Functions\n// ============================================================================\n\n/**\n * Create a new WRPRCBuilder\n */\nexport function wrprc(): WRPRCBuilder {\n  return new WRPRCBuilder()\n}\n\n/**\n * Create a new CredentialBuilder\n */\nexport function credential(): CredentialBuilder {\n  return new CredentialBuilder()\n}\n\n/**\n * Create a WRPRC payload for a legal person\n */\nexport function createLegalPersonWRPRC(input: LegalPersonWRPRCInput): WRPRCPayload {\n  return wrprc()\n    .name(input.name)\n    .legalName(input.legalName)\n    .identifier(input.identifier)\n    .country(input.country)\n    .registryUri(input.registryUri)\n    .entitlements(input.entitlements)\n    .build()\n}\n\n/**\n * Create a WRPRC payload for a natural person\n */\nexport function createNaturalPersonWRPRC(input: NaturalPersonWRPRCInput): WRPRCPayload {\n  return wrprc()\n    .name(input.name)\n    .givenName(input.givenName)\n    .familyName(input.familyName)\n    .identifier(input.identifier)\n    .country(input.country)\n    .registryUri(input.registryUri)\n    .entitlements(input.entitlements)\n    .build()\n}\n\n/**\n * Create a simple service provider WRPRC\n */\nexport function createServiceProviderWRPRC(\n  name: string,\n  legalName: string,\n  identifier: string,\n  country: string,\n  registryUri: string\n): WRPRCPayload {\n  return wrprc()\n    .name(name)\n    .legalName(legalName)\n    .identifier(identifier)\n    .country(country)\n    .registryUri(registryUri)\n    .addEntitlement(ENTITLEMENT_SERVICE_PROVIDER)\n    .build()\n}\n","/**\n * WRPRC Validator\n *\n * Validation functions for ETSI TS 119 475 Wallet-Relying Party Registration Certificates.\n *\n * @see https://www.etsi.org/deliver/etsi_ts/119400_119499/119475/01.02.01_60/ts_119475v010201p.pdf\n */\n\nimport { ALL_ENTITLEMENTS, ALL_PSP_SUB_ENTITLEMENTS, ATTESTATION_PROVIDER_ENTITLEMENTS } from './entitlements'\nimport {\n  LegalPersonSubjectSchema,\n  NaturalPersonSubjectSchema,\n  WRPRCJWTHeaderSchema,\n  WRPRCPayloadSchema,\n} from './schemas'\nimport type { WRPRCPayload } from './types'\nimport { WRPRCException } from './wrprc-exception'\n\n// ============================================================================\n// Validation Result Types\n// ============================================================================\n\n/**\n * A single validation error\n */\nexport interface ValidationError {\n  /** Path to the invalid field */\n  path: string[]\n  /** Error message */\n  message: string\n  /** Error code */\n  code: string\n}\n\n/**\n * Result of WRPRC validation\n */\nexport interface ValidationResult {\n  /** Whether the WRPRC is valid */\n  valid: boolean\n  /** List of validation errors (empty if valid) */\n  errors: ValidationError[]\n  /** Warnings that don't invalidate the certificate but should be noted */\n  warnings: ValidationError[]\n}\n\n// ============================================================================\n// Core Validation Functions\n// ============================================================================\n\n/**\n * Validate a WRPRC payload against the schema\n */\nexport function validateWRPRCPayload(payload: unknown): ValidationResult {\n  const result = WRPRCPayloadSchema.safeParse(payload)\n  const errors: ValidationError[] = []\n  const warnings: ValidationError[] = []\n\n  if (!result.success) {\n    for (const issue of result.error.issues) {\n      errors.push({\n        path: issue.path.map(String),\n        message: issue.message,\n        code: issue.code,\n      })\n    }\n    return { valid: false, errors, warnings }\n  }\n\n  // Additional semantic validations\n  const validPayload: WRPRCPayload = result.data\n\n  // Check entitlements are valid URIs from the standard\n  for (const entitlement of validPayload.entitlements) {\n    if (!ALL_ENTITLEMENTS.includes(entitlement as (typeof ALL_ENTITLEMENTS)[number])) {\n      // Check if it's a sub-entitlement\n      if (!ALL_PSP_SUB_ENTITLEMENTS.includes(entitlement as (typeof ALL_PSP_SUB_ENTITLEMENTS)[number])) {\n        warnings.push({\n          path: ['entitlements'],\n          message: `Unknown entitlement URI: ${entitlement}. This may be a national or EU-defined extension.`,\n          code: 'unknown_entitlement',\n        })\n      }\n    }\n  }\n\n  // GEN-5.2.4-03: At least one entitlement must be specified\n  if (validPayload.entitlements.length === 0) {\n    errors.push({\n      path: ['entitlements'],\n      message: 'At least one entitlement must be specified (GEN-5.2.4-03)',\n      code: 'missing_entitlement',\n    })\n  }\n\n  // GEN-5.2.4-04: If sub-entitlements are present, a base entitlement must also be present\n  const hasSubEntitlement = validPayload.entitlements.some((e) =>\n    ALL_PSP_SUB_ENTITLEMENTS.includes(e as (typeof ALL_PSP_SUB_ENTITLEMENTS)[number])\n  )\n  const hasServiceProvider = validPayload.entitlements.includes(\n    'https://uri.etsi.org/19475/Entitlement/Service_Provider'\n  )\n  if (hasSubEntitlement && !hasServiceProvider) {\n    errors.push({\n      path: ['entitlements'],\n      message: 'Service provider sub-entitlements require Service_Provider entitlement (GEN-5.2.4-04)',\n      code: 'missing_base_entitlement',\n    })\n  }\n\n  // GEN-5.2.4-05: Attestation providers should have provides_attestations\n  const hasAttestationProviderRole = validPayload.entitlements.some((e) =>\n    ATTESTATION_PROVIDER_ENTITLEMENTS.includes(e as (typeof ATTESTATION_PROVIDER_ENTITLEMENTS)[number])\n  )\n  if (hasAttestationProviderRole && !validPayload.provides_attestations) {\n    warnings.push({\n      path: ['provides_attestations'],\n      message:\n        'Attestation providers should include provides_attestations field (GEN-5.2.4-05). This is recommended but not required.',\n      code: 'missing_provides_attestations',\n    })\n  }\n\n  // Validate subject identifier format (semantic identifier)\n  const subResult = validateSemanticIdentifier(validPayload.sub)\n  if (!subResult.valid) {\n    errors.push({\n      path: ['sub'],\n      message: subResult.message,\n      code: 'invalid_semantic_identifier',\n    })\n  }\n\n  return { valid: errors.length === 0, errors, warnings }\n}\n\n/**\n * Validate a JWT header for WRPRC\n */\nexport function validateWRPRCJWTHeader(header: unknown): ValidationResult {\n  const result = WRPRCJWTHeaderSchema.safeParse(header)\n  const errors: ValidationError[] = []\n  const warnings: ValidationError[] = []\n\n  if (!result.success) {\n    for (const issue of result.error.issues) {\n      errors.push({\n        path: issue.path.map(String),\n        message: issue.message,\n        code: issue.code,\n      })\n    }\n  }\n\n  return { valid: errors.length === 0, errors, warnings }\n}\n\n/**\n * Validate a complete WRPRC (header + payload)\n */\nexport function validateWRPRC(header: unknown, payload: unknown): ValidationResult {\n  const headerResult = validateWRPRCJWTHeader(header)\n  const payloadResult = validateWRPRCPayload(payload)\n\n  const errors = [\n    ...headerResult.errors.map((e) => ({ ...e, path: ['header', ...e.path] })),\n    ...payloadResult.errors.map((e) => ({ ...e, path: ['payload', ...e.path] })),\n  ]\n\n  const warnings = [\n    ...headerResult.warnings.map((w) => ({ ...w, path: ['header', ...w.path] })),\n    ...payloadResult.warnings.map((w) => ({ ...w, path: ['payload', ...w.path] })),\n  ]\n\n  return { valid: errors.length === 0, errors, warnings }\n}\n\n// ============================================================================\n// Subject Type Validation\n// ============================================================================\n\n/**\n * Check if payload represents a legal person\n */\nexport function isLegalPersonWRPRC(payload: WRPRCPayload): boolean {\n  return typeof payload.sub_ln === 'string' && payload.sub_ln.length > 0\n}\n\n/**\n * Check if payload represents a natural person\n */\nexport function isNaturalPersonWRPRC(payload: WRPRCPayload): boolean {\n  return (\n    typeof payload.sub_gn === 'string' &&\n    payload.sub_gn.length > 0 &&\n    typeof payload.sub_fn === 'string' &&\n    payload.sub_fn.length > 0\n  )\n}\n\n/**\n * Validate as legal person WRPRC\n */\nexport function validateLegalPersonWRPRC(payload: unknown): ValidationResult {\n  const result = LegalPersonSubjectSchema.safeParse(payload)\n  const errors: ValidationError[] = []\n  const warnings: ValidationError[] = []\n\n  if (!result.success) {\n    for (const issue of result.error.issues) {\n      errors.push({\n        path: issue.path.map(String),\n        message: issue.message,\n        code: issue.code,\n      })\n    }\n  }\n\n  // Additional validation for legal person identifier format\n  if (result.success) {\n    const sub: string = result.data.sub\n    // Legal person identifiers should follow ETSI EN 319 412-1 clause 5.1.4\n    // Format: 3-letter prefix + 2-letter country code + hyphen + identifier\n    if (!/^[A-Z]{3}[A-Z]{2}-.+$/.test(sub)) {\n      warnings.push({\n        path: ['sub'],\n        message:\n          'Legal person identifier should follow format: PREFIX + COUNTRY + \"-\" + ID (e.g., \"LEIXG-529900T8BM49AURSDO55\")',\n        code: 'identifier_format_warning',\n      })\n    }\n  }\n\n  return { valid: errors.length === 0, errors, warnings }\n}\n\n/**\n * Validate as natural person WRPRC\n */\nexport function validateNaturalPersonWRPRC(payload: unknown): ValidationResult {\n  const result = NaturalPersonSubjectSchema.safeParse(payload)\n  const errors: ValidationError[] = []\n  const warnings: ValidationError[] = []\n\n  if (!result.success) {\n    for (const issue of result.error.issues) {\n      errors.push({\n        path: issue.path.map(String),\n        message: issue.message,\n        code: issue.code,\n      })\n    }\n  }\n\n  // Additional validation for natural person identifier format\n  if (result.success) {\n    const sub: string = result.data.sub\n    // Natural person identifiers should follow ETSI EN 319 412-1 clause 5.1.3\n    // Format: 3-letter prefix + 2-letter country code + hyphen + identifier\n    if (!/^[A-Z]{3}[A-Z]{2}-.+$/.test(sub)) {\n      warnings.push({\n        path: ['sub'],\n        message:\n          'Natural person identifier should follow format: PREFIX + COUNTRY + \"-\" + ID (e.g., \"TINIT-RSSMRA85T10A562S\")',\n        code: 'identifier_format_warning',\n      })\n    }\n  }\n\n  return { valid: errors.length === 0, errors, warnings }\n}\n\n// ============================================================================\n// Semantic Identifier Validation\n// ============================================================================\n\n/**\n * Valid semantic identifier prefixes for legal persons (ETSI EN 319 412-1 clause 5.1.4)\n */\nconst LEGAL_PERSON_PREFIXES = ['EOR', 'LEI', 'NTR', 'VAT', 'TIN', 'EXC']\n\n/**\n * Valid semantic identifier prefixes for natural persons (ETSI EN 319 412-1 clause 5.1.3)\n */\nconst NATURAL_PERSON_PREFIXES = ['TIN', 'PAS', 'IDC', 'PNO', 'TAX']\n\n/**\n * Validate a semantic identifier format\n */\nfunction validateSemanticIdentifier(identifier: string): { valid: boolean; message: string } {\n  // Format: PREFIX (3 chars) + COUNTRY (2 chars) + \"-\" + ID\n  const match = identifier.match(/^([A-Z]{3})([A-Z]{2})-(.+)$/)\n\n  if (!match) {\n    return {\n      valid: false,\n      message: 'Semantic identifier must follow format: PREFIX (3 chars) + COUNTRY (2 chars) + \"-\" + ID',\n    }\n  }\n\n  const [, prefix, , id] = match\n\n  // Check if prefix is known\n  const allPrefixes = [...LEGAL_PERSON_PREFIXES, ...NATURAL_PERSON_PREFIXES]\n  if (!allPrefixes.includes(prefix)) {\n    // Unknown prefix is allowed per spec (national schemes may define additional prefixes)\n    // but we validate the format is correct\n  }\n\n  if (!id || id.length === 0) {\n    return {\n      valid: false,\n      message: 'Semantic identifier must have a non-empty ID part after the hyphen',\n    }\n  }\n\n  return { valid: true, message: '' }\n}\n\n// ============================================================================\n// Assertion Functions\n// ============================================================================\n\n/**\n * Assert that a WRPRC payload is valid, throws WRPRCException if not\n */\nexport function assertValidWRPRCPayload(payload: unknown): asserts payload is WRPRCPayload {\n  const result = validateWRPRCPayload(payload)\n  if (!result.valid) {\n    const messages = result.errors.map((e) => `${e.path.join('.')}: ${e.message}`).join('\\n')\n    throw new WRPRCException(`Invalid WRPRC payload:\\n${messages}`, result.errors)\n  }\n}\n\n/**\n * Assert that a WRPRC is valid (header + payload), throws WRPRCException if not\n */\nexport function assertValidWRPRC(header: unknown, payload: unknown): void {\n  const result = validateWRPRC(header, payload)\n  if (!result.valid) {\n    const messages = result.errors.map((e) => `${e.path.join('.')}: ${e.message}`).join('\\n')\n    throw new WRPRCException(`Invalid WRPRC:\\n${messages}`, result.errors)\n  }\n}\n","/**\n * WRPRC Signer\n *\n * Functions for creating and signing ETSI TS 119 475 Wallet-Relying Party Registration Certificates.\n *\n * @see https://www.etsi.org/deliver/etsi_ts/119400_119499/119475/01.02.01_60/ts_119475v010201p.pdf\n */\n\nimport { pemToDer } from '@owf/crypto'\nimport { base64urlEncode, decodeJwt } from '@owf/identity-common'\nimport type { SignedWRPRC, SignOptions, WRPRCJWTHeader, WRPRCPayload } from './types'\nimport { assertValidWRPRCPayload } from './validator'\nimport { WRPRCException } from './wrprc-exception'\n\n// ============================================================================\n// JWT Signing\n// ============================================================================\n\n/**\n * Sign a WRPRC payload to create a JWT\n *\n * @param options - Signing options including payload, algorithm, certificates, and signer\n * @returns Signed WRPRC with JWS string and decoded parts\n */\nexport async function signWRPRC(options: SignOptions): Promise<SignedWRPRC> {\n  const { payload, algorithm = 'ES256', certificates, keyId, signer } = options\n\n  // Validate payload\n  assertValidWRPRCPayload(payload)\n\n  if (!certificates || certificates.length === 0) {\n    throw new WRPRCException('At least one certificate is required for x5c header')\n  }\n\n  // Extract base64 content from PEM certificates\n  const x5c = certificates.map((cert) => {\n    const content = pemToDer(cert)\n    if (!content) {\n      throw new WRPRCException('Invalid PEM certificate format')\n    }\n    return content\n  })\n\n  // Create JWT header\n  const header: WRPRCJWTHeader = {\n    typ: 'rc-wrp+jwt',\n    alg: algorithm,\n    x5c,\n    ...(keyId && { kid: keyId }),\n  }\n\n  // Encode header and payload\n  const encodedHeader = base64urlEncode(JSON.stringify(header))\n  const encodedPayload = base64urlEncode(JSON.stringify(payload))\n  const signingInput = `${encodedHeader}.${encodedPayload}`\n\n  // Sign\n  const signature = await signer(signingInput)\n\n  // Create compact JWS\n  const jws = `${signingInput}.${signature}`\n\n  return {\n    jws,\n    header,\n    payload,\n  }\n}\n\n// ============================================================================\n// JWT Decoding\n// ============================================================================\n\n/**\n * Decode a signed WRPRC JWT (without verification)\n *\n * @param jws - The compact JWS string\n * @returns Decoded WRPRC with header and payload\n */\nexport function decodeWRPRC(jws: string): SignedWRPRC {\n  const decoded = decodeJwt(jws)\n\n  // Validate typ header\n  if (decoded.header.typ !== 'rc-wrp+jwt') {\n    throw new WRPRCException(`Invalid WRPRC type: expected \"rc-wrp+jwt\", got \"${decoded.header.typ}\"`)\n  }\n\n  // Validate payload structure\n  assertValidWRPRCPayload(decoded.payload)\n\n  return {\n    jws,\n    header: decoded.header as WRPRCJWTHeader,\n    payload: decoded.payload as WRPRCPayload,\n  }\n}\n\n/**\n * Parse a WRPRC JWT without validation (for inspection purposes)\n *\n * @param jws - The compact JWS string\n * @returns Decoded parts without validation\n */\nexport function parseWRPRC(jws: string): { header: unknown; payload: unknown; signature: string } {\n  const decoded = decodeJwt(jws)\n  const parts = jws.split('.')\n\n  return {\n    header: decoded.header,\n    payload: decoded.payload,\n    signature: parts[2],\n  }\n}\n\n// ============================================================================\n// WRPRC Creation Helpers\n// ============================================================================\n\n/**\n * Create a WRPRC with automatic timestamp\n *\n * @param payload - Partial payload (iat will be set automatically if not provided)\n * @returns Complete payload with timestamp\n */\nexport function createWRPRCPayload(payload: Omit<WRPRCPayload, 'iat'> & { iat?: number }): WRPRCPayload {\n  const completePayload: WRPRCPayload = {\n    ...payload,\n    iat: payload.iat ?? Math.floor(Date.now() / 1000),\n  }\n\n  assertValidWRPRCPayload(completePayload)\n\n  return completePayload\n}\n"],"mappings":";;;;;;;;AAgCA,MAAa,+BAA+B;;;;;AAM5C,MAAa,4BAA4B;;;;;AAMzC,MAAa,iCAAiC;;;;;AAM9C,MAAa,+BAA+B;;;;;AAM5C,MAAa,2BAA2B;;;;AAwCxC,MAAa,mBAAmB;CAC9B,kBAAkB;CAClB,eAAe;CACf,oBAAoB;CACpB,kBAAkB;CAClB,cAAc;CACd,0BAA0B;CAC1B,yBAAyB;CACzB,oBAAoB;CACpB,mBAAmB;CACnB,8BAA8B;AAChC;;;;AAKA,MAAa,mBAAmB,OAAO,OAAO,gBAAgB;;;;AAK9D,MAAa,oCAAoC;CAC/C;CACA;CACA;CACA;AACF;;;;;AAUA,MAAa,uBAAuB;;CAElC,mBAAmB;;CAEnB,oBAAoB;;CAEpB,qBAAqB;;CAErB,YAAY;;CAEZ,aAAa;AACf;;;;AAKA,MAAa,2BAA2B,OAAO,OAAO,oBAAoB;;;;AAS1E,MAAa,mBAAmB;;CAE9B,MAAM;;CAEN,KAAK;;CAEL,MAAM;;CAEN,OAAO;;CAEP,KAAK;;CAEL,QAAQ;AACV;AAOG,iBAAiB,MACjB,iBAAiB,KACjB,iBAAiB,MACjB,iBAAiB,OACjB,iBAAiB,KACjB,iBAAiB;;;;AAuCpB,SAAgB,mBAAmB,KAAsB;CACvD,OAAO,iBAAiB,SAAS,GAAwC;AAC3E;;;;AAKA,SAAgB,oBAAoB,KAAsB;CACxD,OAAO,yBAAyB,SAAS,GAAgD;AAC3F;;;;AAKA,SAAgB,kCAAkC,cAAiC;CACjF,OAAO,aAAa,MAAM,MACxB,kCAAkC,SAAS,CAAuD,CACpG;AACF;;;;;;;;;;;;;;AC7NA,MAAa,wBAAwBA,IAAAA,EAAE,OAAO;;CAE5C,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;;CAEtB,SAASA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;AAC3B,CAAC;;;;AASD,MAAa,6BAA6BA,IAAAA,EAAE,OAAO;;CAEjD,OAAOA,IAAAA,EAAE,MAAM,CAAC,CAAC,SAAS;;CAE1B,OAAOA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;;CAE3B,KAAKA,IAAAA,EAAE,IAAI,CAAC,CAAC,SAAS;AACxB,CAAC;;;;AAKD,MAAa,cAAcA,IAAAA,EAAE,OAAO;;CAElC,MAAMA,IAAAA,EAAE,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;;CAE/B,QAAQA,IAAAA,EAAE,MAAMA,IAAAA,EAAE,MAAM;EAACA,IAAAA,EAAE,OAAO;EAAGA,IAAAA,EAAE,OAAO;EAAGA,IAAAA,EAAE,QAAQ;CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;AAC3E,CAAC;;;;AAKD,MAAa,mBAAmBA,IAAAA,EAAE,OAAO;;CAEvC,QAAQA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;;CAExB,MAAMA,IAAAA,EAAE,OAAOA,IAAAA,EAAE,OAAO,GAAGA,IAAAA,EAAE,QAAQ,CAAC;;CAEtC,OAAOA,IAAAA,EAAE,MAAM,WAAW,CAAC,CAAC,SAAS;AACvC,CAAC;;;;AAKD,MAAa,mBAAmBA,IAAAA,EAAE,OAAO;;CAEvC,KAAKA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY;;CAElC,KAAKA,IAAAA,EAAE,IAAI;AACb,CAAC;;;;AAKD,MAAa,eAAeA,IAAAA,EAAE,OAAO,EACnC,aAAa,iBACf,CAAC;;;;AAKD,MAAa,qBAAqBA,IAAAA,EAAE,OAAO;;CAEzC,KAAKA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;;CAErB,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;AACxB,CAAC;;;;AASD,MAAa,qBAAqBA,IAAAA,EAAE,OAAO;;CAEzC,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;;CAGtB,QAAQA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;;CAG5B,QAAQA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;;CAG5B,QAAQA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;;CAG5B,KAAKA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;;CAGrB,SAASA,IAAAA,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC;;CAG5B,cAAcA,IAAAA,EAAE,IAAI;;CAGpB,iBAAiBA,IAAAA,EAAE,MAAMA,IAAAA,EAAE,MAAM,qBAAqB,CAAC,CAAC,CAAC,SAAS;;CAGlE,cAAcA,IAAAA,EAAE,MAAMA,IAAAA,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;;CAGpC,gBAAgBA,IAAAA,EAAE,IAAI,CAAC,CAAC,SAAS;;CAGjC,UAAUA,IAAAA,EAAE,IAAI,CAAC,CAAC,SAAS;;CAG3B,aAAaA,IAAAA,EAAE,IAAI,CAAC,CAAC,GAAGA,IAAAA,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS;;CAG5C,uBAAuB,2BAA2B,SAAS;;CAG3D,WAAWA,IAAAA,EAAE,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;;CAGxC,oBAAoBA,IAAAA,EAAE,IAAI,CAAC,CAAC,SAAS;;CAGrC,KAAKA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;;CAG/B,QAAQ,aAAa,SAAS;;CAG9B,SAASA,IAAAA,EAAE,MAAM,qBAAqB,CAAC,CAAC,SAAS;;CAGjD,aAAaA,IAAAA,EAAE,MAAM,gBAAgB,CAAC,CAAC,SAAS;;CAGhD,uBAAuBA,IAAAA,EAAE,MAAM,gBAAgB,CAAC,CAAC,SAAS;;CAG1D,cAAc,mBAAmB,SAAS;AAC5C,CAAC;;;;AASD,MAAa,uBAAuBA,IAAAA,EAAE,OAAO;;CAE3C,KAAKA,IAAAA,EAAE,QAAQ,YAAY;;CAE3B,KAAKA,IAAAA,EAAE,KAAK;EAAC;EAAS;EAAS;EAAS;EAAS;EAAS;CAAO,CAAC;;CAElE,KAAKA,IAAAA,EAAE,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;;CAE9B,KAAKA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;AAC3B,CAAC;;;;AAKD,MAAa,uBAAuBA,IAAAA,EAAE,OAAO;;CAE3C,KAAKA,IAAAA,EAAE,QAAQ,YAAY;;CAE3B,KAAKA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI;;CAEpB,SAASA,IAAAA,EAAE,MAAMA,IAAAA,EAAE,WAAW,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAS6BA,IAAAA,EAAE,OAAO;CACrC,QAAQ;CACR,SAAS;AACX,CAAC;AAK6BA,IAAAA,EAAE,OAAO;CACrC,QAAQ;CACR,SAAS;AACX,CAAC;;;;AASD,MAAa,2BAA2B,mBAAmB,OAAO,EAChE,QAAQA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAC1B,CAAC,CAAC,CAAC,KAAK;CACN,QAAQ;CACR,QAAQ;AACV,CAAC;;;;AAKD,MAAa,6BAA6B,mBAAmB,OAAO;CAClE,QAAQA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACxB,QAAQA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;AAC1B,CAAC,CAAC,CAAC,KAAK,EACN,QAAQ,KACV,CAAC;;;;;;ACrOD,IAAa,iBAAb,MAAa,uBAAuBC,qBAAAA,kBAAkB;CACpD,YAAY,SAAiB,SAAmB;EAC9C,MAAM,SAAS,OAAO;EACtB,OAAO,eAAe,MAAM,eAAe,SAAS;EACpD,KAAK,OAAO;CACd;AACF;;;;;;;;;;;;;ACkDA,IAAa,eAAb,MAA0B;;iBACe,CAAC;;;;;CAKxC,KAAK,OAAqB;EACxB,KAAK,QAAQ,OAAO;EACpB,OAAO;CACT;;;;CAKA,UAAU,OAAqB;EAC7B,KAAK,QAAQ,SAAS;EACtB,OAAO;CACT;;;;CAKA,UAAU,OAAqB;EAC7B,KAAK,QAAQ,SAAS;EACtB,OAAO;CACT;;;;CAKA,WAAW,OAAqB;EAC9B,KAAK,QAAQ,SAAS;EACtB,OAAO;CACT;;;;;;;;CASA,WAAW,YAA0B;EACnC,KAAK,QAAQ,MAAM;EACnB,OAAO;CACT;;;;CAKA,QAAQ,MAAoB;EAC1B,KAAK,QAAQ,UAAU;EACvB,OAAO;CACT;;;;CAKA,YAAY,KAAmB;EAC7B,KAAK,QAAQ,eAAe;EAC5B,OAAO;CACT;;;;CAKA,mBAAmB,aAAqB,OAAO,MAAY;EACzD,KAAK,QAAQ,kBAAkB,KAAK,QAAQ,mBAAmB,CAAC;EAEhE,MAAM,WAAW,KAAK,QAAQ,gBAAgB,MAAM,UAAU,MAAM,MAAM,MAAM,EAAE,SAAS,IAAI,CAAC;EAChG,IAAI,UACF,SAAS,KAAK;GAAE;GAAM,SAAS;EAAY,CAAC;OAE5C,KAAK,QAAQ,gBAAgB,KAAK,CAAC;GAAE;GAAM,SAAS;EAAY,CAAC,CAAC;EAEpE,OAAO;CACT;;;;CAKA,uBAAuB,cAAuC;EAC5D,KAAK,QAAQ,kBAAkB,KAAK,QAAQ,mBAAmB,CAAC;EAChE,KAAK,QAAQ,gBAAgB,KAAK,YAAY;EAC9C,OAAO;CACT;;;;;;CAOA,eAAe,aAAsF;EACnG,KAAK,QAAQ,eAAe,KAAK,QAAQ,gBAAgB,CAAC;EAC1D,IAAI,CAAC,KAAK,QAAQ,aAAa,SAAS,WAAW,GACjD,KAAK,QAAQ,aAAa,KAAK,WAAW;EAE5C,OAAO;CACT;;;;CAKA,aAAa,cAA8B;EACzC,KAAK,QAAQ,eAAe,CAAC,GAAG,YAAY;EAC5C,OAAO;CACT;;;;CAKA,cAAc,KAAmB;EAC/B,KAAK,QAAQ,iBAAiB;EAC9B,OAAO;CACT;;;;CAKA,QAAQ,KAAmB;EACzB,KAAK,QAAQ,WAAW;EACxB,OAAO;CACT;;;;CAKA,WAAW,KAAmB;EAC5B,KAAK,QAAQ,cAAc;EAC3B,OAAO;CACT;;;;CAKA,qBAAqB,WAAuC;EAC1D,KAAK,QAAQ,wBAAwB;EACrC,OAAO;CACT;;;;CAKA,SAAS,KAAqB;EAC5B,KAAK,QAAQ,YAAY;EACzB,OAAO;CACT;;;;CAKA,kBAAkB,KAAmB;EACnC,KAAK,QAAQ,qBAAqB;EAClC,OAAO;CACT;;;;;CAMA,SAAS,WAAgC;EACvC,KAAK,QAAQ,MAAM,OAAO,cAAc,WAAW,YAAY,KAAK,MAAM,UAAU,QAAQ,IAAI,GAAI;EACpG,OAAO;CACT;;;;CAKA,OAAO,QAAsB;EAC3B,KAAK,QAAQ,SAAS;EACtB,OAAO;CACT;;;;CAKA,WAAW,aAAqB,OAAO,MAAY;EACjD,KAAK,QAAQ,UAAU,KAAK,QAAQ,WAAW,CAAC;EAChD,KAAK,QAAQ,QAAQ,KAAK;GAAE;GAAM,SAAS;EAAY,CAAC;EACxD,OAAO;CACT;;;;CAKA,SAAS,UAAmC;EAC1C,KAAK,QAAQ,UAAU;EACvB,OAAO;CACT;;;;CAKA,cAAc,YAA8B;EAC1C,KAAK,QAAQ,cAAc,KAAK,QAAQ,eAAe,CAAC;EACxD,KAAK,QAAQ,YAAY,KAAK,UAAU;EACxC,OAAO;CACT;;;;CAKA,uBAAuB,YAA8B;EACnD,KAAK,QAAQ,wBAAwB,KAAK,QAAQ,yBAAyB,CAAC;EAC5E,KAAK,QAAQ,sBAAsB,KAAK,UAAU;EAClD,OAAO;CACT;;;;CAKA,aAAa,cAAkC;EAC7C,KAAK,QAAQ,eAAe;EAC5B,OAAO;CACT;;;;;;CAOA,QAAsB;EAEpB,IAAI,CAAC,KAAK,QAAQ,KAChB,KAAK,QAAQ,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;EAGjD,MAAM,SAAS,mBAAmB,UAAU,KAAK,OAAO;EAExD,IAAI,CAAC,OAAO,SAEV,MAAM,IAAI,eAAe,2BADR,OAAO,MAAM,OAAO,KAAK,MAAM,GAAG,EAAE,KAAK,KAAK,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,KAAK,IAC/B,KAAK,OAAO,MAAM,MAAM;EAGrF,OAAO,OAAO;CAChB;AACF;;;;AASA,IAAa,oBAAb,MAA+B;;oBACa,CAAC;;;;;;;CAO3C,OAAO,QAAsB;EAC3B,KAAK,WAAW,SAAS;EACzB,OAAO;CACT;;;;;;CAOA,KAAK,MAAqC;EACxC,KAAK,WAAW,OAAO;EACvB,OAAO;CACT;;;;CAKA,UAAU,WAA2B;EACnC,KAAK,WAAW,SAAS;EACzB,KAAK,WAAW,OAAO,EAAE,YAAY,UAAU;EAC/C,OAAO;CACT;;;;CAKA,SAAS,cAA4B;EACnC,KAAK,WAAW,SAAS;EACzB,KAAK,WAAW,OAAO,EAAE,eAAe,aAAa;EACrD,OAAO;CACT;;;;CAKA,SAAS,OAAoB;EAC3B,KAAK,WAAW,QAAQ,KAAK,WAAW,SAAS,CAAC;EAClD,KAAK,WAAW,MAAM,KAAK,KAAK;EAChC,OAAO;CACT;;;;CAKA,aAAa,GAAG,MAAsB;EACpC,KAAK,WAAW,QAAQ,KAAK,WAAW,SAAS,CAAC;EAClD,KAAK,WAAW,MAAM,KAAK,EAAE,KAAK,CAAC;EACnC,OAAO;CACT;;;;CAKA,QAAoB;EAClB,IAAI,CAAC,KAAK,WAAW,QACnB,MAAM,IAAI,eAAe,+BAA+B;EAE1D,IAAI,CAAC,KAAK,WAAW,MACnB,MAAM,IAAI,eAAe,6BAA6B;EAExD,OAAO,KAAK;CACd;AACF;;;;AASA,SAAgB,QAAsB;CACpC,OAAO,IAAI,aAAa;AAC1B;;;;AAKA,SAAgB,aAAgC;CAC9C,OAAO,IAAI,kBAAkB;AAC/B;;;;AAKA,SAAgB,uBAAuB,OAA4C;CACjF,OAAO,MAAM,CAAC,CACX,KAAK,MAAM,IAAI,CAAC,CAChB,UAAU,MAAM,SAAS,CAAC,CAC1B,WAAW,MAAM,UAAU,CAAC,CAC5B,QAAQ,MAAM,OAAO,CAAC,CACtB,YAAY,MAAM,WAAW,CAAC,CAC9B,aAAa,MAAM,YAAY,CAAC,CAChC,MAAM;AACX;;;;AAKA,SAAgB,yBAAyB,OAA8C;CACrF,OAAO,MAAM,CAAC,CACX,KAAK,MAAM,IAAI,CAAC,CAChB,UAAU,MAAM,SAAS,CAAC,CAC1B,WAAW,MAAM,UAAU,CAAC,CAC5B,WAAW,MAAM,UAAU,CAAC,CAC5B,QAAQ,MAAM,OAAO,CAAC,CACtB,YAAY,MAAM,WAAW,CAAC,CAC9B,aAAa,MAAM,YAAY,CAAC,CAChC,MAAM;AACX;;;;AAKA,SAAgB,2BACd,MACA,WACA,YACA,SACA,aACc;CACd,OAAO,MAAM,CAAC,CACX,KAAK,IAAI,CAAC,CACV,UAAU,SAAS,CAAC,CACpB,WAAW,UAAU,CAAC,CACtB,QAAQ,OAAO,CAAC,CAChB,YAAY,WAAW,CAAC,CACxB,eAAe,4BAA4B,CAAC,CAC5C,MAAM;AACX;;;;;;;;;;;;;ACvYA,SAAgB,qBAAqB,SAAoC;CACvE,MAAM,SAAS,mBAAmB,UAAU,OAAO;CACnD,MAAM,SAA4B,CAAC;CACnC,MAAM,WAA8B,CAAC;CAErC,IAAI,CAAC,OAAO,SAAS;EACnB,KAAK,MAAM,SAAS,OAAO,MAAM,QAC/B,OAAO,KAAK;GACV,MAAM,MAAM,KAAK,IAAI,MAAM;GAC3B,SAAS,MAAM;GACf,MAAM,MAAM;EACd,CAAC;EAEH,OAAO;GAAE,OAAO;GAAO;GAAQ;EAAS;CAC1C;CAGA,MAAM,eAA6B,OAAO;CAG1C,KAAK,MAAM,eAAe,aAAa,cACrC,IAAI,CAAC,iBAAiB,SAAS,WAAgD;MAEzE,CAAC,yBAAyB,SAAS,WAAwD,GAC7F,SAAS,KAAK;GACZ,MAAM,CAAC,cAAc;GACrB,SAAS,4BAA4B,YAAY;GACjD,MAAM;EACR,CAAC;CAAA;CAMP,IAAI,aAAa,aAAa,WAAW,GACvC,OAAO,KAAK;EACV,MAAM,CAAC,cAAc;EACrB,SAAS;EACT,MAAM;CACR,CAAC;CAIH,MAAM,oBAAoB,aAAa,aAAa,MAAM,MACxD,yBAAyB,SAAS,CAA8C,CAClF;CACA,MAAM,qBAAqB,aAAa,aAAa,SACnD,yDACF;CACA,IAAI,qBAAqB,CAAC,oBACxB,OAAO,KAAK;EACV,MAAM,CAAC,cAAc;EACrB,SAAS;EACT,MAAM;CACR,CAAC;CAOH,IAHmC,aAAa,aAAa,MAAM,MACjE,kCAAkC,SAAS,CAAuD,CAEvE,KAAK,CAAC,aAAa,uBAC9C,SAAS,KAAK;EACZ,MAAM,CAAC,uBAAuB;EAC9B,SACE;EACF,MAAM;CACR,CAAC;CAIH,MAAM,YAAY,2BAA2B,aAAa,GAAG;CAC7D,IAAI,CAAC,UAAU,OACb,OAAO,KAAK;EACV,MAAM,CAAC,KAAK;EACZ,SAAS,UAAU;EACnB,MAAM;CACR,CAAC;CAGH,OAAO;EAAE,OAAO,OAAO,WAAW;EAAG;EAAQ;CAAS;AACxD;;;;AAKA,SAAgB,uBAAuB,QAAmC;CACxE,MAAM,SAAS,qBAAqB,UAAU,MAAM;CACpD,MAAM,SAA4B,CAAC;CACnC,MAAM,WAA8B,CAAC;CAErC,IAAI,CAAC,OAAO,SACV,KAAK,MAAM,SAAS,OAAO,MAAM,QAC/B,OAAO,KAAK;EACV,MAAM,MAAM,KAAK,IAAI,MAAM;EAC3B,SAAS,MAAM;EACf,MAAM,MAAM;CACd,CAAC;CAIL,OAAO;EAAE,OAAO,OAAO,WAAW;EAAG;EAAQ;CAAS;AACxD;;;;AAKA,SAAgB,cAAc,QAAiB,SAAoC;CACjF,MAAM,eAAe,uBAAuB,MAAM;CAClD,MAAM,gBAAgB,qBAAqB,OAAO;CAElD,MAAM,SAAS,CACb,GAAG,aAAa,OAAO,KAAK,OAAO;EAAE,GAAG;EAAG,MAAM,CAAC,UAAU,GAAG,EAAE,IAAI;CAAE,EAAE,GACzE,GAAG,cAAc,OAAO,KAAK,OAAO;EAAE,GAAG;EAAG,MAAM,CAAC,WAAW,GAAG,EAAE,IAAI;CAAE,EAAE,CAC7E;CAEA,MAAM,WAAW,CACf,GAAG,aAAa,SAAS,KAAK,OAAO;EAAE,GAAG;EAAG,MAAM,CAAC,UAAU,GAAG,EAAE,IAAI;CAAE,EAAE,GAC3E,GAAG,cAAc,SAAS,KAAK,OAAO;EAAE,GAAG;EAAG,MAAM,CAAC,WAAW,GAAG,EAAE,IAAI;CAAE,EAAE,CAC/E;CAEA,OAAO;EAAE,OAAO,OAAO,WAAW;EAAG;EAAQ;CAAS;AACxD;;;;AASA,SAAgB,mBAAmB,SAAgC;CACjE,OAAO,OAAO,QAAQ,WAAW,YAAY,QAAQ,OAAO,SAAS;AACvE;;;;AAKA,SAAgB,qBAAqB,SAAgC;CACnE,OACE,OAAO,QAAQ,WAAW,YAC1B,QAAQ,OAAO,SAAS,KACxB,OAAO,QAAQ,WAAW,YAC1B,QAAQ,OAAO,SAAS;AAE5B;;;;AAKA,SAAgB,yBAAyB,SAAoC;CAC3E,MAAM,SAAS,yBAAyB,UAAU,OAAO;CACzD,MAAM,SAA4B,CAAC;CACnC,MAAM,WAA8B,CAAC;CAErC,IAAI,CAAC,OAAO,SACV,KAAK,MAAM,SAAS,OAAO,MAAM,QAC/B,OAAO,KAAK;EACV,MAAM,MAAM,KAAK,IAAI,MAAM;EAC3B,SAAS,MAAM;EACf,MAAM,MAAM;CACd,CAAC;CAKL,IAAI,OAAO,SAAS;EAClB,MAAM,MAAc,OAAO,KAAK;EAGhC,IAAI,CAAC,wBAAwB,KAAK,GAAG,GACnC,SAAS,KAAK;GACZ,MAAM,CAAC,KAAK;GACZ,SACE;GACF,MAAM;EACR,CAAC;CAEL;CAEA,OAAO;EAAE,OAAO,OAAO,WAAW;EAAG;EAAQ;CAAS;AACxD;;;;AAKA,SAAgB,2BAA2B,SAAoC;CAC7E,MAAM,SAAS,2BAA2B,UAAU,OAAO;CAC3D,MAAM,SAA4B,CAAC;CACnC,MAAM,WAA8B,CAAC;CAErC,IAAI,CAAC,OAAO,SACV,KAAK,MAAM,SAAS,OAAO,MAAM,QAC/B,OAAO,KAAK;EACV,MAAM,MAAM,KAAK,IAAI,MAAM;EAC3B,SAAS,MAAM;EACf,MAAM,MAAM;CACd,CAAC;CAKL,IAAI,OAAO,SAAS;EAClB,MAAM,MAAc,OAAO,KAAK;EAGhC,IAAI,CAAC,wBAAwB,KAAK,GAAG,GACnC,SAAS,KAAK;GACZ,MAAM,CAAC,KAAK;GACZ,SACE;GACF,MAAM;EACR,CAAC;CAEL;CAEA,OAAO;EAAE,OAAO,OAAO,WAAW;EAAG;EAAQ;CAAS;AACxD;;;;AASA,MAAM,wBAAwB;CAAC;CAAO;CAAO;CAAO;CAAO;CAAO;AAAK;;;;AAKvE,MAAM,0BAA0B;CAAC;CAAO;CAAO;CAAO;CAAO;AAAK;;;;AAKlE,SAAS,2BAA2B,YAAyD;CAE3F,MAAM,QAAQ,WAAW,MAAM,6BAA6B;CAE5D,IAAI,CAAC,OACH,OAAO;EACL,OAAO;EACP,SAAS;CACX;CAGF,MAAM,GAAG,UAAU,MAAM;CAIzB,IAAI,CAAC,CADgB,GAAG,uBAAuB,GAAG,uBACnC,CAAC,CAAC,SAAS,MAAM,GAAG,CAGnC;CAEA,IAAI,CAAC,MAAM,GAAG,WAAW,GACvB,OAAO;EACL,OAAO;EACP,SAAS;CACX;CAGF,OAAO;EAAE,OAAO;EAAM,SAAS;CAAG;AACpC;;;;AASA,SAAgB,wBAAwB,SAAmD;CACzF,MAAM,SAAS,qBAAqB,OAAO;CAC3C,IAAI,CAAC,OAAO,OAEV,MAAM,IAAI,eAAe,2BADR,OAAO,OAAO,KAAK,MAAM,GAAG,EAAE,KAAK,KAAK,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,KAAK,IACzB,KAAK,OAAO,MAAM;AAEjF;;;;AAKA,SAAgB,iBAAiB,QAAiB,SAAwB;CACxE,MAAM,SAAS,cAAc,QAAQ,OAAO;CAC5C,IAAI,CAAC,OAAO,OAEV,MAAM,IAAI,eAAe,mBADR,OAAO,OAAO,KAAK,MAAM,GAAG,EAAE,KAAK,KAAK,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,KAAK,IACjC,KAAK,OAAO,MAAM;AAEzE;;;;;;;;;;;;;;;;AC/TA,eAAsB,UAAU,SAA4C;CAC1E,MAAM,EAAE,SAAS,YAAY,SAAS,cAAc,OAAO,WAAW;CAGtE,wBAAwB,OAAO;CAE/B,IAAI,CAAC,gBAAgB,aAAa,WAAW,GAC3C,MAAM,IAAI,eAAe,qDAAqD;CAahF,MAAM,SAAyB;EAC7B,KAAK;EACL,KAAK;EACL,KAZU,aAAa,KAAK,SAAS;GACrC,MAAM,WAAA,GAAA,YAAA,SAAA,CAAmB,IAAI;GAC7B,IAAI,CAAC,SACH,MAAM,IAAI,eAAe,gCAAgC;GAE3D,OAAO;EACT,CAMI;EACF,GAAI,SAAS,EAAE,KAAK,MAAM;CAC5B;CAKA,MAAM,eAAe,IAAA,GAAA,qBAAA,gBAAA,CAFiB,KAAK,UAAU,MAAM,CAEvB,EAAE,IAAA,GAAA,qBAAA,gBAAA,CADC,KAAK,UAAU,OAAO,CACP;CAQtD,OAAO;EACL,KAAA,GAHa,aAAa,GAAG,MAHP,OAAO,YAAY;EAOzC;EACA;CACF;AACF;;;;;;;AAYA,SAAgB,YAAY,KAA0B;CACpD,MAAM,WAAA,GAAA,qBAAA,UAAA,CAAoB,GAAG;CAG7B,IAAI,QAAQ,OAAO,QAAQ,cACzB,MAAM,IAAI,eAAe,mDAAmD,QAAQ,OAAO,IAAI,EAAE;CAInG,wBAAwB,QAAQ,OAAO;CAEvC,OAAO;EACL;EACA,QAAQ,QAAQ;EAChB,SAAS,QAAQ;CACnB;AACF;;;;;;;AAQA,SAAgB,WAAW,KAAuE;CAChG,MAAM,WAAA,GAAA,qBAAA,UAAA,CAAoB,GAAG;CAC7B,MAAM,QAAQ,IAAI,MAAM,GAAG;CAE3B,OAAO;EACL,QAAQ,QAAQ;EAChB,SAAS,QAAQ;EACjB,WAAW,MAAM;CACnB;AACF;;;;;;;AAYA,SAAgB,mBAAmB,SAAqE;CACtG,MAAM,kBAAgC;EACpC,GAAG;EACH,KAAK,QAAQ,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;CAClD;CAEA,wBAAwB,eAAe;CAEvC,OAAO;AACT"}
+{"version":3,"file":"index.cjs","names":["z","IdentityException"],"sources":["../src/entitlements.ts","../src/schemas.ts","../src/wrprc-exception.ts","../src/builders.ts","../src/validator.ts","../src/signer.ts"],"sourcesContent":["/**\n * WRPRC Entitlement Constants\n *\n * Entitlement identifiers as defined in ETSI TS 119 475 Annex A.\n * These identifiers define the roles and capabilities of Wallet-Relying Parties.\n *\n * @see https://www.etsi.org/deliver/etsi_ts/119400_119499/119475/01.02.01_60/ts_119475v010201p.pdf\n */\n\n// ============================================================================\n// OID Base\n// ============================================================================\n\n/**\n * Base OID for ETSI WRPA entitlements: 0.4.0.19475\n * id-etsi-wrpa OBJECT IDENTIFIER ::= { itu-t(0) identified-organization(4) etsi(0) 19475 }\n */\nexport const ETSI_WRPA_BASE_OID = '0.4.0.19475'\n\n/**\n * OID arc for entitlements: 0.4.0.19475.1\n */\nexport const ETSI_WRPA_ENTITLEMENT_ARC = `${ETSI_WRPA_BASE_OID}.1`\n\n// ============================================================================\n// WRP Entitlement URIs (A.2)\n// ============================================================================\n\n/**\n * Service_Provider - General service provider (A.2.1)\n * OID: id-etsi-wrpa-entitlement 1\n */\nexport const ENTITLEMENT_SERVICE_PROVIDER = 'https://uri.etsi.org/19475/Entitlement/Service_Provider'\n\n/**\n * QEAA_Provider - Qualified trust service provider issuing qualified electronic attestations of attributes (A.2.2)\n * OID: id-etsi-wrpa-entitlement 2\n */\nexport const ENTITLEMENT_QEAA_PROVIDER = 'https://uri.etsi.org/19475/Entitlement/QEAA_Provider'\n\n/**\n * Non_Q_EAA_Provider - Trust service provider issuing non-qualified electronic attestations of attributes (A.2.3)\n * OID: id-etsi-wrpa-entitlement 3\n */\nexport const ENTITLEMENT_NON_Q_EAA_PROVIDER = 'https://uri.etsi.org/19475/Entitlement/Non_Q_EAA_Provider'\n\n/**\n * PUB_EAA_Provider - Public sector body or its agent issuing electronic attestations of attributes from authentic sources (A.2.4)\n * OID: id-etsi-wrpa-entitlement 4\n */\nexport const ENTITLEMENT_PUB_EAA_PROVIDER = 'https://uri.etsi.org/19475/Entitlement/PUB_EAA_Provider'\n\n/**\n * PID_Provider - Provider of person identification data (A.2.5)\n * OID: id-etsi-wrpa-entitlement 5\n */\nexport const ENTITLEMENT_PID_PROVIDER = 'https://uri.etsi.org/19475/Entitlement/PID_Provider'\n\n/**\n * QCert_for_ESeal_Provider - QTSP issuing qualified certificates for electronic seals (A.2.6)\n * OID: id-etsi-wrpa-entitlement 6\n */\nexport const ENTITLEMENT_QCERT_FOR_ESEAL_PROVIDER = 'https://uri.etsi.org/19475/Entitlement/QCert_for_ESeal_Provider'\n\n/**\n * QCert_for_ESig_Provider - QTSP issuing qualified certificates for electronic signatures (A.2.7)\n * OID: id-etsi-wrpa-entitlement 7\n */\nexport const ENTITLEMENT_QCERT_FOR_ESIG_PROVIDER = 'https://uri.etsi.org/19475/Entitlement/QCert_for_ESig_Provider'\n\n/**\n * rQSealCDs_Provider - QTSP managing remote qualified electronic seal creation devices (A.2.8)\n * OID: id-etsi-wrpa-entitlement 8\n */\nexport const ENTITLEMENT_RQSEALCDS_PROVIDER = 'https://uri.etsi.org/19475/Entitlement/rQSealCDs_Provider'\n\n/**\n * rQSigCDs_Provider - QTSP managing remote qualified electronic signature creation devices (A.2.9)\n * OID: id-etsi-wrpa-entitlement 9\n */\nexport const ENTITLEMENT_RQSIGCDS_PROVIDER = 'https://uri.etsi.org/19475/Entitlement/rQSigCDs_Provider'\n\n/**\n * ESig_ESeal_Creation_Provider - Non-qualified provider for remote signature/seal creation (A.2.10)\n * OID: id-etsi-wrpa-entitlement 10\n */\nexport const ENTITLEMENT_ESIG_ESEAL_CREATION_PROVIDER =\n  'https://uri.etsi.org/19475/Entitlement/ESig_ESeal_Creation_Provider'\n\n// ============================================================================\n// Entitlement Collection\n// ============================================================================\n\n/**\n * All standard WRP entitlements defined in ETSI TS 119 475\n */\nexport const WRP_ENTITLEMENTS = {\n  SERVICE_PROVIDER: ENTITLEMENT_SERVICE_PROVIDER,\n  QEAA_PROVIDER: ENTITLEMENT_QEAA_PROVIDER,\n  NON_Q_EAA_PROVIDER: ENTITLEMENT_NON_Q_EAA_PROVIDER,\n  PUB_EAA_PROVIDER: ENTITLEMENT_PUB_EAA_PROVIDER,\n  PID_PROVIDER: ENTITLEMENT_PID_PROVIDER,\n  QCERT_FOR_ESEAL_PROVIDER: ENTITLEMENT_QCERT_FOR_ESEAL_PROVIDER,\n  QCERT_FOR_ESIG_PROVIDER: ENTITLEMENT_QCERT_FOR_ESIG_PROVIDER,\n  RQSEALCDS_PROVIDER: ENTITLEMENT_RQSEALCDS_PROVIDER,\n  RQSIGCDS_PROVIDER: ENTITLEMENT_RQSIGCDS_PROVIDER,\n  ESIG_ESEAL_CREATION_PROVIDER: ENTITLEMENT_ESIG_ESEAL_CREATION_PROVIDER,\n} as const\n\n/**\n * List of all standard entitlement URIs\n */\nexport const ALL_ENTITLEMENTS = Object.values(WRP_ENTITLEMENTS)\n\n/**\n * Entitlements for attestation providers (QEAA, Non-Q EAA, PUB EAA, PID)\n */\nexport const ATTESTATION_PROVIDER_ENTITLEMENTS = [\n  ENTITLEMENT_QEAA_PROVIDER,\n  ENTITLEMENT_NON_Q_EAA_PROVIDER,\n  ENTITLEMENT_PUB_EAA_PROVIDER,\n  ENTITLEMENT_PID_PROVIDER,\n] as const\n\n// ============================================================================\n// Service Provider Sub-entitlements (A.3)\n// ============================================================================\n\n/**\n * Payment Service Provider Sub-entitlements (A.3.1)\n * As defined in ETSI TS 119 495\n */\nexport const PSP_SUB_ENTITLEMENTS = {\n  /** Account Servicing Payment Service Provider */\n  ACCOUNT_SERVICING: 'https://uri.etsi.org/19475/SubEntitlement/psp/psp-as',\n  /** Payment Initiation Service Provider */\n  PAYMENT_INITIATION: 'https://uri.etsi.org/19475/SubEntitlement/psp/psp-pi',\n  /** Account Information Service Provider */\n  ACCOUNT_INFORMATION: 'https://uri.etsi.org/19475/SubEntitlement/psp/psp-ai',\n  /** Payment Service Provider issuing card-based payment instruments */\n  CARD_BASED: 'https://uri.etsi.org/19475/SubEntitlement/psp/psp-ic',\n  /** Unspecified Payment Service Provider */\n  UNSPECIFIED: 'https://uri.etsi.org/19475/SubEntitlement/psp/unspecified',\n} as const\n\n/**\n * All PSP sub-entitlement URIs\n */\nexport const ALL_PSP_SUB_ENTITLEMENTS = Object.values(PSP_SUB_ENTITLEMENTS)\n\n// ============================================================================\n// Identifier Type URIs (B.2.5 Class Identifier)\n// ============================================================================\n\n/**\n * Identifier type URIs for legal person semantic identifiers\n */\nexport const IDENTIFIER_TYPES = {\n  /** Economic Operator Registration and Identification Number (EORI-No) */\n  EORI: 'http://data.europa.eu/eudi/id/EORI-No',\n  /** Legal Entity Identifier (LEI) */\n  LEI: 'http://data.europa.eu/eudi/id/LEI',\n  /** European Unique Identifier (EUID) */\n  EUID: 'http://data.europa.eu/eudi/id/EUID',\n  /** Value Added Tax Identification Number (VATIN) */\n  VATIN: 'http://data.europa.eu/eudi/id/VATIN',\n  /** Taxpayer Identification Number (TIN) */\n  TIN: 'http://data.europa.eu/eudi/id/TIN',\n  /** Excise Number */\n  EXCISE: 'http://data.europa.eu/eudi/id/Excise',\n} as const\n\n/**\n * Mapping from identifier type URIs to semantic identifier prefixes\n * as defined in ETSI EN 319 412-1\n */\nexport const IDENTIFIER_TYPE_TO_PREFIX: Record<string, string> = {\n  [IDENTIFIER_TYPES.EORI]: 'EOR',\n  [IDENTIFIER_TYPES.LEI]: 'LEI',\n  [IDENTIFIER_TYPES.EUID]: 'NTR',\n  [IDENTIFIER_TYPES.VATIN]: 'VAT',\n  [IDENTIFIER_TYPES.TIN]: 'TIN',\n  [IDENTIFIER_TYPES.EXCISE]: 'EXC',\n}\n\n// ============================================================================\n// Policy Type URIs (B.2.8 Class Policy)\n// ============================================================================\n\n/**\n * Policy type URIs\n */\nexport const POLICY_TYPES = {\n  /** Privacy Policy */\n  PRIVACY_POLICY: 'http://data.europa.eu/eudi/policy/privacy-policy',\n} as const\n\n// ============================================================================\n// Certificate Policy OIDs (clause 6.1.3)\n// ============================================================================\n\n/**\n * Base OID for WRPRC policies: 0.4.0.19475.3\n */\nexport const WRPRC_POLICY_BASE_OID = `${ETSI_WRPA_BASE_OID}.3`\n\n/**\n * WRPRC Policy OIDs\n */\nexport const WRPRC_POLICIES = {\n  /** WRPRC provider policy identifier */\n  WRPRC_PROVIDER: `${WRPRC_POLICY_BASE_OID}.1`,\n} as const\n\n// ============================================================================\n// Type Guards and Helpers\n// ============================================================================\n\n/**\n * Check if a given URI is a valid WRP entitlement\n */\nexport function isValidEntitlement(uri: string): boolean {\n  return ALL_ENTITLEMENTS.includes(uri as (typeof ALL_ENTITLEMENTS)[number])\n}\n\n/**\n * Check if a given URI is a PSP sub-entitlement\n */\nexport function isPSPSubEntitlement(uri: string): boolean {\n  return ALL_PSP_SUB_ENTITLEMENTS.includes(uri as (typeof ALL_PSP_SUB_ENTITLEMENTS)[number])\n}\n\n/**\n * Check if entitlements include an attestation provider role\n */\nexport function hasAttestationProviderEntitlement(entitlements: string[]): boolean {\n  return entitlements.some((e) =>\n    ATTESTATION_PROVIDER_ENTITLEMENTS.includes(e as (typeof ATTESTATION_PROVIDER_ENTITLEMENTS)[number])\n  )\n}\n\n/**\n * Get the semantic identifier prefix for a given identifier type URI\n */\nexport function getIdentifierPrefix(typeUri: string): string | undefined {\n  return IDENTIFIER_TYPE_TO_PREFIX[typeUri]\n}\n","/**\n * WRPRC Zod Schemas\n *\n * Zod schemas for ETSI TS 119 475 (Wallet-Relying Party Registration Certificates).\n * Types are derived from these schemas via z.infer<>.\n *\n * @see https://www.etsi.org/deliver/etsi_ts/119400_119499/119475/01.02.01_60/ts_119475v010201p.pdf\n */\n\nimport { z } from 'zod'\n\n// ============================================================================\n// Multilingual Value Schemas\n// ============================================================================\n\n/**\n * Multilingual string schema (B.2.6 Class MultiLangString)\n */\nexport const MultiLangStringSchema = z.object({\n  /** Language code per BCP47/RFC 5646 */\n  lang: z.string().min(2),\n  /** Localized string value */\n  content: z.string().min(1),\n})\n\n// ============================================================================\n// Identity Schemas\n// ============================================================================\n\n/**\n * Supervisory Authority schema for Data Protection Authority\n */\nexport const SupervisoryAuthoritySchema = z.object({\n  /** Email address of the Data Protection Authority */\n  email: z.email().optional(),\n  /** Telephone number of the Data Protection Authority */\n  phone: z.string().optional(),\n  /** URL of web form provided by the Data Protection Authority */\n  uri: z.url().optional(),\n})\n\n/**\n * Claim schema for credential attribute specification (B.2.10 Class Claim)\n */\nexport const ClaimSchema = z.object({\n  /** Path pointer that specifies the path to a claim within the Credential */\n  path: z.array(z.string()).min(1),\n  /** Array of expected values of the claim */\n  values: z.array(z.union([z.string(), z.number(), z.boolean()])).optional(),\n})\n\n/**\n * Credential schema for attestations (B.2.9 Class Credential)\n */\nexport const CredentialSchema = z.object({\n  /** Format of the attestation (e.g., \"dc+sd-jwt\", \"mso_mdoc\") */\n  format: z.string().min(1),\n  /** Object defining additional properties per Credential Format */\n  meta: z.record(z.string(), z.unknown()),\n  /** Array of claim objects specifying requestable attributes */\n  claim: z.array(ClaimSchema).optional(),\n})\n\n/**\n * Status list reference for certificate validity\n */\nexport const StatusListSchema = z.object({\n  /** Index in the status list */\n  idx: z.number().int().nonnegative(),\n  /** URI to the status list */\n  uri: z.url(),\n})\n\n/**\n * Status schema for WRPRC validity\n */\nexport const StatusSchema = z.object({\n  status_list: StatusListSchema,\n})\n\n/**\n * Intermediary information when WRP acts through an intermediary\n */\nexport const IntermediarySchema = z.object({\n  /** Identifier of the intermediary */\n  sub: z.string().min(1),\n  /** Name of the intermediary */\n  name: z.string().min(1),\n})\n\n// ============================================================================\n// WRPRC Payload Schema\n// ============================================================================\n\n/**\n * WRPRC Payload schema according to ETSI TS 119 475 clause 5.2.4\n */\nexport const WRPRCPayloadSchema = z.object({\n  /** The subject trade name of the WRPRC (B.2.1 tradeName) */\n  name: z.string().min(1),\n\n  /** Legal name for legal person (B.2.3 legalName) */\n  sub_ln: z.string().optional(),\n\n  /** Given name for natural person (B.2.4 givenName) */\n  sub_gn: z.string().optional(),\n\n  /** Family name for natural person (B.2.4 familyName) */\n  sub_fn: z.string().optional(),\n\n  /** WRP identifier following semantic identifier rules */\n  sub: z.string().min(1),\n\n  /** Country code (ISO 3166-1 Alpha-2) */\n  country: z.string().length(2),\n\n  /** URL pointing to the national registry API endpoint */\n  registry_uri: z.url(),\n\n  /** Descriptions of the services provided by the WRP */\n  srv_description: z.array(z.array(MultiLangStringSchema)).optional(),\n\n  /** List of entitlements assigned to the WRP */\n  entitlements: z.array(z.url()).min(1),\n\n  /** URL to the WRP's privacy policy */\n  privacy_policy: z.url().optional(),\n\n  /** URL general-purpose web address */\n  info_uri: z.url().optional(),\n\n  /** URL or email for data deletion/portability requests */\n  support_uri: z.url().or(z.email()).optional(),\n\n  /** Data Protection Authority supervising the WRP */\n  supervisory_authority: SupervisoryAuthoritySchema.optional(),\n\n  /** Policy identifier as defined in clause 6.1.3 */\n  policy_id: z.array(z.string()).optional(),\n\n  /** URL to the certificate policy and practice statement */\n  certificate_policy: z.url().optional(),\n\n  /** Unix timestamp indicating when the WRPRC was issued */\n  iat: z.number().int().positive(),\n\n  /** Status list for WRPRC validity */\n  status: StatusSchema.optional(),\n\n  /** Purpose of the intended data processing */\n  purpose: z.array(MultiLangStringSchema).optional(),\n\n  /** Set of credentials intended to be requested by the WRP */\n  credentials: z.array(CredentialSchema).optional(),\n\n  /** Set of credentials issued by the WRP (for attestation providers) */\n  provides_attestations: z.array(CredentialSchema).optional(),\n\n  /** Intermediary information when WRP acts through an intermediary */\n  intermediary: IntermediarySchema.optional(),\n})\n\n// ============================================================================\n// WRPRC Header Schemas\n// ============================================================================\n\n/**\n * JWT Header schema according to ETSI TS 119 475 clause 5.2.2\n */\nexport const WRPRCJWTHeaderSchema = z.object({\n  /** Type of the Web Token - must be \"rc-wrp+jwt\" for JWT */\n  typ: z.literal('rc-wrp+jwt'),\n  /** Algorithm used to sign the JWT */\n  alg: z.enum(['ES256', 'ES384', 'ES512', 'RS256', 'RS384', 'RS512']),\n  /** Certificate chain to verify the JWT */\n  x5c: z.array(z.string()).min(1),\n  /** Key ID */\n  kid: z.string().optional(),\n})\n\n/**\n * CWT Header schema according to ETSI TS 119 475 clause 5.2.3\n */\nexport const WRPRCCWTHeaderSchema = z.object({\n  /** Type of the Web Token - must be \"rc-wrp+cwt\" for CWT */\n  typ: z.literal('rc-wrp+cwt'),\n  /** Algorithm used to sign the CWT per RFC 9052 */\n  alg: z.number().int(),\n  /** Certificate chain to verify the CWT per RFC 9360 */\n  x5chain: z.array(z.instanceof(Uint8Array)).min(1),\n})\n\n// ============================================================================\n// Complete WRPRC Document Schemas\n// ============================================================================\n\n/**\n * Complete JWT WRPRC schema\n */\nexport const WRPRCJWTSchema = z.object({\n  header: WRPRCJWTHeaderSchema,\n  payload: WRPRCPayloadSchema,\n})\n\n/**\n * Complete CWT WRPRC schema\n */\nexport const WRPRCCWTSchema = z.object({\n  header: WRPRCCWTHeaderSchema,\n  payload: WRPRCPayloadSchema,\n})\n\n// ============================================================================\n// Legal Person Subject Schema (for validation)\n// ============================================================================\n\n/**\n * Schema for legal person WRPRC subject\n */\nexport const LegalPersonSubjectSchema = WRPRCPayloadSchema.extend({\n  sub_ln: z.string().min(1),\n}).omit({\n  sub_gn: true,\n  sub_fn: true,\n})\n\n/**\n * Schema for natural person WRPRC subject\n */\nexport const NaturalPersonSubjectSchema = WRPRCPayloadSchema.extend({\n  sub_gn: z.string().min(1),\n  sub_fn: z.string().min(1),\n}).omit({\n  sub_ln: true,\n})\n","import { IdentityException } from '@owf/identity-common'\n\n/**\n * WRPRCException is a custom error class for WRPRC-related exceptions.\n */\nexport class WRPRCException extends IdentityException {\n  constructor(message: string, details?: unknown) {\n    super(message, details)\n    Object.setPrototypeOf(this, WRPRCException.prototype)\n    this.name = 'WRPRCException'\n  }\n}\n","/**\n * WRPRC Builders\n *\n * Fluent builders for creating ETSI TS 119 475 Wallet-Relying Party Registration Certificates.\n *\n * @see https://www.etsi.org/deliver/etsi_ts/119400_119499/119475/01.02.01_60/ts_119475v010201p.pdf\n */\n\nimport { ENTITLEMENT_SERVICE_PROVIDER, type WRP_ENTITLEMENTS } from './entitlements'\nimport { WRPRCPayloadSchema } from './schemas'\nimport type {\n  Claim,\n  Credential,\n  Intermediary,\n  LegalPersonWRPRCInput,\n  MultiLangString,\n  NaturalPersonWRPRCInput,\n  Status,\n  SupervisoryAuthority,\n  WRPRCPayload,\n} from './types'\nimport { WRPRCException } from './wrprc-exception'\n\n// ============================================================================\n// Partial Payload Type\n// ============================================================================\n\n/**\n * A partial WRPRC payload used during building\n */\ninterface PartialWRPRCPayload {\n  name?: string\n  sub_ln?: string\n  sub_gn?: string\n  sub_fn?: string\n  sub?: string\n  country?: string\n  registry_uri?: string\n  srv_description?: MultiLangString[][]\n  entitlements?: string[]\n  privacy_policy?: string\n  info_uri?: string\n  support_uri?: string\n  supervisory_authority?: SupervisoryAuthority\n  policy_id?: string[]\n  certificate_policy?: string\n  iat?: number\n  status?: Status\n  purpose?: MultiLangString[]\n  credentials?: Credential[]\n  provides_attestations?: string[]\n  intermediary?: Intermediary\n}\n\n// ============================================================================\n// WRPRC Payload Builder\n// ============================================================================\n\n/**\n * Builder for creating WRPRC payloads with a fluent API\n */\nexport class WRPRCBuilder {\n  private payload: PartialWRPRCPayload = {}\n\n  /**\n   * Set the trade name (display name) of the WRP\n   */\n  name(value: string): this {\n    this.payload.name = value\n    return this\n  }\n\n  /**\n   * Set the legal name for a legal person WRP\n   */\n  legalName(value: string): this {\n    this.payload.sub_ln = value\n    return this\n  }\n\n  /**\n   * Set the given name for a natural person WRP\n   */\n  givenName(value: string): this {\n    this.payload.sub_gn = value\n    return this\n  }\n\n  /**\n   * Set the family name for a natural person WRP\n   */\n  familyName(value: string): this {\n    this.payload.sub_fn = value\n    return this\n  }\n\n  /**\n   * Set the WRP identifier (semantic identifier)\n   *\n   * @param identifier - The semantic identifier following ETSI EN 319 412-1\n   *                     Format: PREFIX (3 chars) + COUNTRY (2 chars) + \"-\" + ID\n   *                     Examples: \"LEIXG-529900T8BM49AURSDO55\", \"TINIT-RSSMRA85T10A562S\"\n   */\n  identifier(identifier: string): this {\n    this.payload.sub = identifier\n    return this\n  }\n\n  /**\n   * Set the country code (ISO 3166-1 Alpha-2)\n   */\n  country(code: string): this {\n    this.payload.country = code\n    return this\n  }\n\n  /**\n   * Set the URL to the national registry API endpoint\n   */\n  registryUri(uri: string): this {\n    this.payload.registry_uri = uri\n    return this\n  }\n\n  /**\n   * Add a service description in a specific language\n   */\n  serviceDescription(description: string, lang = 'en'): this {\n    this.payload.srv_description = this.payload.srv_description ?? []\n    // Each service description is an array of localized strings\n    const existing = this.payload.srv_description.find((group) => group.some((d) => d.lang === lang))\n    if (existing) {\n      existing.push({ lang, content: description })\n    } else {\n      this.payload.srv_description.push([{ lang, content: description }])\n    }\n    return this\n  }\n\n  /**\n   * Add multiple service descriptions (one array per service, with multiple languages)\n   */\n  addServiceDescriptions(descriptions: MultiLangString[]): this {\n    this.payload.srv_description = this.payload.srv_description ?? []\n    this.payload.srv_description.push(descriptions)\n    return this\n  }\n\n  /**\n   * Add an entitlement\n   *\n   * @param entitlement - The entitlement URI or key from WRP_ENTITLEMENTS\n   */\n  addEntitlement(entitlement: string | (typeof WRP_ENTITLEMENTS)[keyof typeof WRP_ENTITLEMENTS]): this {\n    this.payload.entitlements = this.payload.entitlements ?? []\n    if (!this.payload.entitlements.includes(entitlement)) {\n      this.payload.entitlements.push(entitlement)\n    }\n    return this\n  }\n\n  /**\n   * Set all entitlements (replaces existing)\n   */\n  entitlements(entitlements: string[]): this {\n    this.payload.entitlements = [...entitlements]\n    return this\n  }\n\n  /**\n   * Set the privacy policy URL\n   */\n  privacyPolicy(uri: string): this {\n    this.payload.privacy_policy = uri\n    return this\n  }\n\n  /**\n   * Set the info URI (general-purpose web address)\n   */\n  infoUri(uri: string): this {\n    this.payload.info_uri = uri\n    return this\n  }\n\n  /**\n   * Set the support URI for data requests\n   */\n  supportUri(uri: string): this {\n    this.payload.support_uri = uri\n    return this\n  }\n\n  /**\n   * Set the supervisory authority (Data Protection Authority)\n   */\n  supervisoryAuthority(authority: SupervisoryAuthority): this {\n    this.payload.supervisory_authority = authority\n    return this\n  }\n\n  /**\n   * Set the policy ID(s)\n   */\n  policyId(ids: string[]): this {\n    this.payload.policy_id = ids\n    return this\n  }\n\n  /**\n   * Set the certificate policy URL\n   */\n  certificatePolicy(uri: string): this {\n    this.payload.certificate_policy = uri\n    return this\n  }\n\n  /**\n   * Set the issued-at timestamp (Unix timestamp)\n   * If not set, will default to current time when building\n   */\n  issuedAt(timestamp: number | Date): this {\n    this.payload.iat = typeof timestamp === 'number' ? timestamp : Math.floor(timestamp.getTime() / 1000)\n    return this\n  }\n\n  /**\n   * Set the status reference for certificate validity\n   */\n  status(status: Status): this {\n    this.payload.status = status\n    return this\n  }\n\n  /**\n   * Add a purpose description\n   */\n  addPurpose(description: string, lang = 'en'): this {\n    this.payload.purpose = this.payload.purpose ?? []\n    this.payload.purpose.push({ lang, content: description })\n    return this\n  }\n\n  /**\n   * Set all purposes (replaces existing)\n   */\n  purposes(purposes: MultiLangString[]): this {\n    this.payload.purpose = purposes\n    return this\n  }\n\n  /**\n   * Add a credential that the WRP intends to request\n   */\n  addCredential(credential: Credential): this {\n    this.payload.credentials = this.payload.credentials ?? []\n    this.payload.credentials.push(credential)\n    return this\n  }\n\n  /**\n   * Add a schema metadata that the WRP provides (for attestation providers)\n   */\n  addProvidedAttestation(schemaMetadata: string): this {\n    this.payload.provides_attestations = this.payload.provides_attestations ?? []\n    this.payload.provides_attestations.push(schemaMetadata)\n    return this\n  }\n\n  /**\n   * Set intermediary information\n   */\n  intermediary(intermediary: Intermediary): this {\n    this.payload.intermediary = intermediary\n    return this\n  }\n\n  /**\n   * Build the WRPRC payload\n   *\n   * @throws WRPRCException if the payload is invalid\n   */\n  build(): WRPRCPayload {\n    // Set default iat if not provided\n    if (!this.payload.iat) {\n      this.payload.iat = Math.floor(Date.now() / 1000)\n    }\n\n    const result = WRPRCPayloadSchema.safeParse(this.payload)\n\n    if (!result.success) {\n      const messages = result.error.issues.map((i) => `${i.path.join('.')}: ${i.message}`).join('\\n')\n      throw new WRPRCException(`Invalid WRPRC payload:\\n${messages}`, result.error.issues)\n    }\n\n    return result.data\n  }\n}\n\n// ============================================================================\n// Credential Builder\n// ============================================================================\n\n/**\n * Builder for creating Credential objects\n */\nexport class CredentialBuilder {\n  private credential: Partial<Credential> = {}\n\n  /**\n   * Set the credential format\n   *\n   * @param format - The format identifier (e.g., \"dc+sd-jwt\", \"mso_mdoc\")\n   */\n  format(format: string): this {\n    this.credential.format = format\n    return this\n  }\n\n  /**\n   * Set the credential metadata\n   *\n   * @param meta - Metadata object per credential format specification\n   */\n  meta(meta: Record<string, unknown>): this {\n    this.credential.meta = meta\n    return this\n  }\n\n  /**\n   * Set SD-JWT credential metadata (vct_values)\n   */\n  sdJwtMeta(vctValues: string[]): this {\n    this.credential.format = 'dc+sd-jwt'\n    this.credential.meta = { vct_values: vctValues }\n    return this\n  }\n\n  /**\n   * Set mDL/mDoc credential metadata (doctype_value)\n   */\n  mdocMeta(doctypeValue: string): this {\n    this.credential.format = 'mso_mdoc'\n    this.credential.meta = { doctype_value: doctypeValue }\n    return this\n  }\n\n  /**\n   * Add a claim to request\n   */\n  addClaim(claim: Claim): this {\n    this.credential.claim = this.credential.claim ?? []\n    this.credential.claim.push(claim)\n    return this\n  }\n\n  /**\n   * Add a simple path claim\n   */\n  addPathClaim(...path: string[]): this {\n    this.credential.claim = this.credential.claim ?? []\n    this.credential.claim.push({ path })\n    return this\n  }\n\n  /**\n   * Build the Credential object\n   */\n  build(): Credential {\n    if (!this.credential.format) {\n      throw new WRPRCException('Credential format is required')\n    }\n    if (!this.credential.meta) {\n      throw new WRPRCException('Credential meta is required')\n    }\n    return this.credential as Credential\n  }\n}\n\n// ============================================================================\n// Factory Functions\n// ============================================================================\n\n/**\n * Create a new WRPRCBuilder\n */\nexport function wrprc(): WRPRCBuilder {\n  return new WRPRCBuilder()\n}\n\n/**\n * Create a new CredentialBuilder\n */\nexport function credential(): CredentialBuilder {\n  return new CredentialBuilder()\n}\n\n/**\n * Create a WRPRC payload for a legal person\n */\nexport function createLegalPersonWRPRC(input: LegalPersonWRPRCInput): WRPRCPayload {\n  return wrprc()\n    .name(input.name)\n    .legalName(input.legalName)\n    .identifier(input.identifier)\n    .country(input.country)\n    .registryUri(input.registryUri)\n    .entitlements(input.entitlements)\n    .build()\n}\n\n/**\n * Create a WRPRC payload for a natural person\n */\nexport function createNaturalPersonWRPRC(input: NaturalPersonWRPRCInput): WRPRCPayload {\n  return wrprc()\n    .name(input.name)\n    .givenName(input.givenName)\n    .familyName(input.familyName)\n    .identifier(input.identifier)\n    .country(input.country)\n    .registryUri(input.registryUri)\n    .entitlements(input.entitlements)\n    .build()\n}\n\n/**\n * Create a simple service provider WRPRC\n */\nexport function createServiceProviderWRPRC(\n  name: string,\n  legalName: string,\n  identifier: string,\n  country: string,\n  registryUri: string\n): WRPRCPayload {\n  return wrprc()\n    .name(name)\n    .legalName(legalName)\n    .identifier(identifier)\n    .country(country)\n    .registryUri(registryUri)\n    .addEntitlement(ENTITLEMENT_SERVICE_PROVIDER)\n    .build()\n}\n","/**\n * WRPRC Validator\n *\n * Validation functions for ETSI TS 119 475 Wallet-Relying Party Registration Certificates.\n *\n * @see https://www.etsi.org/deliver/etsi_ts/119400_119499/119475/01.02.01_60/ts_119475v010201p.pdf\n */\n\nimport { ALL_ENTITLEMENTS, ALL_PSP_SUB_ENTITLEMENTS, ATTESTATION_PROVIDER_ENTITLEMENTS } from './entitlements'\nimport {\n  LegalPersonSubjectSchema,\n  NaturalPersonSubjectSchema,\n  WRPRCJWTHeaderSchema,\n  WRPRCPayloadSchema,\n} from './schemas'\nimport type { WRPRCPayload } from './types'\nimport { WRPRCException } from './wrprc-exception'\n\n// ============================================================================\n// Validation Result Types\n// ============================================================================\n\n/**\n * A single validation error\n */\nexport interface ValidationError {\n  /** Path to the invalid field */\n  path: string[]\n  /** Error message */\n  message: string\n  /** Error code */\n  code: string\n}\n\n/**\n * Result of WRPRC validation\n */\nexport interface ValidationResult {\n  /** Whether the WRPRC is valid */\n  valid: boolean\n  /** List of validation errors (empty if valid) */\n  errors: ValidationError[]\n  /** Warnings that don't invalidate the certificate but should be noted */\n  warnings: ValidationError[]\n}\n\n// ============================================================================\n// Core Validation Functions\n// ============================================================================\n\n/**\n * Validate a WRPRC payload against the schema\n */\nexport function validateWRPRCPayload(payload: unknown): ValidationResult {\n  const result = WRPRCPayloadSchema.safeParse(payload)\n  const errors: ValidationError[] = []\n  const warnings: ValidationError[] = []\n\n  if (!result.success) {\n    for (const issue of result.error.issues) {\n      errors.push({\n        path: issue.path.map(String),\n        message: issue.message,\n        code: issue.code,\n      })\n    }\n    return { valid: false, errors, warnings }\n  }\n\n  // Additional semantic validations\n  const validPayload: WRPRCPayload = result.data\n\n  // Check entitlements are valid URIs from the standard\n  for (const entitlement of validPayload.entitlements) {\n    if (!ALL_ENTITLEMENTS.includes(entitlement as (typeof ALL_ENTITLEMENTS)[number])) {\n      // Check if it's a sub-entitlement\n      if (!ALL_PSP_SUB_ENTITLEMENTS.includes(entitlement as (typeof ALL_PSP_SUB_ENTITLEMENTS)[number])) {\n        warnings.push({\n          path: ['entitlements'],\n          message: `Unknown entitlement URI: ${entitlement}. This may be a national or EU-defined extension.`,\n          code: 'unknown_entitlement',\n        })\n      }\n    }\n  }\n\n  // GEN-5.2.4-03: At least one entitlement must be specified\n  if (validPayload.entitlements.length === 0) {\n    errors.push({\n      path: ['entitlements'],\n      message: 'At least one entitlement must be specified (GEN-5.2.4-03)',\n      code: 'missing_entitlement',\n    })\n  }\n\n  // GEN-5.2.4-04: If sub-entitlements are present, a base entitlement must also be present\n  const hasSubEntitlement = validPayload.entitlements.some((e) =>\n    ALL_PSP_SUB_ENTITLEMENTS.includes(e as (typeof ALL_PSP_SUB_ENTITLEMENTS)[number])\n  )\n  const hasServiceProvider = validPayload.entitlements.includes(\n    'https://uri.etsi.org/19475/Entitlement/Service_Provider'\n  )\n  if (hasSubEntitlement && !hasServiceProvider) {\n    errors.push({\n      path: ['entitlements'],\n      message: 'Service provider sub-entitlements require Service_Provider entitlement (GEN-5.2.4-04)',\n      code: 'missing_base_entitlement',\n    })\n  }\n\n  // GEN-5.2.4-05: Attestation providers should have provides_attestations\n  const hasAttestationProviderRole = validPayload.entitlements.some((e) =>\n    ATTESTATION_PROVIDER_ENTITLEMENTS.includes(e as (typeof ATTESTATION_PROVIDER_ENTITLEMENTS)[number])\n  )\n  if (hasAttestationProviderRole && !validPayload.provides_attestations) {\n    warnings.push({\n      path: ['provides_attestations'],\n      message:\n        'Attestation providers should include provides_attestations field (GEN-5.2.4-05). This is recommended but not required.',\n      code: 'missing_provides_attestations',\n    })\n  }\n\n  // Validate subject identifier format (semantic identifier)\n  const subResult = validateSemanticIdentifier(validPayload.sub)\n  if (!subResult.valid) {\n    errors.push({\n      path: ['sub'],\n      message: subResult.message,\n      code: 'invalid_semantic_identifier',\n    })\n  }\n\n  return { valid: errors.length === 0, errors, warnings }\n}\n\n/**\n * Validate a JWT header for WRPRC\n */\nexport function validateWRPRCJWTHeader(header: unknown): ValidationResult {\n  const result = WRPRCJWTHeaderSchema.safeParse(header)\n  const errors: ValidationError[] = []\n  const warnings: ValidationError[] = []\n\n  if (!result.success) {\n    for (const issue of result.error.issues) {\n      errors.push({\n        path: issue.path.map(String),\n        message: issue.message,\n        code: issue.code,\n      })\n    }\n  }\n\n  return { valid: errors.length === 0, errors, warnings }\n}\n\n/**\n * Validate a complete WRPRC (header + payload)\n */\nexport function validateWRPRC(header: unknown, payload: unknown): ValidationResult {\n  const headerResult = validateWRPRCJWTHeader(header)\n  const payloadResult = validateWRPRCPayload(payload)\n\n  const errors = [\n    ...headerResult.errors.map((e) => ({ ...e, path: ['header', ...e.path] })),\n    ...payloadResult.errors.map((e) => ({ ...e, path: ['payload', ...e.path] })),\n  ]\n\n  const warnings = [\n    ...headerResult.warnings.map((w) => ({ ...w, path: ['header', ...w.path] })),\n    ...payloadResult.warnings.map((w) => ({ ...w, path: ['payload', ...w.path] })),\n  ]\n\n  return { valid: errors.length === 0, errors, warnings }\n}\n\n// ============================================================================\n// Subject Type Validation\n// ============================================================================\n\n/**\n * Check if payload represents a legal person\n */\nexport function isLegalPersonWRPRC(payload: WRPRCPayload): boolean {\n  return typeof payload.sub_ln === 'string' && payload.sub_ln.length > 0\n}\n\n/**\n * Check if payload represents a natural person\n */\nexport function isNaturalPersonWRPRC(payload: WRPRCPayload): boolean {\n  return (\n    typeof payload.sub_gn === 'string' &&\n    payload.sub_gn.length > 0 &&\n    typeof payload.sub_fn === 'string' &&\n    payload.sub_fn.length > 0\n  )\n}\n\n/**\n * Validate as legal person WRPRC\n */\nexport function validateLegalPersonWRPRC(payload: unknown): ValidationResult {\n  const result = LegalPersonSubjectSchema.safeParse(payload)\n  const errors: ValidationError[] = []\n  const warnings: ValidationError[] = []\n\n  if (!result.success) {\n    for (const issue of result.error.issues) {\n      errors.push({\n        path: issue.path.map(String),\n        message: issue.message,\n        code: issue.code,\n      })\n    }\n  }\n\n  // Additional validation for legal person identifier format\n  if (result.success) {\n    const sub: string = result.data.sub\n    // Legal person identifiers should follow ETSI EN 319 412-1 clause 5.1.4\n    // Format: 3-letter prefix + 2-letter country code + hyphen + identifier\n    if (!/^[A-Z]{3}[A-Z]{2}-.+$/.test(sub)) {\n      warnings.push({\n        path: ['sub'],\n        message:\n          'Legal person identifier should follow format: PREFIX + COUNTRY + \"-\" + ID (e.g., \"LEIXG-529900T8BM49AURSDO55\")',\n        code: 'identifier_format_warning',\n      })\n    }\n  }\n\n  return { valid: errors.length === 0, errors, warnings }\n}\n\n/**\n * Validate as natural person WRPRC\n */\nexport function validateNaturalPersonWRPRC(payload: unknown): ValidationResult {\n  const result = NaturalPersonSubjectSchema.safeParse(payload)\n  const errors: ValidationError[] = []\n  const warnings: ValidationError[] = []\n\n  if (!result.success) {\n    for (const issue of result.error.issues) {\n      errors.push({\n        path: issue.path.map(String),\n        message: issue.message,\n        code: issue.code,\n      })\n    }\n  }\n\n  // Additional validation for natural person identifier format\n  if (result.success) {\n    const sub: string = result.data.sub\n    // Natural person identifiers should follow ETSI EN 319 412-1 clause 5.1.3\n    // Format: 3-letter prefix + 2-letter country code + hyphen + identifier\n    if (!/^[A-Z]{3}[A-Z]{2}-.+$/.test(sub)) {\n      warnings.push({\n        path: ['sub'],\n        message:\n          'Natural person identifier should follow format: PREFIX + COUNTRY + \"-\" + ID (e.g., \"TINIT-RSSMRA85T10A562S\")',\n        code: 'identifier_format_warning',\n      })\n    }\n  }\n\n  return { valid: errors.length === 0, errors, warnings }\n}\n\n// ============================================================================\n// Semantic Identifier Validation\n// ============================================================================\n\n/**\n * Valid semantic identifier prefixes for legal persons (ETSI EN 319 412-1 clause 5.1.4)\n */\nconst LEGAL_PERSON_PREFIXES = ['EOR', 'LEI', 'NTR', 'VAT', 'TIN', 'EXC']\n\n/**\n * Valid semantic identifier prefixes for natural persons (ETSI EN 319 412-1 clause 5.1.3)\n */\nconst NATURAL_PERSON_PREFIXES = ['TIN', 'PAS', 'IDC', 'PNO', 'TAX']\n\n/**\n * Validate a semantic identifier format\n */\nfunction validateSemanticIdentifier(identifier: string): { valid: boolean; message: string } {\n  // Format: PREFIX (3 chars) + COUNTRY (2 chars) + \"-\" + ID\n  const match = identifier.match(/^([A-Z]{3})([A-Z]{2})-(.+)$/)\n\n  if (!match) {\n    return {\n      valid: false,\n      message: 'Semantic identifier must follow format: PREFIX (3 chars) + COUNTRY (2 chars) + \"-\" + ID',\n    }\n  }\n\n  const [, prefix, , id] = match\n\n  // Check if prefix is known\n  const allPrefixes = [...LEGAL_PERSON_PREFIXES, ...NATURAL_PERSON_PREFIXES]\n  if (!allPrefixes.includes(prefix)) {\n    // Unknown prefix is allowed per spec (national schemes may define additional prefixes)\n    // but we validate the format is correct\n  }\n\n  if (!id || id.length === 0) {\n    return {\n      valid: false,\n      message: 'Semantic identifier must have a non-empty ID part after the hyphen',\n    }\n  }\n\n  return { valid: true, message: '' }\n}\n\n// ============================================================================\n// Assertion Functions\n// ============================================================================\n\n/**\n * Assert that a WRPRC payload is valid, throws WRPRCException if not\n */\nexport function assertValidWRPRCPayload(payload: unknown): asserts payload is WRPRCPayload {\n  const result = validateWRPRCPayload(payload)\n  if (!result.valid) {\n    const messages = result.errors.map((e) => `${e.path.join('.')}: ${e.message}`).join('\\n')\n    throw new WRPRCException(`Invalid WRPRC payload:\\n${messages}`, result.errors)\n  }\n}\n\n/**\n * Assert that a WRPRC is valid (header + payload), throws WRPRCException if not\n */\nexport function assertValidWRPRC(header: unknown, payload: unknown): void {\n  const result = validateWRPRC(header, payload)\n  if (!result.valid) {\n    const messages = result.errors.map((e) => `${e.path.join('.')}: ${e.message}`).join('\\n')\n    throw new WRPRCException(`Invalid WRPRC:\\n${messages}`, result.errors)\n  }\n}\n","/**\n * WRPRC Signer\n *\n * Functions for creating and signing ETSI TS 119 475 Wallet-Relying Party Registration Certificates.\n *\n * @see https://www.etsi.org/deliver/etsi_ts/119400_119499/119475/01.02.01_60/ts_119475v010201p.pdf\n */\n\nimport { pemToDer } from '@owf/crypto'\nimport { base64urlEncode, decodeJwt } from '@owf/identity-common'\nimport type { SignedWRPRC, SignOptions, WRPRCJWTHeader, WRPRCPayload } from './types'\nimport { assertValidWRPRCPayload } from './validator'\nimport { WRPRCException } from './wrprc-exception'\n\n// ============================================================================\n// JWT Signing\n// ============================================================================\n\n/**\n * Sign a WRPRC payload to create a JWT\n *\n * @param options - Signing options including payload, algorithm, certificates, and signer\n * @returns Signed WRPRC with JWS string and decoded parts\n */\nexport async function signWRPRC(options: SignOptions): Promise<SignedWRPRC> {\n  const { payload, algorithm = 'ES256', certificates, keyId, signer } = options\n\n  // Validate payload\n  assertValidWRPRCPayload(payload)\n\n  if (!certificates || certificates.length === 0) {\n    throw new WRPRCException('At least one certificate is required for x5c header')\n  }\n\n  // Extract base64 content from PEM certificates\n  const x5c = certificates.map((cert) => {\n    const content = pemToDer(cert)\n    if (!content) {\n      throw new WRPRCException('Invalid PEM certificate format')\n    }\n    return content\n  })\n\n  // Create JWT header\n  const header: WRPRCJWTHeader = {\n    typ: 'rc-wrp+jwt',\n    alg: algorithm,\n    x5c,\n    ...(keyId && { kid: keyId }),\n  }\n\n  // Encode header and payload\n  const encodedHeader = base64urlEncode(JSON.stringify(header))\n  const encodedPayload = base64urlEncode(JSON.stringify(payload))\n  const signingInput = `${encodedHeader}.${encodedPayload}`\n\n  // Sign\n  const signature = await signer(signingInput)\n\n  // Create compact JWS\n  const jws = `${signingInput}.${signature}`\n\n  return {\n    jws,\n    header,\n    payload,\n  }\n}\n\n// ============================================================================\n// JWT Decoding\n// ============================================================================\n\n/**\n * Decode a signed WRPRC JWT (without verification)\n *\n * @param jws - The compact JWS string\n * @returns Decoded WRPRC with header and payload\n */\nexport function decodeWRPRC(jws: string): SignedWRPRC {\n  const decoded = decodeJwt(jws)\n\n  // Validate typ header\n  if (decoded.header.typ !== 'rc-wrp+jwt') {\n    throw new WRPRCException(`Invalid WRPRC type: expected \"rc-wrp+jwt\", got \"${decoded.header.typ}\"`)\n  }\n\n  // Validate payload structure\n  assertValidWRPRCPayload(decoded.payload)\n\n  return {\n    jws,\n    header: decoded.header as WRPRCJWTHeader,\n    payload: decoded.payload as WRPRCPayload,\n  }\n}\n\n/**\n * Parse a WRPRC JWT without validation (for inspection purposes)\n *\n * @param jws - The compact JWS string\n * @returns Decoded parts without validation\n */\nexport function parseWRPRC(jws: string): { header: unknown; payload: unknown; signature: string } {\n  const decoded = decodeJwt(jws)\n  const parts = jws.split('.')\n\n  return {\n    header: decoded.header,\n    payload: decoded.payload,\n    signature: parts[2],\n  }\n}\n\n// ============================================================================\n// WRPRC Creation Helpers\n// ============================================================================\n\n/**\n * Create a WRPRC with automatic timestamp\n *\n * @param payload - Partial payload (iat will be set automatically if not provided)\n * @returns Complete payload with timestamp\n */\nexport function createWRPRCPayload(payload: Omit<WRPRCPayload, 'iat'> & { iat?: number }): WRPRCPayload {\n  const completePayload: WRPRCPayload = {\n    ...payload,\n    iat: payload.iat ?? Math.floor(Date.now() / 1000),\n  }\n\n  assertValidWRPRCPayload(completePayload)\n\n  return completePayload\n}\n"],"mappings":";;;;;;;;AAgCA,MAAa,+BAA+B;;;;;AAM5C,MAAa,4BAA4B;;;;;AAMzC,MAAa,iCAAiC;;;;;AAM9C,MAAa,+BAA+B;;;;;AAM5C,MAAa,2BAA2B;;;;AAwCxC,MAAa,mBAAmB;CAC9B,kBAAkB;CAClB,eAAe;CACf,oBAAoB;CACpB,kBAAkB;CAClB,cAAc;CACd,0BAA0B;CAC1B,yBAAyB;CACzB,oBAAoB;CACpB,mBAAmB;CACnB,8BAA8B;AAChC;;;;AAKA,MAAa,mBAAmB,OAAO,OAAO,gBAAgB;;;;AAK9D,MAAa,oCAAoC;CAC/C;CACA;CACA;CACA;AACF;;;;;AAUA,MAAa,uBAAuB;;CAElC,mBAAmB;;CAEnB,oBAAoB;;CAEpB,qBAAqB;;CAErB,YAAY;;CAEZ,aAAa;AACf;;;;AAKA,MAAa,2BAA2B,OAAO,OAAO,oBAAoB;;;;AAS1E,MAAa,mBAAmB;;CAE9B,MAAM;;CAEN,KAAK;;CAEL,MAAM;;CAEN,OAAO;;CAEP,KAAK;;CAEL,QAAQ;AACV;AAOG,iBAAiB,MACjB,iBAAiB,KACjB,iBAAiB,MACjB,iBAAiB,OACjB,iBAAiB,KACjB,iBAAiB;;;;AAuCpB,SAAgB,mBAAmB,KAAsB;CACvD,OAAO,iBAAiB,SAAS,GAAwC;AAC3E;;;;AAKA,SAAgB,oBAAoB,KAAsB;CACxD,OAAO,yBAAyB,SAAS,GAAgD;AAC3F;;;;AAKA,SAAgB,kCAAkC,cAAiC;CACjF,OAAO,aAAa,MAAM,MACxB,kCAAkC,SAAS,CAAuD,CACpG;AACF;;;;;;;;;;;;;;AC7NA,MAAa,wBAAwBA,IAAAA,EAAE,OAAO;;CAE5C,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;;CAEtB,SAASA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;AAC3B,CAAC;;;;AASD,MAAa,6BAA6BA,IAAAA,EAAE,OAAO;;CAEjD,OAAOA,IAAAA,EAAE,MAAM,CAAC,CAAC,SAAS;;CAE1B,OAAOA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;;CAE3B,KAAKA,IAAAA,EAAE,IAAI,CAAC,CAAC,SAAS;AACxB,CAAC;;;;AAKD,MAAa,cAAcA,IAAAA,EAAE,OAAO;;CAElC,MAAMA,IAAAA,EAAE,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;;CAE/B,QAAQA,IAAAA,EAAE,MAAMA,IAAAA,EAAE,MAAM;EAACA,IAAAA,EAAE,OAAO;EAAGA,IAAAA,EAAE,OAAO;EAAGA,IAAAA,EAAE,QAAQ;CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;AAC3E,CAAC;;;;AAKD,MAAa,mBAAmBA,IAAAA,EAAE,OAAO;;CAEvC,QAAQA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;;CAExB,MAAMA,IAAAA,EAAE,OAAOA,IAAAA,EAAE,OAAO,GAAGA,IAAAA,EAAE,QAAQ,CAAC;;CAEtC,OAAOA,IAAAA,EAAE,MAAM,WAAW,CAAC,CAAC,SAAS;AACvC,CAAC;;;;AAKD,MAAa,mBAAmBA,IAAAA,EAAE,OAAO;;CAEvC,KAAKA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY;;CAElC,KAAKA,IAAAA,EAAE,IAAI;AACb,CAAC;;;;AAKD,MAAa,eAAeA,IAAAA,EAAE,OAAO,EACnC,aAAa,iBACf,CAAC;;;;AAKD,MAAa,qBAAqBA,IAAAA,EAAE,OAAO;;CAEzC,KAAKA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;;CAErB,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;AACxB,CAAC;;;;AASD,MAAa,qBAAqBA,IAAAA,EAAE,OAAO;;CAEzC,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;;CAGtB,QAAQA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;;CAG5B,QAAQA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;;CAG5B,QAAQA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;;CAG5B,KAAKA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;;CAGrB,SAASA,IAAAA,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC;;CAG5B,cAAcA,IAAAA,EAAE,IAAI;;CAGpB,iBAAiBA,IAAAA,EAAE,MAAMA,IAAAA,EAAE,MAAM,qBAAqB,CAAC,CAAC,CAAC,SAAS;;CAGlE,cAAcA,IAAAA,EAAE,MAAMA,IAAAA,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;;CAGpC,gBAAgBA,IAAAA,EAAE,IAAI,CAAC,CAAC,SAAS;;CAGjC,UAAUA,IAAAA,EAAE,IAAI,CAAC,CAAC,SAAS;;CAG3B,aAAaA,IAAAA,EAAE,IAAI,CAAC,CAAC,GAAGA,IAAAA,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS;;CAG5C,uBAAuB,2BAA2B,SAAS;;CAG3D,WAAWA,IAAAA,EAAE,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;;CAGxC,oBAAoBA,IAAAA,EAAE,IAAI,CAAC,CAAC,SAAS;;CAGrC,KAAKA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;;CAG/B,QAAQ,aAAa,SAAS;;CAG9B,SAASA,IAAAA,EAAE,MAAM,qBAAqB,CAAC,CAAC,SAAS;;CAGjD,aAAaA,IAAAA,EAAE,MAAM,gBAAgB,CAAC,CAAC,SAAS;;CAGhD,uBAAuBA,IAAAA,EAAE,MAAM,gBAAgB,CAAC,CAAC,SAAS;;CAG1D,cAAc,mBAAmB,SAAS;AAC5C,CAAC;;;;AASD,MAAa,uBAAuBA,IAAAA,EAAE,OAAO;;CAE3C,KAAKA,IAAAA,EAAE,QAAQ,YAAY;;CAE3B,KAAKA,IAAAA,EAAE,KAAK;EAAC;EAAS;EAAS;EAAS;EAAS;EAAS;CAAO,CAAC;;CAElE,KAAKA,IAAAA,EAAE,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;;CAE9B,KAAKA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;AAC3B,CAAC;;;;AAKD,MAAa,uBAAuBA,IAAAA,EAAE,OAAO;;CAE3C,KAAKA,IAAAA,EAAE,QAAQ,YAAY;;CAE3B,KAAKA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI;;CAEpB,SAASA,IAAAA,EAAE,MAAMA,IAAAA,EAAE,WAAW,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAS6BA,IAAAA,EAAE,OAAO;CACrC,QAAQ;CACR,SAAS;AACX,CAAC;AAK6BA,IAAAA,EAAE,OAAO;CACrC,QAAQ;CACR,SAAS;AACX,CAAC;;;;AASD,MAAa,2BAA2B,mBAAmB,OAAO,EAChE,QAAQA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAC1B,CAAC,CAAC,CAAC,KAAK;CACN,QAAQ;CACR,QAAQ;AACV,CAAC;;;;AAKD,MAAa,6BAA6B,mBAAmB,OAAO;CAClE,QAAQA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACxB,QAAQA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;AAC1B,CAAC,CAAC,CAAC,KAAK,EACN,QAAQ,KACV,CAAC;;;;;;ACrOD,IAAa,iBAAb,MAAa,uBAAuBC,qBAAAA,kBAAkB;CACpD,YAAY,SAAiB,SAAmB;EAC9C,MAAM,SAAS,OAAO;EACtB,OAAO,eAAe,MAAM,eAAe,SAAS;EACpD,KAAK,OAAO;CACd;AACF;;;;;;;;;;;;;ACkDA,IAAa,eAAb,MAA0B;;iBACe,CAAC;;;;;CAKxC,KAAK,OAAqB;EACxB,KAAK,QAAQ,OAAO;EACpB,OAAO;CACT;;;;CAKA,UAAU,OAAqB;EAC7B,KAAK,QAAQ,SAAS;EACtB,OAAO;CACT;;;;CAKA,UAAU,OAAqB;EAC7B,KAAK,QAAQ,SAAS;EACtB,OAAO;CACT;;;;CAKA,WAAW,OAAqB;EAC9B,KAAK,QAAQ,SAAS;EACtB,OAAO;CACT;;;;;;;;CASA,WAAW,YAA0B;EACnC,KAAK,QAAQ,MAAM;EACnB,OAAO;CACT;;;;CAKA,QAAQ,MAAoB;EAC1B,KAAK,QAAQ,UAAU;EACvB,OAAO;CACT;;;;CAKA,YAAY,KAAmB;EAC7B,KAAK,QAAQ,eAAe;EAC5B,OAAO;CACT;;;;CAKA,mBAAmB,aAAqB,OAAO,MAAY;EACzD,KAAK,QAAQ,kBAAkB,KAAK,QAAQ,mBAAmB,CAAC;EAEhE,MAAM,WAAW,KAAK,QAAQ,gBAAgB,MAAM,UAAU,MAAM,MAAM,MAAM,EAAE,SAAS,IAAI,CAAC;EAChG,IAAI,UACF,SAAS,KAAK;GAAE;GAAM,SAAS;EAAY,CAAC;OAE5C,KAAK,QAAQ,gBAAgB,KAAK,CAAC;GAAE;GAAM,SAAS;EAAY,CAAC,CAAC;EAEpE,OAAO;CACT;;;;CAKA,uBAAuB,cAAuC;EAC5D,KAAK,QAAQ,kBAAkB,KAAK,QAAQ,mBAAmB,CAAC;EAChE,KAAK,QAAQ,gBAAgB,KAAK,YAAY;EAC9C,OAAO;CACT;;;;;;CAOA,eAAe,aAAsF;EACnG,KAAK,QAAQ,eAAe,KAAK,QAAQ,gBAAgB,CAAC;EAC1D,IAAI,CAAC,KAAK,QAAQ,aAAa,SAAS,WAAW,GACjD,KAAK,QAAQ,aAAa,KAAK,WAAW;EAE5C,OAAO;CACT;;;;CAKA,aAAa,cAA8B;EACzC,KAAK,QAAQ,eAAe,CAAC,GAAG,YAAY;EAC5C,OAAO;CACT;;;;CAKA,cAAc,KAAmB;EAC/B,KAAK,QAAQ,iBAAiB;EAC9B,OAAO;CACT;;;;CAKA,QAAQ,KAAmB;EACzB,KAAK,QAAQ,WAAW;EACxB,OAAO;CACT;;;;CAKA,WAAW,KAAmB;EAC5B,KAAK,QAAQ,cAAc;EAC3B,OAAO;CACT;;;;CAKA,qBAAqB,WAAuC;EAC1D,KAAK,QAAQ,wBAAwB;EACrC,OAAO;CACT;;;;CAKA,SAAS,KAAqB;EAC5B,KAAK,QAAQ,YAAY;EACzB,OAAO;CACT;;;;CAKA,kBAAkB,KAAmB;EACnC,KAAK,QAAQ,qBAAqB;EAClC,OAAO;CACT;;;;;CAMA,SAAS,WAAgC;EACvC,KAAK,QAAQ,MAAM,OAAO,cAAc,WAAW,YAAY,KAAK,MAAM,UAAU,QAAQ,IAAI,GAAI;EACpG,OAAO;CACT;;;;CAKA,OAAO,QAAsB;EAC3B,KAAK,QAAQ,SAAS;EACtB,OAAO;CACT;;;;CAKA,WAAW,aAAqB,OAAO,MAAY;EACjD,KAAK,QAAQ,UAAU,KAAK,QAAQ,WAAW,CAAC;EAChD,KAAK,QAAQ,QAAQ,KAAK;GAAE;GAAM,SAAS;EAAY,CAAC;EACxD,OAAO;CACT;;;;CAKA,SAAS,UAAmC;EAC1C,KAAK,QAAQ,UAAU;EACvB,OAAO;CACT;;;;CAKA,cAAc,YAA8B;EAC1C,KAAK,QAAQ,cAAc,KAAK,QAAQ,eAAe,CAAC;EACxD,KAAK,QAAQ,YAAY,KAAK,UAAU;EACxC,OAAO;CACT;;;;CAKA,uBAAuB,gBAA8B;EACnD,KAAK,QAAQ,wBAAwB,KAAK,QAAQ,yBAAyB,CAAC;EAC5E,KAAK,QAAQ,sBAAsB,KAAK,cAAc;EACtD,OAAO;CACT;;;;CAKA,aAAa,cAAkC;EAC7C,KAAK,QAAQ,eAAe;EAC5B,OAAO;CACT;;;;;;CAOA,QAAsB;EAEpB,IAAI,CAAC,KAAK,QAAQ,KAChB,KAAK,QAAQ,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;EAGjD,MAAM,SAAS,mBAAmB,UAAU,KAAK,OAAO;EAExD,IAAI,CAAC,OAAO,SAEV,MAAM,IAAI,eAAe,2BADR,OAAO,MAAM,OAAO,KAAK,MAAM,GAAG,EAAE,KAAK,KAAK,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,KAAK,IAC/B,KAAK,OAAO,MAAM,MAAM;EAGrF,OAAO,OAAO;CAChB;AACF;;;;AASA,IAAa,oBAAb,MAA+B;;oBACa,CAAC;;;;;;;CAO3C,OAAO,QAAsB;EAC3B,KAAK,WAAW,SAAS;EACzB,OAAO;CACT;;;;;;CAOA,KAAK,MAAqC;EACxC,KAAK,WAAW,OAAO;EACvB,OAAO;CACT;;;;CAKA,UAAU,WAA2B;EACnC,KAAK,WAAW,SAAS;EACzB,KAAK,WAAW,OAAO,EAAE,YAAY,UAAU;EAC/C,OAAO;CACT;;;;CAKA,SAAS,cAA4B;EACnC,KAAK,WAAW,SAAS;EACzB,KAAK,WAAW,OAAO,EAAE,eAAe,aAAa;EACrD,OAAO;CACT;;;;CAKA,SAAS,OAAoB;EAC3B,KAAK,WAAW,QAAQ,KAAK,WAAW,SAAS,CAAC;EAClD,KAAK,WAAW,MAAM,KAAK,KAAK;EAChC,OAAO;CACT;;;;CAKA,aAAa,GAAG,MAAsB;EACpC,KAAK,WAAW,QAAQ,KAAK,WAAW,SAAS,CAAC;EAClD,KAAK,WAAW,MAAM,KAAK,EAAE,KAAK,CAAC;EACnC,OAAO;CACT;;;;CAKA,QAAoB;EAClB,IAAI,CAAC,KAAK,WAAW,QACnB,MAAM,IAAI,eAAe,+BAA+B;EAE1D,IAAI,CAAC,KAAK,WAAW,MACnB,MAAM,IAAI,eAAe,6BAA6B;EAExD,OAAO,KAAK;CACd;AACF;;;;AASA,SAAgB,QAAsB;CACpC,OAAO,IAAI,aAAa;AAC1B;;;;AAKA,SAAgB,aAAgC;CAC9C,OAAO,IAAI,kBAAkB;AAC/B;;;;AAKA,SAAgB,uBAAuB,OAA4C;CACjF,OAAO,MAAM,CAAC,CACX,KAAK,MAAM,IAAI,CAAC,CAChB,UAAU,MAAM,SAAS,CAAC,CAC1B,WAAW,MAAM,UAAU,CAAC,CAC5B,QAAQ,MAAM,OAAO,CAAC,CACtB,YAAY,MAAM,WAAW,CAAC,CAC9B,aAAa,MAAM,YAAY,CAAC,CAChC,MAAM;AACX;;;;AAKA,SAAgB,yBAAyB,OAA8C;CACrF,OAAO,MAAM,CAAC,CACX,KAAK,MAAM,IAAI,CAAC,CAChB,UAAU,MAAM,SAAS,CAAC,CAC1B,WAAW,MAAM,UAAU,CAAC,CAC5B,WAAW,MAAM,UAAU,CAAC,CAC5B,QAAQ,MAAM,OAAO,CAAC,CACtB,YAAY,MAAM,WAAW,CAAC,CAC9B,aAAa,MAAM,YAAY,CAAC,CAChC,MAAM;AACX;;;;AAKA,SAAgB,2BACd,MACA,WACA,YACA,SACA,aACc;CACd,OAAO,MAAM,CAAC,CACX,KAAK,IAAI,CAAC,CACV,UAAU,SAAS,CAAC,CACpB,WAAW,UAAU,CAAC,CACtB,QAAQ,OAAO,CAAC,CAChB,YAAY,WAAW,CAAC,CACxB,eAAe,4BAA4B,CAAC,CAC5C,MAAM;AACX;;;;;;;;;;;;;ACvYA,SAAgB,qBAAqB,SAAoC;CACvE,MAAM,SAAS,mBAAmB,UAAU,OAAO;CACnD,MAAM,SAA4B,CAAC;CACnC,MAAM,WAA8B,CAAC;CAErC,IAAI,CAAC,OAAO,SAAS;EACnB,KAAK,MAAM,SAAS,OAAO,MAAM,QAC/B,OAAO,KAAK;GACV,MAAM,MAAM,KAAK,IAAI,MAAM;GAC3B,SAAS,MAAM;GACf,MAAM,MAAM;EACd,CAAC;EAEH,OAAO;GAAE,OAAO;GAAO;GAAQ;EAAS;CAC1C;CAGA,MAAM,eAA6B,OAAO;CAG1C,KAAK,MAAM,eAAe,aAAa,cACrC,IAAI,CAAC,iBAAiB,SAAS,WAAgD;MAEzE,CAAC,yBAAyB,SAAS,WAAwD,GAC7F,SAAS,KAAK;GACZ,MAAM,CAAC,cAAc;GACrB,SAAS,4BAA4B,YAAY;GACjD,MAAM;EACR,CAAC;CAAA;CAMP,IAAI,aAAa,aAAa,WAAW,GACvC,OAAO,KAAK;EACV,MAAM,CAAC,cAAc;EACrB,SAAS;EACT,MAAM;CACR,CAAC;CAIH,MAAM,oBAAoB,aAAa,aAAa,MAAM,MACxD,yBAAyB,SAAS,CAA8C,CAClF;CACA,MAAM,qBAAqB,aAAa,aAAa,SACnD,yDACF;CACA,IAAI,qBAAqB,CAAC,oBACxB,OAAO,KAAK;EACV,MAAM,CAAC,cAAc;EACrB,SAAS;EACT,MAAM;CACR,CAAC;CAOH,IAHmC,aAAa,aAAa,MAAM,MACjE,kCAAkC,SAAS,CAAuD,CAEvE,KAAK,CAAC,aAAa,uBAC9C,SAAS,KAAK;EACZ,MAAM,CAAC,uBAAuB;EAC9B,SACE;EACF,MAAM;CACR,CAAC;CAIH,MAAM,YAAY,2BAA2B,aAAa,GAAG;CAC7D,IAAI,CAAC,UAAU,OACb,OAAO,KAAK;EACV,MAAM,CAAC,KAAK;EACZ,SAAS,UAAU;EACnB,MAAM;CACR,CAAC;CAGH,OAAO;EAAE,OAAO,OAAO,WAAW;EAAG;EAAQ;CAAS;AACxD;;;;AAKA,SAAgB,uBAAuB,QAAmC;CACxE,MAAM,SAAS,qBAAqB,UAAU,MAAM;CACpD,MAAM,SAA4B,CAAC;CACnC,MAAM,WAA8B,CAAC;CAErC,IAAI,CAAC,OAAO,SACV,KAAK,MAAM,SAAS,OAAO,MAAM,QAC/B,OAAO,KAAK;EACV,MAAM,MAAM,KAAK,IAAI,MAAM;EAC3B,SAAS,MAAM;EACf,MAAM,MAAM;CACd,CAAC;CAIL,OAAO;EAAE,OAAO,OAAO,WAAW;EAAG;EAAQ;CAAS;AACxD;;;;AAKA,SAAgB,cAAc,QAAiB,SAAoC;CACjF,MAAM,eAAe,uBAAuB,MAAM;CAClD,MAAM,gBAAgB,qBAAqB,OAAO;CAElD,MAAM,SAAS,CACb,GAAG,aAAa,OAAO,KAAK,OAAO;EAAE,GAAG;EAAG,MAAM,CAAC,UAAU,GAAG,EAAE,IAAI;CAAE,EAAE,GACzE,GAAG,cAAc,OAAO,KAAK,OAAO;EAAE,GAAG;EAAG,MAAM,CAAC,WAAW,GAAG,EAAE,IAAI;CAAE,EAAE,CAC7E;CAEA,MAAM,WAAW,CACf,GAAG,aAAa,SAAS,KAAK,OAAO;EAAE,GAAG;EAAG,MAAM,CAAC,UAAU,GAAG,EAAE,IAAI;CAAE,EAAE,GAC3E,GAAG,cAAc,SAAS,KAAK,OAAO;EAAE,GAAG;EAAG,MAAM,CAAC,WAAW,GAAG,EAAE,IAAI;CAAE,EAAE,CAC/E;CAEA,OAAO;EAAE,OAAO,OAAO,WAAW;EAAG;EAAQ;CAAS;AACxD;;;;AASA,SAAgB,mBAAmB,SAAgC;CACjE,OAAO,OAAO,QAAQ,WAAW,YAAY,QAAQ,OAAO,SAAS;AACvE;;;;AAKA,SAAgB,qBAAqB,SAAgC;CACnE,OACE,OAAO,QAAQ,WAAW,YAC1B,QAAQ,OAAO,SAAS,KACxB,OAAO,QAAQ,WAAW,YAC1B,QAAQ,OAAO,SAAS;AAE5B;;;;AAKA,SAAgB,yBAAyB,SAAoC;CAC3E,MAAM,SAAS,yBAAyB,UAAU,OAAO;CACzD,MAAM,SAA4B,CAAC;CACnC,MAAM,WAA8B,CAAC;CAErC,IAAI,CAAC,OAAO,SACV,KAAK,MAAM,SAAS,OAAO,MAAM,QAC/B,OAAO,KAAK;EACV,MAAM,MAAM,KAAK,IAAI,MAAM;EAC3B,SAAS,MAAM;EACf,MAAM,MAAM;CACd,CAAC;CAKL,IAAI,OAAO,SAAS;EAClB,MAAM,MAAc,OAAO,KAAK;EAGhC,IAAI,CAAC,wBAAwB,KAAK,GAAG,GACnC,SAAS,KAAK;GACZ,MAAM,CAAC,KAAK;GACZ,SACE;GACF,MAAM;EACR,CAAC;CAEL;CAEA,OAAO;EAAE,OAAO,OAAO,WAAW;EAAG;EAAQ;CAAS;AACxD;;;;AAKA,SAAgB,2BAA2B,SAAoC;CAC7E,MAAM,SAAS,2BAA2B,UAAU,OAAO;CAC3D,MAAM,SAA4B,CAAC;CACnC,MAAM,WAA8B,CAAC;CAErC,IAAI,CAAC,OAAO,SACV,KAAK,MAAM,SAAS,OAAO,MAAM,QAC/B,OAAO,KAAK;EACV,MAAM,MAAM,KAAK,IAAI,MAAM;EAC3B,SAAS,MAAM;EACf,MAAM,MAAM;CACd,CAAC;CAKL,IAAI,OAAO,SAAS;EAClB,MAAM,MAAc,OAAO,KAAK;EAGhC,IAAI,CAAC,wBAAwB,KAAK,GAAG,GACnC,SAAS,KAAK;GACZ,MAAM,CAAC,KAAK;GACZ,SACE;GACF,MAAM;EACR,CAAC;CAEL;CAEA,OAAO;EAAE,OAAO,OAAO,WAAW;EAAG;EAAQ;CAAS;AACxD;;;;AASA,MAAM,wBAAwB;CAAC;CAAO;CAAO;CAAO;CAAO;CAAO;AAAK;;;;AAKvE,MAAM,0BAA0B;CAAC;CAAO;CAAO;CAAO;CAAO;AAAK;;;;AAKlE,SAAS,2BAA2B,YAAyD;CAE3F,MAAM,QAAQ,WAAW,MAAM,6BAA6B;CAE5D,IAAI,CAAC,OACH,OAAO;EACL,OAAO;EACP,SAAS;CACX;CAGF,MAAM,GAAG,UAAU,MAAM;CAIzB,IAAI,CAAC,CADgB,GAAG,uBAAuB,GAAG,uBACnC,CAAC,CAAC,SAAS,MAAM,GAAG,CAGnC;CAEA,IAAI,CAAC,MAAM,GAAG,WAAW,GACvB,OAAO;EACL,OAAO;EACP,SAAS;CACX;CAGF,OAAO;EAAE,OAAO;EAAM,SAAS;CAAG;AACpC;;;;AASA,SAAgB,wBAAwB,SAAmD;CACzF,MAAM,SAAS,qBAAqB,OAAO;CAC3C,IAAI,CAAC,OAAO,OAEV,MAAM,IAAI,eAAe,2BADR,OAAO,OAAO,KAAK,MAAM,GAAG,EAAE,KAAK,KAAK,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,KAAK,IACzB,KAAK,OAAO,MAAM;AAEjF;;;;AAKA,SAAgB,iBAAiB,QAAiB,SAAwB;CACxE,MAAM,SAAS,cAAc,QAAQ,OAAO;CAC5C,IAAI,CAAC,OAAO,OAEV,MAAM,IAAI,eAAe,mBADR,OAAO,OAAO,KAAK,MAAM,GAAG,EAAE,KAAK,KAAK,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,KAAK,IACjC,KAAK,OAAO,MAAM;AAEzE;;;;;;;;;;;;;;;;AC/TA,eAAsB,UAAU,SAA4C;CAC1E,MAAM,EAAE,SAAS,YAAY,SAAS,cAAc,OAAO,WAAW;CAGtE,wBAAwB,OAAO;CAE/B,IAAI,CAAC,gBAAgB,aAAa,WAAW,GAC3C,MAAM,IAAI,eAAe,qDAAqD;CAahF,MAAM,SAAyB;EAC7B,KAAK;EACL,KAAK;EACL,KAZU,aAAa,KAAK,SAAS;GACrC,MAAM,WAAA,GAAA,YAAA,SAAA,CAAmB,IAAI;GAC7B,IAAI,CAAC,SACH,MAAM,IAAI,eAAe,gCAAgC;GAE3D,OAAO;EACT,CAMI;EACF,GAAI,SAAS,EAAE,KAAK,MAAM;CAC5B;CAKA,MAAM,eAAe,IAAA,GAAA,qBAAA,gBAAA,CAFiB,KAAK,UAAU,MAAM,CAEvB,EAAE,IAAA,GAAA,qBAAA,gBAAA,CADC,KAAK,UAAU,OAAO,CACP;CAQtD,OAAO;EACL,KAAA,GAHa,aAAa,GAAG,MAHP,OAAO,YAAY;EAOzC;EACA;CACF;AACF;;;;;;;AAYA,SAAgB,YAAY,KAA0B;CACpD,MAAM,WAAA,GAAA,qBAAA,UAAA,CAAoB,GAAG;CAG7B,IAAI,QAAQ,OAAO,QAAQ,cACzB,MAAM,IAAI,eAAe,mDAAmD,QAAQ,OAAO,IAAI,EAAE;CAInG,wBAAwB,QAAQ,OAAO;CAEvC,OAAO;EACL;EACA,QAAQ,QAAQ;EAChB,SAAS,QAAQ;CACnB;AACF;;;;;;;AAQA,SAAgB,WAAW,KAAuE;CAChG,MAAM,WAAA,GAAA,qBAAA,UAAA,CAAoB,GAAG;CAC7B,MAAM,QAAQ,IAAI,MAAM,GAAG;CAE3B,OAAO;EACL,QAAQ,QAAQ;EAChB,SAAS,QAAQ;EACjB,WAAW,MAAM;CACnB;AACF;;;;;;;AAYA,SAAgB,mBAAmB,SAAqE;CACtG,MAAM,kBAAgC;EACpC,GAAG;EACH,KAAK,QAAQ,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;CAClD;CAEA,wBAAwB,eAAe;CAEvC,OAAO;AACT"}

package/dist/index.d.cts

@@ -479,9 +479,9 @@ declare class WRPRCBuilder {
    */
   addCredential(credential: Credential): this;
   /**
-   * Add a credential the WRP provides (for attestation providers)
+   * Add a schema metadata that the WRP provides (for attestation providers)
    */
-  addProvidedAttestation(credential: Credential): this;
+  addProvidedAttestation(schemaMetadata: string): this;
   /**
    * Set intermediary information
    */

package/dist/index.d.mts

@@ -479,9 +479,9 @@ declare class WRPRCBuilder {
    */
   addCredential(credential: Credential): this;
   /**
-   * Add a credential the WRP provides (for attestation providers)
+   * Add a schema metadata that the WRP provides (for attestation providers)
    */
-  addProvidedAttestation(credential: Credential): this;
+  addProvidedAttestation(schemaMetadata: string): this;
   /**
    * Set intermediary information
    */

package/dist/index.mjs

@@ -492,11 +492,11 @@ var WRPRCBuilder = class {
 		return this;
 	}
 	/**
-	* Add a credential the WRP provides (for attestation providers)
+	* Add a schema metadata that the WRP provides (for attestation providers)
 	*/
-	addProvidedAttestation(credential) {
+	addProvidedAttestation(schemaMetadata) {
 		this.payload.provides_attestations = this.payload.provides_attestations ?? [];
-		this.payload.provides_attestations.push(credential);
+		this.payload.provides_attestations.push(schemaMetadata);
 		return this;
 	}
 	/**

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../src/entitlements.ts","../src/schemas.ts","../src/wrprc-exception.ts","../src/builders.ts","../src/validator.ts","../src/signer.ts"],"sourcesContent":["/**\n * WRPRC Entitlement Constants\n *\n * Entitlement identifiers as defined in ETSI TS 119 475 Annex A.\n * These identifiers define the roles and capabilities of Wallet-Relying Parties.\n *\n * @see https://www.etsi.org/deliver/etsi_ts/119400_119499/119475/01.02.01_60/ts_119475v010201p.pdf\n */\n\n// ============================================================================\n// OID Base\n// ============================================================================\n\n/**\n * Base OID for ETSI WRPA entitlements: 0.4.0.19475\n * id-etsi-wrpa OBJECT IDENTIFIER ::= { itu-t(0) identified-organization(4) etsi(0) 19475 }\n */\nexport const ETSI_WRPA_BASE_OID = '0.4.0.19475'\n\n/**\n * OID arc for entitlements: 0.4.0.19475.1\n */\nexport const ETSI_WRPA_ENTITLEMENT_ARC = `${ETSI_WRPA_BASE_OID}.1`\n\n// ============================================================================\n// WRP Entitlement URIs (A.2)\n// ============================================================================\n\n/**\n * Service_Provider - General service provider (A.2.1)\n * OID: id-etsi-wrpa-entitlement 1\n */\nexport const ENTITLEMENT_SERVICE_PROVIDER = 'https://uri.etsi.org/19475/Entitlement/Service_Provider'\n\n/**\n * QEAA_Provider - Qualified trust service provider issuing qualified electronic attestations of attributes (A.2.2)\n * OID: id-etsi-wrpa-entitlement 2\n */\nexport const ENTITLEMENT_QEAA_PROVIDER = 'https://uri.etsi.org/19475/Entitlement/QEAA_Provider'\n\n/**\n * Non_Q_EAA_Provider - Trust service provider issuing non-qualified electronic attestations of attributes (A.2.3)\n * OID: id-etsi-wrpa-entitlement 3\n */\nexport const ENTITLEMENT_NON_Q_EAA_PROVIDER = 'https://uri.etsi.org/19475/Entitlement/Non_Q_EAA_Provider'\n\n/**\n * PUB_EAA_Provider - Public sector body or its agent issuing electronic attestations of attributes from authentic sources (A.2.4)\n * OID: id-etsi-wrpa-entitlement 4\n */\nexport const ENTITLEMENT_PUB_EAA_PROVIDER = 'https://uri.etsi.org/19475/Entitlement/PUB_EAA_Provider'\n\n/**\n * PID_Provider - Provider of person identification data (A.2.5)\n * OID: id-etsi-wrpa-entitlement 5\n */\nexport const ENTITLEMENT_PID_PROVIDER = 'https://uri.etsi.org/19475/Entitlement/PID_Provider'\n\n/**\n * QCert_for_ESeal_Provider - QTSP issuing qualified certificates for electronic seals (A.2.6)\n * OID: id-etsi-wrpa-entitlement 6\n */\nexport const ENTITLEMENT_QCERT_FOR_ESEAL_PROVIDER = 'https://uri.etsi.org/19475/Entitlement/QCert_for_ESeal_Provider'\n\n/**\n * QCert_for_ESig_Provider - QTSP issuing qualified certificates for electronic signatures (A.2.7)\n * OID: id-etsi-wrpa-entitlement 7\n */\nexport const ENTITLEMENT_QCERT_FOR_ESIG_PROVIDER = 'https://uri.etsi.org/19475/Entitlement/QCert_for_ESig_Provider'\n\n/**\n * rQSealCDs_Provider - QTSP managing remote qualified electronic seal creation devices (A.2.8)\n * OID: id-etsi-wrpa-entitlement 8\n */\nexport const ENTITLEMENT_RQSEALCDS_PROVIDER = 'https://uri.etsi.org/19475/Entitlement/rQSealCDs_Provider'\n\n/**\n * rQSigCDs_Provider - QTSP managing remote qualified electronic signature creation devices (A.2.9)\n * OID: id-etsi-wrpa-entitlement 9\n */\nexport const ENTITLEMENT_RQSIGCDS_PROVIDER = 'https://uri.etsi.org/19475/Entitlement/rQSigCDs_Provider'\n\n/**\n * ESig_ESeal_Creation_Provider - Non-qualified provider for remote signature/seal creation (A.2.10)\n * OID: id-etsi-wrpa-entitlement 10\n */\nexport const ENTITLEMENT_ESIG_ESEAL_CREATION_PROVIDER =\n  'https://uri.etsi.org/19475/Entitlement/ESig_ESeal_Creation_Provider'\n\n// ============================================================================\n// Entitlement Collection\n// ============================================================================\n\n/**\n * All standard WRP entitlements defined in ETSI TS 119 475\n */\nexport const WRP_ENTITLEMENTS = {\n  SERVICE_PROVIDER: ENTITLEMENT_SERVICE_PROVIDER,\n  QEAA_PROVIDER: ENTITLEMENT_QEAA_PROVIDER,\n  NON_Q_EAA_PROVIDER: ENTITLEMENT_NON_Q_EAA_PROVIDER,\n  PUB_EAA_PROVIDER: ENTITLEMENT_PUB_EAA_PROVIDER,\n  PID_PROVIDER: ENTITLEMENT_PID_PROVIDER,\n  QCERT_FOR_ESEAL_PROVIDER: ENTITLEMENT_QCERT_FOR_ESEAL_PROVIDER,\n  QCERT_FOR_ESIG_PROVIDER: ENTITLEMENT_QCERT_FOR_ESIG_PROVIDER,\n  RQSEALCDS_PROVIDER: ENTITLEMENT_RQSEALCDS_PROVIDER,\n  RQSIGCDS_PROVIDER: ENTITLEMENT_RQSIGCDS_PROVIDER,\n  ESIG_ESEAL_CREATION_PROVIDER: ENTITLEMENT_ESIG_ESEAL_CREATION_PROVIDER,\n} as const\n\n/**\n * List of all standard entitlement URIs\n */\nexport const ALL_ENTITLEMENTS = Object.values(WRP_ENTITLEMENTS)\n\n/**\n * Entitlements for attestation providers (QEAA, Non-Q EAA, PUB EAA, PID)\n */\nexport const ATTESTATION_PROVIDER_ENTITLEMENTS = [\n  ENTITLEMENT_QEAA_PROVIDER,\n  ENTITLEMENT_NON_Q_EAA_PROVIDER,\n  ENTITLEMENT_PUB_EAA_PROVIDER,\n  ENTITLEMENT_PID_PROVIDER,\n] as const\n\n// ============================================================================\n// Service Provider Sub-entitlements (A.3)\n// ============================================================================\n\n/**\n * Payment Service Provider Sub-entitlements (A.3.1)\n * As defined in ETSI TS 119 495\n */\nexport const PSP_SUB_ENTITLEMENTS = {\n  /** Account Servicing Payment Service Provider */\n  ACCOUNT_SERVICING: 'https://uri.etsi.org/19475/SubEntitlement/psp/psp-as',\n  /** Payment Initiation Service Provider */\n  PAYMENT_INITIATION: 'https://uri.etsi.org/19475/SubEntitlement/psp/psp-pi',\n  /** Account Information Service Provider */\n  ACCOUNT_INFORMATION: 'https://uri.etsi.org/19475/SubEntitlement/psp/psp-ai',\n  /** Payment Service Provider issuing card-based payment instruments */\n  CARD_BASED: 'https://uri.etsi.org/19475/SubEntitlement/psp/psp-ic',\n  /** Unspecified Payment Service Provider */\n  UNSPECIFIED: 'https://uri.etsi.org/19475/SubEntitlement/psp/unspecified',\n} as const\n\n/**\n * All PSP sub-entitlement URIs\n */\nexport const ALL_PSP_SUB_ENTITLEMENTS = Object.values(PSP_SUB_ENTITLEMENTS)\n\n// ============================================================================\n// Identifier Type URIs (B.2.5 Class Identifier)\n// ============================================================================\n\n/**\n * Identifier type URIs for legal person semantic identifiers\n */\nexport const IDENTIFIER_TYPES = {\n  /** Economic Operator Registration and Identification Number (EORI-No) */\n  EORI: 'http://data.europa.eu/eudi/id/EORI-No',\n  /** Legal Entity Identifier (LEI) */\n  LEI: 'http://data.europa.eu/eudi/id/LEI',\n  /** European Unique Identifier (EUID) */\n  EUID: 'http://data.europa.eu/eudi/id/EUID',\n  /** Value Added Tax Identification Number (VATIN) */\n  VATIN: 'http://data.europa.eu/eudi/id/VATIN',\n  /** Taxpayer Identification Number (TIN) */\n  TIN: 'http://data.europa.eu/eudi/id/TIN',\n  /** Excise Number */\n  EXCISE: 'http://data.europa.eu/eudi/id/Excise',\n} as const\n\n/**\n * Mapping from identifier type URIs to semantic identifier prefixes\n * as defined in ETSI EN 319 412-1\n */\nexport const IDENTIFIER_TYPE_TO_PREFIX: Record<string, string> = {\n  [IDENTIFIER_TYPES.EORI]: 'EOR',\n  [IDENTIFIER_TYPES.LEI]: 'LEI',\n  [IDENTIFIER_TYPES.EUID]: 'NTR',\n  [IDENTIFIER_TYPES.VATIN]: 'VAT',\n  [IDENTIFIER_TYPES.TIN]: 'TIN',\n  [IDENTIFIER_TYPES.EXCISE]: 'EXC',\n}\n\n// ============================================================================\n// Policy Type URIs (B.2.8 Class Policy)\n// ============================================================================\n\n/**\n * Policy type URIs\n */\nexport const POLICY_TYPES = {\n  /** Privacy Policy */\n  PRIVACY_POLICY: 'http://data.europa.eu/eudi/policy/privacy-policy',\n} as const\n\n// ============================================================================\n// Certificate Policy OIDs (clause 6.1.3)\n// ============================================================================\n\n/**\n * Base OID for WRPRC policies: 0.4.0.19475.3\n */\nexport const WRPRC_POLICY_BASE_OID = `${ETSI_WRPA_BASE_OID}.3`\n\n/**\n * WRPRC Policy OIDs\n */\nexport const WRPRC_POLICIES = {\n  /** WRPRC provider policy identifier */\n  WRPRC_PROVIDER: `${WRPRC_POLICY_BASE_OID}.1`,\n} as const\n\n// ============================================================================\n// Type Guards and Helpers\n// ============================================================================\n\n/**\n * Check if a given URI is a valid WRP entitlement\n */\nexport function isValidEntitlement(uri: string): boolean {\n  return ALL_ENTITLEMENTS.includes(uri as (typeof ALL_ENTITLEMENTS)[number])\n}\n\n/**\n * Check if a given URI is a PSP sub-entitlement\n */\nexport function isPSPSubEntitlement(uri: string): boolean {\n  return ALL_PSP_SUB_ENTITLEMENTS.includes(uri as (typeof ALL_PSP_SUB_ENTITLEMENTS)[number])\n}\n\n/**\n * Check if entitlements include an attestation provider role\n */\nexport function hasAttestationProviderEntitlement(entitlements: string[]): boolean {\n  return entitlements.some((e) =>\n    ATTESTATION_PROVIDER_ENTITLEMENTS.includes(e as (typeof ATTESTATION_PROVIDER_ENTITLEMENTS)[number])\n  )\n}\n\n/**\n * Get the semantic identifier prefix for a given identifier type URI\n */\nexport function getIdentifierPrefix(typeUri: string): string | undefined {\n  return IDENTIFIER_TYPE_TO_PREFIX[typeUri]\n}\n","/**\n * WRPRC Zod Schemas\n *\n * Zod schemas for ETSI TS 119 475 (Wallet-Relying Party Registration Certificates).\n * Types are derived from these schemas via z.infer<>.\n *\n * @see https://www.etsi.org/deliver/etsi_ts/119400_119499/119475/01.02.01_60/ts_119475v010201p.pdf\n */\n\nimport { z } from 'zod'\n\n// ============================================================================\n// Multilingual Value Schemas\n// ============================================================================\n\n/**\n * Multilingual string schema (B.2.6 Class MultiLangString)\n */\nexport const MultiLangStringSchema = z.object({\n  /** Language code per BCP47/RFC 5646 */\n  lang: z.string().min(2),\n  /** Localized string value */\n  content: z.string().min(1),\n})\n\n// ============================================================================\n// Identity Schemas\n// ============================================================================\n\n/**\n * Supervisory Authority schema for Data Protection Authority\n */\nexport const SupervisoryAuthoritySchema = z.object({\n  /** Email address of the Data Protection Authority */\n  email: z.email().optional(),\n  /** Telephone number of the Data Protection Authority */\n  phone: z.string().optional(),\n  /** URL of web form provided by the Data Protection Authority */\n  uri: z.url().optional(),\n})\n\n/**\n * Claim schema for credential attribute specification (B.2.10 Class Claim)\n */\nexport const ClaimSchema = z.object({\n  /** Path pointer that specifies the path to a claim within the Credential */\n  path: z.array(z.string()).min(1),\n  /** Array of expected values of the claim */\n  values: z.array(z.union([z.string(), z.number(), z.boolean()])).optional(),\n})\n\n/**\n * Credential schema for attestations (B.2.9 Class Credential)\n */\nexport const CredentialSchema = z.object({\n  /** Format of the attestation (e.g., \"dc+sd-jwt\", \"mso_mdoc\") */\n  format: z.string().min(1),\n  /** Object defining additional properties per Credential Format */\n  meta: z.record(z.string(), z.unknown()),\n  /** Array of claim objects specifying requestable attributes */\n  claim: z.array(ClaimSchema).optional(),\n})\n\n/**\n * Status list reference for certificate validity\n */\nexport const StatusListSchema = z.object({\n  /** Index in the status list */\n  idx: z.number().int().nonnegative(),\n  /** URI to the status list */\n  uri: z.url(),\n})\n\n/**\n * Status schema for WRPRC validity\n */\nexport const StatusSchema = z.object({\n  status_list: StatusListSchema,\n})\n\n/**\n * Intermediary information when WRP acts through an intermediary\n */\nexport const IntermediarySchema = z.object({\n  /** Identifier of the intermediary */\n  sub: z.string().min(1),\n  /** Name of the intermediary */\n  name: z.string().min(1),\n})\n\n// ============================================================================\n// WRPRC Payload Schema\n// ============================================================================\n\n/**\n * WRPRC Payload schema according to ETSI TS 119 475 clause 5.2.4\n */\nexport const WRPRCPayloadSchema = z.object({\n  /** The subject trade name of the WRPRC (B.2.1 tradeName) */\n  name: z.string().min(1),\n\n  /** Legal name for legal person (B.2.3 legalName) */\n  sub_ln: z.string().optional(),\n\n  /** Given name for natural person (B.2.4 givenName) */\n  sub_gn: z.string().optional(),\n\n  /** Family name for natural person (B.2.4 familyName) */\n  sub_fn: z.string().optional(),\n\n  /** WRP identifier following semantic identifier rules */\n  sub: z.string().min(1),\n\n  /** Country code (ISO 3166-1 Alpha-2) */\n  country: z.string().length(2),\n\n  /** URL pointing to the national registry API endpoint */\n  registry_uri: z.url(),\n\n  /** Descriptions of the services provided by the WRP */\n  srv_description: z.array(z.array(MultiLangStringSchema)).optional(),\n\n  /** List of entitlements assigned to the WRP */\n  entitlements: z.array(z.url()).min(1),\n\n  /** URL to the WRP's privacy policy */\n  privacy_policy: z.url().optional(),\n\n  /** URL general-purpose web address */\n  info_uri: z.url().optional(),\n\n  /** URL or email for data deletion/portability requests */\n  support_uri: z.url().or(z.email()).optional(),\n\n  /** Data Protection Authority supervising the WRP */\n  supervisory_authority: SupervisoryAuthoritySchema.optional(),\n\n  /** Policy identifier as defined in clause 6.1.3 */\n  policy_id: z.array(z.string()).optional(),\n\n  /** URL to the certificate policy and practice statement */\n  certificate_policy: z.url().optional(),\n\n  /** Unix timestamp indicating when the WRPRC was issued */\n  iat: z.number().int().positive(),\n\n  /** Status list for WRPRC validity */\n  status: StatusSchema.optional(),\n\n  /** Purpose of the intended data processing */\n  purpose: z.array(MultiLangStringSchema).optional(),\n\n  /** Set of credentials intended to be requested by the WRP */\n  credentials: z.array(CredentialSchema).optional(),\n\n  /** Set of credentials issued by the WRP (for attestation providers) */\n  provides_attestations: z.array(CredentialSchema).optional(),\n\n  /** Intermediary information when WRP acts through an intermediary */\n  intermediary: IntermediarySchema.optional(),\n})\n\n// ============================================================================\n// WRPRC Header Schemas\n// ============================================================================\n\n/**\n * JWT Header schema according to ETSI TS 119 475 clause 5.2.2\n */\nexport const WRPRCJWTHeaderSchema = z.object({\n  /** Type of the Web Token - must be \"rc-wrp+jwt\" for JWT */\n  typ: z.literal('rc-wrp+jwt'),\n  /** Algorithm used to sign the JWT */\n  alg: z.enum(['ES256', 'ES384', 'ES512', 'RS256', 'RS384', 'RS512']),\n  /** Certificate chain to verify the JWT */\n  x5c: z.array(z.string()).min(1),\n  /** Key ID */\n  kid: z.string().optional(),\n})\n\n/**\n * CWT Header schema according to ETSI TS 119 475 clause 5.2.3\n */\nexport const WRPRCCWTHeaderSchema = z.object({\n  /** Type of the Web Token - must be \"rc-wrp+cwt\" for CWT */\n  typ: z.literal('rc-wrp+cwt'),\n  /** Algorithm used to sign the CWT per RFC 9052 */\n  alg: z.number().int(),\n  /** Certificate chain to verify the CWT per RFC 9360 */\n  x5chain: z.array(z.instanceof(Uint8Array)).min(1),\n})\n\n// ============================================================================\n// Complete WRPRC Document Schemas\n// ============================================================================\n\n/**\n * Complete JWT WRPRC schema\n */\nexport const WRPRCJWTSchema = z.object({\n  header: WRPRCJWTHeaderSchema,\n  payload: WRPRCPayloadSchema,\n})\n\n/**\n * Complete CWT WRPRC schema\n */\nexport const WRPRCCWTSchema = z.object({\n  header: WRPRCCWTHeaderSchema,\n  payload: WRPRCPayloadSchema,\n})\n\n// ============================================================================\n// Legal Person Subject Schema (for validation)\n// ============================================================================\n\n/**\n * Schema for legal person WRPRC subject\n */\nexport const LegalPersonSubjectSchema = WRPRCPayloadSchema.extend({\n  sub_ln: z.string().min(1),\n}).omit({\n  sub_gn: true,\n  sub_fn: true,\n})\n\n/**\n * Schema for natural person WRPRC subject\n */\nexport const NaturalPersonSubjectSchema = WRPRCPayloadSchema.extend({\n  sub_gn: z.string().min(1),\n  sub_fn: z.string().min(1),\n}).omit({\n  sub_ln: true,\n})\n","import { IdentityException } from '@owf/identity-common'\n\n/**\n * WRPRCException is a custom error class for WRPRC-related exceptions.\n */\nexport class WRPRCException extends IdentityException {\n  constructor(message: string, details?: unknown) {\n    super(message, details)\n    Object.setPrototypeOf(this, WRPRCException.prototype)\n    this.name = 'WRPRCException'\n  }\n}\n","/**\n * WRPRC Builders\n *\n * Fluent builders for creating ETSI TS 119 475 Wallet-Relying Party Registration Certificates.\n *\n * @see https://www.etsi.org/deliver/etsi_ts/119400_119499/119475/01.02.01_60/ts_119475v010201p.pdf\n */\n\nimport { ENTITLEMENT_SERVICE_PROVIDER, type WRP_ENTITLEMENTS } from './entitlements'\nimport { WRPRCPayloadSchema } from './schemas'\nimport type {\n  Claim,\n  Credential,\n  Intermediary,\n  LegalPersonWRPRCInput,\n  MultiLangString,\n  NaturalPersonWRPRCInput,\n  Status,\n  SupervisoryAuthority,\n  WRPRCPayload,\n} from './types'\nimport { WRPRCException } from './wrprc-exception'\n\n// ============================================================================\n// Partial Payload Type\n// ============================================================================\n\n/**\n * A partial WRPRC payload used during building\n */\ninterface PartialWRPRCPayload {\n  name?: string\n  sub_ln?: string\n  sub_gn?: string\n  sub_fn?: string\n  sub?: string\n  country?: string\n  registry_uri?: string\n  srv_description?: MultiLangString[][]\n  entitlements?: string[]\n  privacy_policy?: string\n  info_uri?: string\n  support_uri?: string\n  supervisory_authority?: SupervisoryAuthority\n  policy_id?: string[]\n  certificate_policy?: string\n  iat?: number\n  status?: Status\n  purpose?: MultiLangString[]\n  credentials?: Credential[]\n  provides_attestations?: Credential[]\n  intermediary?: Intermediary\n}\n\n// ============================================================================\n// WRPRC Payload Builder\n// ============================================================================\n\n/**\n * Builder for creating WRPRC payloads with a fluent API\n */\nexport class WRPRCBuilder {\n  private payload: PartialWRPRCPayload = {}\n\n  /**\n   * Set the trade name (display name) of the WRP\n   */\n  name(value: string): this {\n    this.payload.name = value\n    return this\n  }\n\n  /**\n   * Set the legal name for a legal person WRP\n   */\n  legalName(value: string): this {\n    this.payload.sub_ln = value\n    return this\n  }\n\n  /**\n   * Set the given name for a natural person WRP\n   */\n  givenName(value: string): this {\n    this.payload.sub_gn = value\n    return this\n  }\n\n  /**\n   * Set the family name for a natural person WRP\n   */\n  familyName(value: string): this {\n    this.payload.sub_fn = value\n    return this\n  }\n\n  /**\n   * Set the WRP identifier (semantic identifier)\n   *\n   * @param identifier - The semantic identifier following ETSI EN 319 412-1\n   *                     Format: PREFIX (3 chars) + COUNTRY (2 chars) + \"-\" + ID\n   *                     Examples: \"LEIXG-529900T8BM49AURSDO55\", \"TINIT-RSSMRA85T10A562S\"\n   */\n  identifier(identifier: string): this {\n    this.payload.sub = identifier\n    return this\n  }\n\n  /**\n   * Set the country code (ISO 3166-1 Alpha-2)\n   */\n  country(code: string): this {\n    this.payload.country = code\n    return this\n  }\n\n  /**\n   * Set the URL to the national registry API endpoint\n   */\n  registryUri(uri: string): this {\n    this.payload.registry_uri = uri\n    return this\n  }\n\n  /**\n   * Add a service description in a specific language\n   */\n  serviceDescription(description: string, lang = 'en'): this {\n    this.payload.srv_description = this.payload.srv_description ?? []\n    // Each service description is an array of localized strings\n    const existing = this.payload.srv_description.find((group) => group.some((d) => d.lang === lang))\n    if (existing) {\n      existing.push({ lang, content: description })\n    } else {\n      this.payload.srv_description.push([{ lang, content: description }])\n    }\n    return this\n  }\n\n  /**\n   * Add multiple service descriptions (one array per service, with multiple languages)\n   */\n  addServiceDescriptions(descriptions: MultiLangString[]): this {\n    this.payload.srv_description = this.payload.srv_description ?? []\n    this.payload.srv_description.push(descriptions)\n    return this\n  }\n\n  /**\n   * Add an entitlement\n   *\n   * @param entitlement - The entitlement URI or key from WRP_ENTITLEMENTS\n   */\n  addEntitlement(entitlement: string | (typeof WRP_ENTITLEMENTS)[keyof typeof WRP_ENTITLEMENTS]): this {\n    this.payload.entitlements = this.payload.entitlements ?? []\n    if (!this.payload.entitlements.includes(entitlement)) {\n      this.payload.entitlements.push(entitlement)\n    }\n    return this\n  }\n\n  /**\n   * Set all entitlements (replaces existing)\n   */\n  entitlements(entitlements: string[]): this {\n    this.payload.entitlements = [...entitlements]\n    return this\n  }\n\n  /**\n   * Set the privacy policy URL\n   */\n  privacyPolicy(uri: string): this {\n    this.payload.privacy_policy = uri\n    return this\n  }\n\n  /**\n   * Set the info URI (general-purpose web address)\n   */\n  infoUri(uri: string): this {\n    this.payload.info_uri = uri\n    return this\n  }\n\n  /**\n   * Set the support URI for data requests\n   */\n  supportUri(uri: string): this {\n    this.payload.support_uri = uri\n    return this\n  }\n\n  /**\n   * Set the supervisory authority (Data Protection Authority)\n   */\n  supervisoryAuthority(authority: SupervisoryAuthority): this {\n    this.payload.supervisory_authority = authority\n    return this\n  }\n\n  /**\n   * Set the policy ID(s)\n   */\n  policyId(ids: string[]): this {\n    this.payload.policy_id = ids\n    return this\n  }\n\n  /**\n   * Set the certificate policy URL\n   */\n  certificatePolicy(uri: string): this {\n    this.payload.certificate_policy = uri\n    return this\n  }\n\n  /**\n   * Set the issued-at timestamp (Unix timestamp)\n   * If not set, will default to current time when building\n   */\n  issuedAt(timestamp: number | Date): this {\n    this.payload.iat = typeof timestamp === 'number' ? timestamp : Math.floor(timestamp.getTime() / 1000)\n    return this\n  }\n\n  /**\n   * Set the status reference for certificate validity\n   */\n  status(status: Status): this {\n    this.payload.status = status\n    return this\n  }\n\n  /**\n   * Add a purpose description\n   */\n  addPurpose(description: string, lang = 'en'): this {\n    this.payload.purpose = this.payload.purpose ?? []\n    this.payload.purpose.push({ lang, content: description })\n    return this\n  }\n\n  /**\n   * Set all purposes (replaces existing)\n   */\n  purposes(purposes: MultiLangString[]): this {\n    this.payload.purpose = purposes\n    return this\n  }\n\n  /**\n   * Add a credential that the WRP intends to request\n   */\n  addCredential(credential: Credential): this {\n    this.payload.credentials = this.payload.credentials ?? []\n    this.payload.credentials.push(credential)\n    return this\n  }\n\n  /**\n   * Add a credential the WRP provides (for attestation providers)\n   */\n  addProvidedAttestation(credential: Credential): this {\n    this.payload.provides_attestations = this.payload.provides_attestations ?? []\n    this.payload.provides_attestations.push(credential)\n    return this\n  }\n\n  /**\n   * Set intermediary information\n   */\n  intermediary(intermediary: Intermediary): this {\n    this.payload.intermediary = intermediary\n    return this\n  }\n\n  /**\n   * Build the WRPRC payload\n   *\n   * @throws WRPRCException if the payload is invalid\n   */\n  build(): WRPRCPayload {\n    // Set default iat if not provided\n    if (!this.payload.iat) {\n      this.payload.iat = Math.floor(Date.now() / 1000)\n    }\n\n    const result = WRPRCPayloadSchema.safeParse(this.payload)\n\n    if (!result.success) {\n      const messages = result.error.issues.map((i) => `${i.path.join('.')}: ${i.message}`).join('\\n')\n      throw new WRPRCException(`Invalid WRPRC payload:\\n${messages}`, result.error.issues)\n    }\n\n    return result.data\n  }\n}\n\n// ============================================================================\n// Credential Builder\n// ============================================================================\n\n/**\n * Builder for creating Credential objects\n */\nexport class CredentialBuilder {\n  private credential: Partial<Credential> = {}\n\n  /**\n   * Set the credential format\n   *\n   * @param format - The format identifier (e.g., \"dc+sd-jwt\", \"mso_mdoc\")\n   */\n  format(format: string): this {\n    this.credential.format = format\n    return this\n  }\n\n  /**\n   * Set the credential metadata\n   *\n   * @param meta - Metadata object per credential format specification\n   */\n  meta(meta: Record<string, unknown>): this {\n    this.credential.meta = meta\n    return this\n  }\n\n  /**\n   * Set SD-JWT credential metadata (vct_values)\n   */\n  sdJwtMeta(vctValues: string[]): this {\n    this.credential.format = 'dc+sd-jwt'\n    this.credential.meta = { vct_values: vctValues }\n    return this\n  }\n\n  /**\n   * Set mDL/mDoc credential metadata (doctype_value)\n   */\n  mdocMeta(doctypeValue: string): this {\n    this.credential.format = 'mso_mdoc'\n    this.credential.meta = { doctype_value: doctypeValue }\n    return this\n  }\n\n  /**\n   * Add a claim to request\n   */\n  addClaim(claim: Claim): this {\n    this.credential.claim = this.credential.claim ?? []\n    this.credential.claim.push(claim)\n    return this\n  }\n\n  /**\n   * Add a simple path claim\n   */\n  addPathClaim(...path: string[]): this {\n    this.credential.claim = this.credential.claim ?? []\n    this.credential.claim.push({ path })\n    return this\n  }\n\n  /**\n   * Build the Credential object\n   */\n  build(): Credential {\n    if (!this.credential.format) {\n      throw new WRPRCException('Credential format is required')\n    }\n    if (!this.credential.meta) {\n      throw new WRPRCException('Credential meta is required')\n    }\n    return this.credential as Credential\n  }\n}\n\n// ============================================================================\n// Factory Functions\n// ============================================================================\n\n/**\n * Create a new WRPRCBuilder\n */\nexport function wrprc(): WRPRCBuilder {\n  return new WRPRCBuilder()\n}\n\n/**\n * Create a new CredentialBuilder\n */\nexport function credential(): CredentialBuilder {\n  return new CredentialBuilder()\n}\n\n/**\n * Create a WRPRC payload for a legal person\n */\nexport function createLegalPersonWRPRC(input: LegalPersonWRPRCInput): WRPRCPayload {\n  return wrprc()\n    .name(input.name)\n    .legalName(input.legalName)\n    .identifier(input.identifier)\n    .country(input.country)\n    .registryUri(input.registryUri)\n    .entitlements(input.entitlements)\n    .build()\n}\n\n/**\n * Create a WRPRC payload for a natural person\n */\nexport function createNaturalPersonWRPRC(input: NaturalPersonWRPRCInput): WRPRCPayload {\n  return wrprc()\n    .name(input.name)\n    .givenName(input.givenName)\n    .familyName(input.familyName)\n    .identifier(input.identifier)\n    .country(input.country)\n    .registryUri(input.registryUri)\n    .entitlements(input.entitlements)\n    .build()\n}\n\n/**\n * Create a simple service provider WRPRC\n */\nexport function createServiceProviderWRPRC(\n  name: string,\n  legalName: string,\n  identifier: string,\n  country: string,\n  registryUri: string\n): WRPRCPayload {\n  return wrprc()\n    .name(name)\n    .legalName(legalName)\n    .identifier(identifier)\n    .country(country)\n    .registryUri(registryUri)\n    .addEntitlement(ENTITLEMENT_SERVICE_PROVIDER)\n    .build()\n}\n","/**\n * WRPRC Validator\n *\n * Validation functions for ETSI TS 119 475 Wallet-Relying Party Registration Certificates.\n *\n * @see https://www.etsi.org/deliver/etsi_ts/119400_119499/119475/01.02.01_60/ts_119475v010201p.pdf\n */\n\nimport { ALL_ENTITLEMENTS, ALL_PSP_SUB_ENTITLEMENTS, ATTESTATION_PROVIDER_ENTITLEMENTS } from './entitlements'\nimport {\n  LegalPersonSubjectSchema,\n  NaturalPersonSubjectSchema,\n  WRPRCJWTHeaderSchema,\n  WRPRCPayloadSchema,\n} from './schemas'\nimport type { WRPRCPayload } from './types'\nimport { WRPRCException } from './wrprc-exception'\n\n// ============================================================================\n// Validation Result Types\n// ============================================================================\n\n/**\n * A single validation error\n */\nexport interface ValidationError {\n  /** Path to the invalid field */\n  path: string[]\n  /** Error message */\n  message: string\n  /** Error code */\n  code: string\n}\n\n/**\n * Result of WRPRC validation\n */\nexport interface ValidationResult {\n  /** Whether the WRPRC is valid */\n  valid: boolean\n  /** List of validation errors (empty if valid) */\n  errors: ValidationError[]\n  /** Warnings that don't invalidate the certificate but should be noted */\n  warnings: ValidationError[]\n}\n\n// ============================================================================\n// Core Validation Functions\n// ============================================================================\n\n/**\n * Validate a WRPRC payload against the schema\n */\nexport function validateWRPRCPayload(payload: unknown): ValidationResult {\n  const result = WRPRCPayloadSchema.safeParse(payload)\n  const errors: ValidationError[] = []\n  const warnings: ValidationError[] = []\n\n  if (!result.success) {\n    for (const issue of result.error.issues) {\n      errors.push({\n        path: issue.path.map(String),\n        message: issue.message,\n        code: issue.code,\n      })\n    }\n    return { valid: false, errors, warnings }\n  }\n\n  // Additional semantic validations\n  const validPayload: WRPRCPayload = result.data\n\n  // Check entitlements are valid URIs from the standard\n  for (const entitlement of validPayload.entitlements) {\n    if (!ALL_ENTITLEMENTS.includes(entitlement as (typeof ALL_ENTITLEMENTS)[number])) {\n      // Check if it's a sub-entitlement\n      if (!ALL_PSP_SUB_ENTITLEMENTS.includes(entitlement as (typeof ALL_PSP_SUB_ENTITLEMENTS)[number])) {\n        warnings.push({\n          path: ['entitlements'],\n          message: `Unknown entitlement URI: ${entitlement}. This may be a national or EU-defined extension.`,\n          code: 'unknown_entitlement',\n        })\n      }\n    }\n  }\n\n  // GEN-5.2.4-03: At least one entitlement must be specified\n  if (validPayload.entitlements.length === 0) {\n    errors.push({\n      path: ['entitlements'],\n      message: 'At least one entitlement must be specified (GEN-5.2.4-03)',\n      code: 'missing_entitlement',\n    })\n  }\n\n  // GEN-5.2.4-04: If sub-entitlements are present, a base entitlement must also be present\n  const hasSubEntitlement = validPayload.entitlements.some((e) =>\n    ALL_PSP_SUB_ENTITLEMENTS.includes(e as (typeof ALL_PSP_SUB_ENTITLEMENTS)[number])\n  )\n  const hasServiceProvider = validPayload.entitlements.includes(\n    'https://uri.etsi.org/19475/Entitlement/Service_Provider'\n  )\n  if (hasSubEntitlement && !hasServiceProvider) {\n    errors.push({\n      path: ['entitlements'],\n      message: 'Service provider sub-entitlements require Service_Provider entitlement (GEN-5.2.4-04)',\n      code: 'missing_base_entitlement',\n    })\n  }\n\n  // GEN-5.2.4-05: Attestation providers should have provides_attestations\n  const hasAttestationProviderRole = validPayload.entitlements.some((e) =>\n    ATTESTATION_PROVIDER_ENTITLEMENTS.includes(e as (typeof ATTESTATION_PROVIDER_ENTITLEMENTS)[number])\n  )\n  if (hasAttestationProviderRole && !validPayload.provides_attestations) {\n    warnings.push({\n      path: ['provides_attestations'],\n      message:\n        'Attestation providers should include provides_attestations field (GEN-5.2.4-05). This is recommended but not required.',\n      code: 'missing_provides_attestations',\n    })\n  }\n\n  // Validate subject identifier format (semantic identifier)\n  const subResult = validateSemanticIdentifier(validPayload.sub)\n  if (!subResult.valid) {\n    errors.push({\n      path: ['sub'],\n      message: subResult.message,\n      code: 'invalid_semantic_identifier',\n    })\n  }\n\n  return { valid: errors.length === 0, errors, warnings }\n}\n\n/**\n * Validate a JWT header for WRPRC\n */\nexport function validateWRPRCJWTHeader(header: unknown): ValidationResult {\n  const result = WRPRCJWTHeaderSchema.safeParse(header)\n  const errors: ValidationError[] = []\n  const warnings: ValidationError[] = []\n\n  if (!result.success) {\n    for (const issue of result.error.issues) {\n      errors.push({\n        path: issue.path.map(String),\n        message: issue.message,\n        code: issue.code,\n      })\n    }\n  }\n\n  return { valid: errors.length === 0, errors, warnings }\n}\n\n/**\n * Validate a complete WRPRC (header + payload)\n */\nexport function validateWRPRC(header: unknown, payload: unknown): ValidationResult {\n  const headerResult = validateWRPRCJWTHeader(header)\n  const payloadResult = validateWRPRCPayload(payload)\n\n  const errors = [\n    ...headerResult.errors.map((e) => ({ ...e, path: ['header', ...e.path] })),\n    ...payloadResult.errors.map((e) => ({ ...e, path: ['payload', ...e.path] })),\n  ]\n\n  const warnings = [\n    ...headerResult.warnings.map((w) => ({ ...w, path: ['header', ...w.path] })),\n    ...payloadResult.warnings.map((w) => ({ ...w, path: ['payload', ...w.path] })),\n  ]\n\n  return { valid: errors.length === 0, errors, warnings }\n}\n\n// ============================================================================\n// Subject Type Validation\n// ============================================================================\n\n/**\n * Check if payload represents a legal person\n */\nexport function isLegalPersonWRPRC(payload: WRPRCPayload): boolean {\n  return typeof payload.sub_ln === 'string' && payload.sub_ln.length > 0\n}\n\n/**\n * Check if payload represents a natural person\n */\nexport function isNaturalPersonWRPRC(payload: WRPRCPayload): boolean {\n  return (\n    typeof payload.sub_gn === 'string' &&\n    payload.sub_gn.length > 0 &&\n    typeof payload.sub_fn === 'string' &&\n    payload.sub_fn.length > 0\n  )\n}\n\n/**\n * Validate as legal person WRPRC\n */\nexport function validateLegalPersonWRPRC(payload: unknown): ValidationResult {\n  const result = LegalPersonSubjectSchema.safeParse(payload)\n  const errors: ValidationError[] = []\n  const warnings: ValidationError[] = []\n\n  if (!result.success) {\n    for (const issue of result.error.issues) {\n      errors.push({\n        path: issue.path.map(String),\n        message: issue.message,\n        code: issue.code,\n      })\n    }\n  }\n\n  // Additional validation for legal person identifier format\n  if (result.success) {\n    const sub: string = result.data.sub\n    // Legal person identifiers should follow ETSI EN 319 412-1 clause 5.1.4\n    // Format: 3-letter prefix + 2-letter country code + hyphen + identifier\n    if (!/^[A-Z]{3}[A-Z]{2}-.+$/.test(sub)) {\n      warnings.push({\n        path: ['sub'],\n        message:\n          'Legal person identifier should follow format: PREFIX + COUNTRY + \"-\" + ID (e.g., \"LEIXG-529900T8BM49AURSDO55\")',\n        code: 'identifier_format_warning',\n      })\n    }\n  }\n\n  return { valid: errors.length === 0, errors, warnings }\n}\n\n/**\n * Validate as natural person WRPRC\n */\nexport function validateNaturalPersonWRPRC(payload: unknown): ValidationResult {\n  const result = NaturalPersonSubjectSchema.safeParse(payload)\n  const errors: ValidationError[] = []\n  const warnings: ValidationError[] = []\n\n  if (!result.success) {\n    for (const issue of result.error.issues) {\n      errors.push({\n        path: issue.path.map(String),\n        message: issue.message,\n        code: issue.code,\n      })\n    }\n  }\n\n  // Additional validation for natural person identifier format\n  if (result.success) {\n    const sub: string = result.data.sub\n    // Natural person identifiers should follow ETSI EN 319 412-1 clause 5.1.3\n    // Format: 3-letter prefix + 2-letter country code + hyphen + identifier\n    if (!/^[A-Z]{3}[A-Z]{2}-.+$/.test(sub)) {\n      warnings.push({\n        path: ['sub'],\n        message:\n          'Natural person identifier should follow format: PREFIX + COUNTRY + \"-\" + ID (e.g., \"TINIT-RSSMRA85T10A562S\")',\n        code: 'identifier_format_warning',\n      })\n    }\n  }\n\n  return { valid: errors.length === 0, errors, warnings }\n}\n\n// ============================================================================\n// Semantic Identifier Validation\n// ============================================================================\n\n/**\n * Valid semantic identifier prefixes for legal persons (ETSI EN 319 412-1 clause 5.1.4)\n */\nconst LEGAL_PERSON_PREFIXES = ['EOR', 'LEI', 'NTR', 'VAT', 'TIN', 'EXC']\n\n/**\n * Valid semantic identifier prefixes for natural persons (ETSI EN 319 412-1 clause 5.1.3)\n */\nconst NATURAL_PERSON_PREFIXES = ['TIN', 'PAS', 'IDC', 'PNO', 'TAX']\n\n/**\n * Validate a semantic identifier format\n */\nfunction validateSemanticIdentifier(identifier: string): { valid: boolean; message: string } {\n  // Format: PREFIX (3 chars) + COUNTRY (2 chars) + \"-\" + ID\n  const match = identifier.match(/^([A-Z]{3})([A-Z]{2})-(.+)$/)\n\n  if (!match) {\n    return {\n      valid: false,\n      message: 'Semantic identifier must follow format: PREFIX (3 chars) + COUNTRY (2 chars) + \"-\" + ID',\n    }\n  }\n\n  const [, prefix, , id] = match\n\n  // Check if prefix is known\n  const allPrefixes = [...LEGAL_PERSON_PREFIXES, ...NATURAL_PERSON_PREFIXES]\n  if (!allPrefixes.includes(prefix)) {\n    // Unknown prefix is allowed per spec (national schemes may define additional prefixes)\n    // but we validate the format is correct\n  }\n\n  if (!id || id.length === 0) {\n    return {\n      valid: false,\n      message: 'Semantic identifier must have a non-empty ID part after the hyphen',\n    }\n  }\n\n  return { valid: true, message: '' }\n}\n\n// ============================================================================\n// Assertion Functions\n// ============================================================================\n\n/**\n * Assert that a WRPRC payload is valid, throws WRPRCException if not\n */\nexport function assertValidWRPRCPayload(payload: unknown): asserts payload is WRPRCPayload {\n  const result = validateWRPRCPayload(payload)\n  if (!result.valid) {\n    const messages = result.errors.map((e) => `${e.path.join('.')}: ${e.message}`).join('\\n')\n    throw new WRPRCException(`Invalid WRPRC payload:\\n${messages}`, result.errors)\n  }\n}\n\n/**\n * Assert that a WRPRC is valid (header + payload), throws WRPRCException if not\n */\nexport function assertValidWRPRC(header: unknown, payload: unknown): void {\n  const result = validateWRPRC(header, payload)\n  if (!result.valid) {\n    const messages = result.errors.map((e) => `${e.path.join('.')}: ${e.message}`).join('\\n')\n    throw new WRPRCException(`Invalid WRPRC:\\n${messages}`, result.errors)\n  }\n}\n","/**\n * WRPRC Signer\n *\n * Functions for creating and signing ETSI TS 119 475 Wallet-Relying Party Registration Certificates.\n *\n * @see https://www.etsi.org/deliver/etsi_ts/119400_119499/119475/01.02.01_60/ts_119475v010201p.pdf\n */\n\nimport { pemToDer } from '@owf/crypto'\nimport { base64urlEncode, decodeJwt } from '@owf/identity-common'\nimport type { SignedWRPRC, SignOptions, WRPRCJWTHeader, WRPRCPayload } from './types'\nimport { assertValidWRPRCPayload } from './validator'\nimport { WRPRCException } from './wrprc-exception'\n\n// ============================================================================\n// JWT Signing\n// ============================================================================\n\n/**\n * Sign a WRPRC payload to create a JWT\n *\n * @param options - Signing options including payload, algorithm, certificates, and signer\n * @returns Signed WRPRC with JWS string and decoded parts\n */\nexport async function signWRPRC(options: SignOptions): Promise<SignedWRPRC> {\n  const { payload, algorithm = 'ES256', certificates, keyId, signer } = options\n\n  // Validate payload\n  assertValidWRPRCPayload(payload)\n\n  if (!certificates || certificates.length === 0) {\n    throw new WRPRCException('At least one certificate is required for x5c header')\n  }\n\n  // Extract base64 content from PEM certificates\n  const x5c = certificates.map((cert) => {\n    const content = pemToDer(cert)\n    if (!content) {\n      throw new WRPRCException('Invalid PEM certificate format')\n    }\n    return content\n  })\n\n  // Create JWT header\n  const header: WRPRCJWTHeader = {\n    typ: 'rc-wrp+jwt',\n    alg: algorithm,\n    x5c,\n    ...(keyId && { kid: keyId }),\n  }\n\n  // Encode header and payload\n  const encodedHeader = base64urlEncode(JSON.stringify(header))\n  const encodedPayload = base64urlEncode(JSON.stringify(payload))\n  const signingInput = `${encodedHeader}.${encodedPayload}`\n\n  // Sign\n  const signature = await signer(signingInput)\n\n  // Create compact JWS\n  const jws = `${signingInput}.${signature}`\n\n  return {\n    jws,\n    header,\n    payload,\n  }\n}\n\n// ============================================================================\n// JWT Decoding\n// ============================================================================\n\n/**\n * Decode a signed WRPRC JWT (without verification)\n *\n * @param jws - The compact JWS string\n * @returns Decoded WRPRC with header and payload\n */\nexport function decodeWRPRC(jws: string): SignedWRPRC {\n  const decoded = decodeJwt(jws)\n\n  // Validate typ header\n  if (decoded.header.typ !== 'rc-wrp+jwt') {\n    throw new WRPRCException(`Invalid WRPRC type: expected \"rc-wrp+jwt\", got \"${decoded.header.typ}\"`)\n  }\n\n  // Validate payload structure\n  assertValidWRPRCPayload(decoded.payload)\n\n  return {\n    jws,\n    header: decoded.header as WRPRCJWTHeader,\n    payload: decoded.payload as WRPRCPayload,\n  }\n}\n\n/**\n * Parse a WRPRC JWT without validation (for inspection purposes)\n *\n * @param jws - The compact JWS string\n * @returns Decoded parts without validation\n */\nexport function parseWRPRC(jws: string): { header: unknown; payload: unknown; signature: string } {\n  const decoded = decodeJwt(jws)\n  const parts = jws.split('.')\n\n  return {\n    header: decoded.header,\n    payload: decoded.payload,\n    signature: parts[2],\n  }\n}\n\n// ============================================================================\n// WRPRC Creation Helpers\n// ============================================================================\n\n/**\n * Create a WRPRC with automatic timestamp\n *\n * @param payload - Partial payload (iat will be set automatically if not provided)\n * @returns Complete payload with timestamp\n */\nexport function createWRPRCPayload(payload: Omit<WRPRCPayload, 'iat'> & { iat?: number }): WRPRCPayload {\n  const completePayload: WRPRCPayload = {\n    ...payload,\n    iat: payload.iat ?? Math.floor(Date.now() / 1000),\n  }\n\n  assertValidWRPRCPayload(completePayload)\n\n  return completePayload\n}\n"],"mappings":";;;;;;;AAgCA,MAAa,+BAA+B;;;;;AAM5C,MAAa,4BAA4B;;;;;AAMzC,MAAa,iCAAiC;;;;;AAM9C,MAAa,+BAA+B;;;;;AAM5C,MAAa,2BAA2B;;;;AAwCxC,MAAa,mBAAmB;CAC9B,kBAAkB;CAClB,eAAe;CACf,oBAAoB;CACpB,kBAAkB;CAClB,cAAc;CACd,0BAA0B;CAC1B,yBAAyB;CACzB,oBAAoB;CACpB,mBAAmB;CACnB,8BAA8B;AAChC;;;;AAKA,MAAa,mBAAmB,OAAO,OAAO,gBAAgB;;;;AAK9D,MAAa,oCAAoC;CAC/C;CACA;CACA;CACA;AACF;;;;;AAUA,MAAa,uBAAuB;;CAElC,mBAAmB;;CAEnB,oBAAoB;;CAEpB,qBAAqB;;CAErB,YAAY;;CAEZ,aAAa;AACf;;;;AAKA,MAAa,2BAA2B,OAAO,OAAO,oBAAoB;;;;AAS1E,MAAa,mBAAmB;;CAE9B,MAAM;;CAEN,KAAK;;CAEL,MAAM;;CAEN,OAAO;;CAEP,KAAK;;CAEL,QAAQ;AACV;AAOG,iBAAiB,MACjB,iBAAiB,KACjB,iBAAiB,MACjB,iBAAiB,OACjB,iBAAiB,KACjB,iBAAiB;;;;AAuCpB,SAAgB,mBAAmB,KAAsB;CACvD,OAAO,iBAAiB,SAAS,GAAwC;AAC3E;;;;AAKA,SAAgB,oBAAoB,KAAsB;CACxD,OAAO,yBAAyB,SAAS,GAAgD;AAC3F;;;;AAKA,SAAgB,kCAAkC,cAAiC;CACjF,OAAO,aAAa,MAAM,MACxB,kCAAkC,SAAS,CAAuD,CACpG;AACF;;;;;;;;;;;;;;AC7NA,MAAa,wBAAwB,EAAE,OAAO;;CAE5C,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;;CAEtB,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;AAC3B,CAAC;;;;AASD,MAAa,6BAA6B,EAAE,OAAO;;CAEjD,OAAO,EAAE,MAAM,CAAC,CAAC,SAAS;;CAE1B,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS;;CAE3B,KAAK,EAAE,IAAI,CAAC,CAAC,SAAS;AACxB,CAAC;;;;AAKD,MAAa,cAAc,EAAE,OAAO;;CAElC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;;CAE/B,QAAQ,EAAE,MAAM,EAAE,MAAM;EAAC,EAAE,OAAO;EAAG,EAAE,OAAO;EAAG,EAAE,QAAQ;CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;AAC3E,CAAC;;;;AAKD,MAAa,mBAAmB,EAAE,OAAO;;CAEvC,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;;CAExB,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;;CAEtC,OAAO,EAAE,MAAM,WAAW,CAAC,CAAC,SAAS;AACvC,CAAC;;;;AAKD,MAAa,mBAAmB,EAAE,OAAO;;CAEvC,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY;;CAElC,KAAK,EAAE,IAAI;AACb,CAAC;;;;AAKD,MAAa,eAAe,EAAE,OAAO,EACnC,aAAa,iBACf,CAAC;;;;AAKD,MAAa,qBAAqB,EAAE,OAAO;;CAEzC,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;;CAErB,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;AACxB,CAAC;;;;AASD,MAAa,qBAAqB,EAAE,OAAO;;CAEzC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;;CAGtB,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;;CAG5B,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;;CAG5B,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;;CAG5B,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;;CAGrB,SAAS,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC;;CAG5B,cAAc,EAAE,IAAI;;CAGpB,iBAAiB,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC,CAAC,CAAC,SAAS;;CAGlE,cAAc,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;;CAGpC,gBAAgB,EAAE,IAAI,CAAC,CAAC,SAAS;;CAGjC,UAAU,EAAE,IAAI,CAAC,CAAC,SAAS;;CAG3B,aAAa,EAAE,IAAI,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS;;CAG5C,uBAAuB,2BAA2B,SAAS;;CAG3D,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;;CAGxC,oBAAoB,EAAE,IAAI,CAAC,CAAC,SAAS;;CAGrC,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;;CAG/B,QAAQ,aAAa,SAAS;;CAG9B,SAAS,EAAE,MAAM,qBAAqB,CAAC,CAAC,SAAS;;CAGjD,aAAa,EAAE,MAAM,gBAAgB,CAAC,CAAC,SAAS;;CAGhD,uBAAuB,EAAE,MAAM,gBAAgB,CAAC,CAAC,SAAS;;CAG1D,cAAc,mBAAmB,SAAS;AAC5C,CAAC;;;;AASD,MAAa,uBAAuB,EAAE,OAAO;;CAE3C,KAAK,EAAE,QAAQ,YAAY;;CAE3B,KAAK,EAAE,KAAK;EAAC;EAAS;EAAS;EAAS;EAAS;EAAS;CAAO,CAAC;;CAElE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;;CAE9B,KAAK,EAAE,OAAO,CAAC,CAAC,SAAS;AAC3B,CAAC;;;;AAKD,MAAa,uBAAuB,EAAE,OAAO;;CAE3C,KAAK,EAAE,QAAQ,YAAY;;CAE3B,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI;;CAEpB,SAAS,EAAE,MAAM,EAAE,WAAW,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAS6B,EAAE,OAAO;CACrC,QAAQ;CACR,SAAS;AACX,CAAC;AAK6B,EAAE,OAAO;CACrC,QAAQ;CACR,SAAS;AACX,CAAC;;;;AASD,MAAa,2BAA2B,mBAAmB,OAAO,EAChE,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAC1B,CAAC,CAAC,CAAC,KAAK;CACN,QAAQ;CACR,QAAQ;AACV,CAAC;;;;AAKD,MAAa,6BAA6B,mBAAmB,OAAO;CAClE,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACxB,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;AAC1B,CAAC,CAAC,CAAC,KAAK,EACN,QAAQ,KACV,CAAC;;;;;;ACrOD,IAAa,iBAAb,MAAa,uBAAuB,kBAAkB;CACpD,YAAY,SAAiB,SAAmB;EAC9C,MAAM,SAAS,OAAO;EACtB,OAAO,eAAe,MAAM,eAAe,SAAS;EACpD,KAAK,OAAO;CACd;AACF;;;;;;;;;;;;;ACkDA,IAAa,eAAb,MAA0B;;iBACe,CAAC;;;;;CAKxC,KAAK,OAAqB;EACxB,KAAK,QAAQ,OAAO;EACpB,OAAO;CACT;;;;CAKA,UAAU,OAAqB;EAC7B,KAAK,QAAQ,SAAS;EACtB,OAAO;CACT;;;;CAKA,UAAU,OAAqB;EAC7B,KAAK,QAAQ,SAAS;EACtB,OAAO;CACT;;;;CAKA,WAAW,OAAqB;EAC9B,KAAK,QAAQ,SAAS;EACtB,OAAO;CACT;;;;;;;;CASA,WAAW,YAA0B;EACnC,KAAK,QAAQ,MAAM;EACnB,OAAO;CACT;;;;CAKA,QAAQ,MAAoB;EAC1B,KAAK,QAAQ,UAAU;EACvB,OAAO;CACT;;;;CAKA,YAAY,KAAmB;EAC7B,KAAK,QAAQ,eAAe;EAC5B,OAAO;CACT;;;;CAKA,mBAAmB,aAAqB,OAAO,MAAY;EACzD,KAAK,QAAQ,kBAAkB,KAAK,QAAQ,mBAAmB,CAAC;EAEhE,MAAM,WAAW,KAAK,QAAQ,gBAAgB,MAAM,UAAU,MAAM,MAAM,MAAM,EAAE,SAAS,IAAI,CAAC;EAChG,IAAI,UACF,SAAS,KAAK;GAAE;GAAM,SAAS;EAAY,CAAC;OAE5C,KAAK,QAAQ,gBAAgB,KAAK,CAAC;GAAE;GAAM,SAAS;EAAY,CAAC,CAAC;EAEpE,OAAO;CACT;;;;CAKA,uBAAuB,cAAuC;EAC5D,KAAK,QAAQ,kBAAkB,KAAK,QAAQ,mBAAmB,CAAC;EAChE,KAAK,QAAQ,gBAAgB,KAAK,YAAY;EAC9C,OAAO;CACT;;;;;;CAOA,eAAe,aAAsF;EACnG,KAAK,QAAQ,eAAe,KAAK,QAAQ,gBAAgB,CAAC;EAC1D,IAAI,CAAC,KAAK,QAAQ,aAAa,SAAS,WAAW,GACjD,KAAK,QAAQ,aAAa,KAAK,WAAW;EAE5C,OAAO;CACT;;;;CAKA,aAAa,cAA8B;EACzC,KAAK,QAAQ,eAAe,CAAC,GAAG,YAAY;EAC5C,OAAO;CACT;;;;CAKA,cAAc,KAAmB;EAC/B,KAAK,QAAQ,iBAAiB;EAC9B,OAAO;CACT;;;;CAKA,QAAQ,KAAmB;EACzB,KAAK,QAAQ,WAAW;EACxB,OAAO;CACT;;;;CAKA,WAAW,KAAmB;EAC5B,KAAK,QAAQ,cAAc;EAC3B,OAAO;CACT;;;;CAKA,qBAAqB,WAAuC;EAC1D,KAAK,QAAQ,wBAAwB;EACrC,OAAO;CACT;;;;CAKA,SAAS,KAAqB;EAC5B,KAAK,QAAQ,YAAY;EACzB,OAAO;CACT;;;;CAKA,kBAAkB,KAAmB;EACnC,KAAK,QAAQ,qBAAqB;EAClC,OAAO;CACT;;;;;CAMA,SAAS,WAAgC;EACvC,KAAK,QAAQ,MAAM,OAAO,cAAc,WAAW,YAAY,KAAK,MAAM,UAAU,QAAQ,IAAI,GAAI;EACpG,OAAO;CACT;;;;CAKA,OAAO,QAAsB;EAC3B,KAAK,QAAQ,SAAS;EACtB,OAAO;CACT;;;;CAKA,WAAW,aAAqB,OAAO,MAAY;EACjD,KAAK,QAAQ,UAAU,KAAK,QAAQ,WAAW,CAAC;EAChD,KAAK,QAAQ,QAAQ,KAAK;GAAE;GAAM,SAAS;EAAY,CAAC;EACxD,OAAO;CACT;;;;CAKA,SAAS,UAAmC;EAC1C,KAAK,QAAQ,UAAU;EACvB,OAAO;CACT;;;;CAKA,cAAc,YAA8B;EAC1C,KAAK,QAAQ,cAAc,KAAK,QAAQ,eAAe,CAAC;EACxD,KAAK,QAAQ,YAAY,KAAK,UAAU;EACxC,OAAO;CACT;;;;CAKA,uBAAuB,YAA8B;EACnD,KAAK,QAAQ,wBAAwB,KAAK,QAAQ,yBAAyB,CAAC;EAC5E,KAAK,QAAQ,sBAAsB,KAAK,UAAU;EAClD,OAAO;CACT;;;;CAKA,aAAa,cAAkC;EAC7C,KAAK,QAAQ,eAAe;EAC5B,OAAO;CACT;;;;;;CAOA,QAAsB;EAEpB,IAAI,CAAC,KAAK,QAAQ,KAChB,KAAK,QAAQ,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;EAGjD,MAAM,SAAS,mBAAmB,UAAU,KAAK,OAAO;EAExD,IAAI,CAAC,OAAO,SAEV,MAAM,IAAI,eAAe,2BADR,OAAO,MAAM,OAAO,KAAK,MAAM,GAAG,EAAE,KAAK,KAAK,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,KAAK,IAC/B,KAAK,OAAO,MAAM,MAAM;EAGrF,OAAO,OAAO;CAChB;AACF;;;;AASA,IAAa,oBAAb,MAA+B;;oBACa,CAAC;;;;;;;CAO3C,OAAO,QAAsB;EAC3B,KAAK,WAAW,SAAS;EACzB,OAAO;CACT;;;;;;CAOA,KAAK,MAAqC;EACxC,KAAK,WAAW,OAAO;EACvB,OAAO;CACT;;;;CAKA,UAAU,WAA2B;EACnC,KAAK,WAAW,SAAS;EACzB,KAAK,WAAW,OAAO,EAAE,YAAY,UAAU;EAC/C,OAAO;CACT;;;;CAKA,SAAS,cAA4B;EACnC,KAAK,WAAW,SAAS;EACzB,KAAK,WAAW,OAAO,EAAE,eAAe,aAAa;EACrD,OAAO;CACT;;;;CAKA,SAAS,OAAoB;EAC3B,KAAK,WAAW,QAAQ,KAAK,WAAW,SAAS,CAAC;EAClD,KAAK,WAAW,MAAM,KAAK,KAAK;EAChC,OAAO;CACT;;;;CAKA,aAAa,GAAG,MAAsB;EACpC,KAAK,WAAW,QAAQ,KAAK,WAAW,SAAS,CAAC;EAClD,KAAK,WAAW,MAAM,KAAK,EAAE,KAAK,CAAC;EACnC,OAAO;CACT;;;;CAKA,QAAoB;EAClB,IAAI,CAAC,KAAK,WAAW,QACnB,MAAM,IAAI,eAAe,+BAA+B;EAE1D,IAAI,CAAC,KAAK,WAAW,MACnB,MAAM,IAAI,eAAe,6BAA6B;EAExD,OAAO,KAAK;CACd;AACF;;;;AASA,SAAgB,QAAsB;CACpC,OAAO,IAAI,aAAa;AAC1B;;;;AAKA,SAAgB,aAAgC;CAC9C,OAAO,IAAI,kBAAkB;AAC/B;;;;AAKA,SAAgB,uBAAuB,OAA4C;CACjF,OAAO,MAAM,CAAC,CACX,KAAK,MAAM,IAAI,CAAC,CAChB,UAAU,MAAM,SAAS,CAAC,CAC1B,WAAW,MAAM,UAAU,CAAC,CAC5B,QAAQ,MAAM,OAAO,CAAC,CACtB,YAAY,MAAM,WAAW,CAAC,CAC9B,aAAa,MAAM,YAAY,CAAC,CAChC,MAAM;AACX;;;;AAKA,SAAgB,yBAAyB,OAA8C;CACrF,OAAO,MAAM,CAAC,CACX,KAAK,MAAM,IAAI,CAAC,CAChB,UAAU,MAAM,SAAS,CAAC,CAC1B,WAAW,MAAM,UAAU,CAAC,CAC5B,WAAW,MAAM,UAAU,CAAC,CAC5B,QAAQ,MAAM,OAAO,CAAC,CACtB,YAAY,MAAM,WAAW,CAAC,CAC9B,aAAa,MAAM,YAAY,CAAC,CAChC,MAAM;AACX;;;;AAKA,SAAgB,2BACd,MACA,WACA,YACA,SACA,aACc;CACd,OAAO,MAAM,CAAC,CACX,KAAK,IAAI,CAAC,CACV,UAAU,SAAS,CAAC,CACpB,WAAW,UAAU,CAAC,CACtB,QAAQ,OAAO,CAAC,CAChB,YAAY,WAAW,CAAC,CACxB,eAAe,4BAA4B,CAAC,CAC5C,MAAM;AACX;;;;;;;;;;;;;ACvYA,SAAgB,qBAAqB,SAAoC;CACvE,MAAM,SAAS,mBAAmB,UAAU,OAAO;CACnD,MAAM,SAA4B,CAAC;CACnC,MAAM,WAA8B,CAAC;CAErC,IAAI,CAAC,OAAO,SAAS;EACnB,KAAK,MAAM,SAAS,OAAO,MAAM,QAC/B,OAAO,KAAK;GACV,MAAM,MAAM,KAAK,IAAI,MAAM;GAC3B,SAAS,MAAM;GACf,MAAM,MAAM;EACd,CAAC;EAEH,OAAO;GAAE,OAAO;GAAO;GAAQ;EAAS;CAC1C;CAGA,MAAM,eAA6B,OAAO;CAG1C,KAAK,MAAM,eAAe,aAAa,cACrC,IAAI,CAAC,iBAAiB,SAAS,WAAgD;MAEzE,CAAC,yBAAyB,SAAS,WAAwD,GAC7F,SAAS,KAAK;GACZ,MAAM,CAAC,cAAc;GACrB,SAAS,4BAA4B,YAAY;GACjD,MAAM;EACR,CAAC;CAAA;CAMP,IAAI,aAAa,aAAa,WAAW,GACvC,OAAO,KAAK;EACV,MAAM,CAAC,cAAc;EACrB,SAAS;EACT,MAAM;CACR,CAAC;CAIH,MAAM,oBAAoB,aAAa,aAAa,MAAM,MACxD,yBAAyB,SAAS,CAA8C,CAClF;CACA,MAAM,qBAAqB,aAAa,aAAa,SACnD,yDACF;CACA,IAAI,qBAAqB,CAAC,oBACxB,OAAO,KAAK;EACV,MAAM,CAAC,cAAc;EACrB,SAAS;EACT,MAAM;CACR,CAAC;CAOH,IAHmC,aAAa,aAAa,MAAM,MACjE,kCAAkC,SAAS,CAAuD,CAEvE,KAAK,CAAC,aAAa,uBAC9C,SAAS,KAAK;EACZ,MAAM,CAAC,uBAAuB;EAC9B,SACE;EACF,MAAM;CACR,CAAC;CAIH,MAAM,YAAY,2BAA2B,aAAa,GAAG;CAC7D,IAAI,CAAC,UAAU,OACb,OAAO,KAAK;EACV,MAAM,CAAC,KAAK;EACZ,SAAS,UAAU;EACnB,MAAM;CACR,CAAC;CAGH,OAAO;EAAE,OAAO,OAAO,WAAW;EAAG;EAAQ;CAAS;AACxD;;;;AAKA,SAAgB,uBAAuB,QAAmC;CACxE,MAAM,SAAS,qBAAqB,UAAU,MAAM;CACpD,MAAM,SAA4B,CAAC;CACnC,MAAM,WAA8B,CAAC;CAErC,IAAI,CAAC,OAAO,SACV,KAAK,MAAM,SAAS,OAAO,MAAM,QAC/B,OAAO,KAAK;EACV,MAAM,MAAM,KAAK,IAAI,MAAM;EAC3B,SAAS,MAAM;EACf,MAAM,MAAM;CACd,CAAC;CAIL,OAAO;EAAE,OAAO,OAAO,WAAW;EAAG;EAAQ;CAAS;AACxD;;;;AAKA,SAAgB,cAAc,QAAiB,SAAoC;CACjF,MAAM,eAAe,uBAAuB,MAAM;CAClD,MAAM,gBAAgB,qBAAqB,OAAO;CAElD,MAAM,SAAS,CACb,GAAG,aAAa,OAAO,KAAK,OAAO;EAAE,GAAG;EAAG,MAAM,CAAC,UAAU,GAAG,EAAE,IAAI;CAAE,EAAE,GACzE,GAAG,cAAc,OAAO,KAAK,OAAO;EAAE,GAAG;EAAG,MAAM,CAAC,WAAW,GAAG,EAAE,IAAI;CAAE,EAAE,CAC7E;CAEA,MAAM,WAAW,CACf,GAAG,aAAa,SAAS,KAAK,OAAO;EAAE,GAAG;EAAG,MAAM,CAAC,UAAU,GAAG,EAAE,IAAI;CAAE,EAAE,GAC3E,GAAG,cAAc,SAAS,KAAK,OAAO;EAAE,GAAG;EAAG,MAAM,CAAC,WAAW,GAAG,EAAE,IAAI;CAAE,EAAE,CAC/E;CAEA,OAAO;EAAE,OAAO,OAAO,WAAW;EAAG;EAAQ;CAAS;AACxD;;;;AASA,SAAgB,mBAAmB,SAAgC;CACjE,OAAO,OAAO,QAAQ,WAAW,YAAY,QAAQ,OAAO,SAAS;AACvE;;;;AAKA,SAAgB,qBAAqB,SAAgC;CACnE,OACE,OAAO,QAAQ,WAAW,YAC1B,QAAQ,OAAO,SAAS,KACxB,OAAO,QAAQ,WAAW,YAC1B,QAAQ,OAAO,SAAS;AAE5B;;;;AAKA,SAAgB,yBAAyB,SAAoC;CAC3E,MAAM,SAAS,yBAAyB,UAAU,OAAO;CACzD,MAAM,SAA4B,CAAC;CACnC,MAAM,WAA8B,CAAC;CAErC,IAAI,CAAC,OAAO,SACV,KAAK,MAAM,SAAS,OAAO,MAAM,QAC/B,OAAO,KAAK;EACV,MAAM,MAAM,KAAK,IAAI,MAAM;EAC3B,SAAS,MAAM;EACf,MAAM,MAAM;CACd,CAAC;CAKL,IAAI,OAAO,SAAS;EAClB,MAAM,MAAc,OAAO,KAAK;EAGhC,IAAI,CAAC,wBAAwB,KAAK,GAAG,GACnC,SAAS,KAAK;GACZ,MAAM,CAAC,KAAK;GACZ,SACE;GACF,MAAM;EACR,CAAC;CAEL;CAEA,OAAO;EAAE,OAAO,OAAO,WAAW;EAAG;EAAQ;CAAS;AACxD;;;;AAKA,SAAgB,2BAA2B,SAAoC;CAC7E,MAAM,SAAS,2BAA2B,UAAU,OAAO;CAC3D,MAAM,SAA4B,CAAC;CACnC,MAAM,WAA8B,CAAC;CAErC,IAAI,CAAC,OAAO,SACV,KAAK,MAAM,SAAS,OAAO,MAAM,QAC/B,OAAO,KAAK;EACV,MAAM,MAAM,KAAK,IAAI,MAAM;EAC3B,SAAS,MAAM;EACf,MAAM,MAAM;CACd,CAAC;CAKL,IAAI,OAAO,SAAS;EAClB,MAAM,MAAc,OAAO,KAAK;EAGhC,IAAI,CAAC,wBAAwB,KAAK,GAAG,GACnC,SAAS,KAAK;GACZ,MAAM,CAAC,KAAK;GACZ,SACE;GACF,MAAM;EACR,CAAC;CAEL;CAEA,OAAO;EAAE,OAAO,OAAO,WAAW;EAAG;EAAQ;CAAS;AACxD;;;;AASA,MAAM,wBAAwB;CAAC;CAAO;CAAO;CAAO;CAAO;CAAO;AAAK;;;;AAKvE,MAAM,0BAA0B;CAAC;CAAO;CAAO;CAAO;CAAO;AAAK;;;;AAKlE,SAAS,2BAA2B,YAAyD;CAE3F,MAAM,QAAQ,WAAW,MAAM,6BAA6B;CAE5D,IAAI,CAAC,OACH,OAAO;EACL,OAAO;EACP,SAAS;CACX;CAGF,MAAM,GAAG,UAAU,MAAM;CAIzB,IAAI,CAAC,CADgB,GAAG,uBAAuB,GAAG,uBACnC,CAAC,CAAC,SAAS,MAAM,GAAG,CAGnC;CAEA,IAAI,CAAC,MAAM,GAAG,WAAW,GACvB,OAAO;EACL,OAAO;EACP,SAAS;CACX;CAGF,OAAO;EAAE,OAAO;EAAM,SAAS;CAAG;AACpC;;;;AASA,SAAgB,wBAAwB,SAAmD;CACzF,MAAM,SAAS,qBAAqB,OAAO;CAC3C,IAAI,CAAC,OAAO,OAEV,MAAM,IAAI,eAAe,2BADR,OAAO,OAAO,KAAK,MAAM,GAAG,EAAE,KAAK,KAAK,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,KAAK,IACzB,KAAK,OAAO,MAAM;AAEjF;;;;AAKA,SAAgB,iBAAiB,QAAiB,SAAwB;CACxE,MAAM,SAAS,cAAc,QAAQ,OAAO;CAC5C,IAAI,CAAC,OAAO,OAEV,MAAM,IAAI,eAAe,mBADR,OAAO,OAAO,KAAK,MAAM,GAAG,EAAE,KAAK,KAAK,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,KAAK,IACjC,KAAK,OAAO,MAAM;AAEzE;;;;;;;;;;;;;;;;AC/TA,eAAsB,UAAU,SAA4C;CAC1E,MAAM,EAAE,SAAS,YAAY,SAAS,cAAc,OAAO,WAAW;CAGtE,wBAAwB,OAAO;CAE/B,IAAI,CAAC,gBAAgB,aAAa,WAAW,GAC3C,MAAM,IAAI,eAAe,qDAAqD;CAahF,MAAM,SAAyB;EAC7B,KAAK;EACL,KAAK;EACL,KAZU,aAAa,KAAK,SAAS;GACrC,MAAM,UAAU,SAAS,IAAI;GAC7B,IAAI,CAAC,SACH,MAAM,IAAI,eAAe,gCAAgC;GAE3D,OAAO;EACT,CAMI;EACF,GAAI,SAAS,EAAE,KAAK,MAAM;CAC5B;CAKA,MAAM,eAAe,GAFC,gBAAgB,KAAK,UAAU,MAAM,CAEvB,EAAE,GADf,gBAAgB,KAAK,UAAU,OAAO,CACP;CAQtD,OAAO;EACL,KAAA,GAHa,aAAa,GAAG,MAHP,OAAO,YAAY;EAOzC;EACA;CACF;AACF;;;;;;;AAYA,SAAgB,YAAY,KAA0B;CACpD,MAAM,UAAU,UAAU,GAAG;CAG7B,IAAI,QAAQ,OAAO,QAAQ,cACzB,MAAM,IAAI,eAAe,mDAAmD,QAAQ,OAAO,IAAI,EAAE;CAInG,wBAAwB,QAAQ,OAAO;CAEvC,OAAO;EACL;EACA,QAAQ,QAAQ;EAChB,SAAS,QAAQ;CACnB;AACF;;;;;;;AAQA,SAAgB,WAAW,KAAuE;CAChG,MAAM,UAAU,UAAU,GAAG;CAC7B,MAAM,QAAQ,IAAI,MAAM,GAAG;CAE3B,OAAO;EACL,QAAQ,QAAQ;EAChB,SAAS,QAAQ;EACjB,WAAW,MAAM;CACnB;AACF;;;;;;;AAYA,SAAgB,mBAAmB,SAAqE;CACtG,MAAM,kBAAgC;EACpC,GAAG;EACH,KAAK,QAAQ,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;CAClD;CAEA,wBAAwB,eAAe;CAEvC,OAAO;AACT"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../src/entitlements.ts","../src/schemas.ts","../src/wrprc-exception.ts","../src/builders.ts","../src/validator.ts","../src/signer.ts"],"sourcesContent":["/**\n * WRPRC Entitlement Constants\n *\n * Entitlement identifiers as defined in ETSI TS 119 475 Annex A.\n * These identifiers define the roles and capabilities of Wallet-Relying Parties.\n *\n * @see https://www.etsi.org/deliver/etsi_ts/119400_119499/119475/01.02.01_60/ts_119475v010201p.pdf\n */\n\n// ============================================================================\n// OID Base\n// ============================================================================\n\n/**\n * Base OID for ETSI WRPA entitlements: 0.4.0.19475\n * id-etsi-wrpa OBJECT IDENTIFIER ::= { itu-t(0) identified-organization(4) etsi(0) 19475 }\n */\nexport const ETSI_WRPA_BASE_OID = '0.4.0.19475'\n\n/**\n * OID arc for entitlements: 0.4.0.19475.1\n */\nexport const ETSI_WRPA_ENTITLEMENT_ARC = `${ETSI_WRPA_BASE_OID}.1`\n\n// ============================================================================\n// WRP Entitlement URIs (A.2)\n// ============================================================================\n\n/**\n * Service_Provider - General service provider (A.2.1)\n * OID: id-etsi-wrpa-entitlement 1\n */\nexport const ENTITLEMENT_SERVICE_PROVIDER = 'https://uri.etsi.org/19475/Entitlement/Service_Provider'\n\n/**\n * QEAA_Provider - Qualified trust service provider issuing qualified electronic attestations of attributes (A.2.2)\n * OID: id-etsi-wrpa-entitlement 2\n */\nexport const ENTITLEMENT_QEAA_PROVIDER = 'https://uri.etsi.org/19475/Entitlement/QEAA_Provider'\n\n/**\n * Non_Q_EAA_Provider - Trust service provider issuing non-qualified electronic attestations of attributes (A.2.3)\n * OID: id-etsi-wrpa-entitlement 3\n */\nexport const ENTITLEMENT_NON_Q_EAA_PROVIDER = 'https://uri.etsi.org/19475/Entitlement/Non_Q_EAA_Provider'\n\n/**\n * PUB_EAA_Provider - Public sector body or its agent issuing electronic attestations of attributes from authentic sources (A.2.4)\n * OID: id-etsi-wrpa-entitlement 4\n */\nexport const ENTITLEMENT_PUB_EAA_PROVIDER = 'https://uri.etsi.org/19475/Entitlement/PUB_EAA_Provider'\n\n/**\n * PID_Provider - Provider of person identification data (A.2.5)\n * OID: id-etsi-wrpa-entitlement 5\n */\nexport const ENTITLEMENT_PID_PROVIDER = 'https://uri.etsi.org/19475/Entitlement/PID_Provider'\n\n/**\n * QCert_for_ESeal_Provider - QTSP issuing qualified certificates for electronic seals (A.2.6)\n * OID: id-etsi-wrpa-entitlement 6\n */\nexport const ENTITLEMENT_QCERT_FOR_ESEAL_PROVIDER = 'https://uri.etsi.org/19475/Entitlement/QCert_for_ESeal_Provider'\n\n/**\n * QCert_for_ESig_Provider - QTSP issuing qualified certificates for electronic signatures (A.2.7)\n * OID: id-etsi-wrpa-entitlement 7\n */\nexport const ENTITLEMENT_QCERT_FOR_ESIG_PROVIDER = 'https://uri.etsi.org/19475/Entitlement/QCert_for_ESig_Provider'\n\n/**\n * rQSealCDs_Provider - QTSP managing remote qualified electronic seal creation devices (A.2.8)\n * OID: id-etsi-wrpa-entitlement 8\n */\nexport const ENTITLEMENT_RQSEALCDS_PROVIDER = 'https://uri.etsi.org/19475/Entitlement/rQSealCDs_Provider'\n\n/**\n * rQSigCDs_Provider - QTSP managing remote qualified electronic signature creation devices (A.2.9)\n * OID: id-etsi-wrpa-entitlement 9\n */\nexport const ENTITLEMENT_RQSIGCDS_PROVIDER = 'https://uri.etsi.org/19475/Entitlement/rQSigCDs_Provider'\n\n/**\n * ESig_ESeal_Creation_Provider - Non-qualified provider for remote signature/seal creation (A.2.10)\n * OID: id-etsi-wrpa-entitlement 10\n */\nexport const ENTITLEMENT_ESIG_ESEAL_CREATION_PROVIDER =\n  'https://uri.etsi.org/19475/Entitlement/ESig_ESeal_Creation_Provider'\n\n// ============================================================================\n// Entitlement Collection\n// ============================================================================\n\n/**\n * All standard WRP entitlements defined in ETSI TS 119 475\n */\nexport const WRP_ENTITLEMENTS = {\n  SERVICE_PROVIDER: ENTITLEMENT_SERVICE_PROVIDER,\n  QEAA_PROVIDER: ENTITLEMENT_QEAA_PROVIDER,\n  NON_Q_EAA_PROVIDER: ENTITLEMENT_NON_Q_EAA_PROVIDER,\n  PUB_EAA_PROVIDER: ENTITLEMENT_PUB_EAA_PROVIDER,\n  PID_PROVIDER: ENTITLEMENT_PID_PROVIDER,\n  QCERT_FOR_ESEAL_PROVIDER: ENTITLEMENT_QCERT_FOR_ESEAL_PROVIDER,\n  QCERT_FOR_ESIG_PROVIDER: ENTITLEMENT_QCERT_FOR_ESIG_PROVIDER,\n  RQSEALCDS_PROVIDER: ENTITLEMENT_RQSEALCDS_PROVIDER,\n  RQSIGCDS_PROVIDER: ENTITLEMENT_RQSIGCDS_PROVIDER,\n  ESIG_ESEAL_CREATION_PROVIDER: ENTITLEMENT_ESIG_ESEAL_CREATION_PROVIDER,\n} as const\n\n/**\n * List of all standard entitlement URIs\n */\nexport const ALL_ENTITLEMENTS = Object.values(WRP_ENTITLEMENTS)\n\n/**\n * Entitlements for attestation providers (QEAA, Non-Q EAA, PUB EAA, PID)\n */\nexport const ATTESTATION_PROVIDER_ENTITLEMENTS = [\n  ENTITLEMENT_QEAA_PROVIDER,\n  ENTITLEMENT_NON_Q_EAA_PROVIDER,\n  ENTITLEMENT_PUB_EAA_PROVIDER,\n  ENTITLEMENT_PID_PROVIDER,\n] as const\n\n// ============================================================================\n// Service Provider Sub-entitlements (A.3)\n// ============================================================================\n\n/**\n * Payment Service Provider Sub-entitlements (A.3.1)\n * As defined in ETSI TS 119 495\n */\nexport const PSP_SUB_ENTITLEMENTS = {\n  /** Account Servicing Payment Service Provider */\n  ACCOUNT_SERVICING: 'https://uri.etsi.org/19475/SubEntitlement/psp/psp-as',\n  /** Payment Initiation Service Provider */\n  PAYMENT_INITIATION: 'https://uri.etsi.org/19475/SubEntitlement/psp/psp-pi',\n  /** Account Information Service Provider */\n  ACCOUNT_INFORMATION: 'https://uri.etsi.org/19475/SubEntitlement/psp/psp-ai',\n  /** Payment Service Provider issuing card-based payment instruments */\n  CARD_BASED: 'https://uri.etsi.org/19475/SubEntitlement/psp/psp-ic',\n  /** Unspecified Payment Service Provider */\n  UNSPECIFIED: 'https://uri.etsi.org/19475/SubEntitlement/psp/unspecified',\n} as const\n\n/**\n * All PSP sub-entitlement URIs\n */\nexport const ALL_PSP_SUB_ENTITLEMENTS = Object.values(PSP_SUB_ENTITLEMENTS)\n\n// ============================================================================\n// Identifier Type URIs (B.2.5 Class Identifier)\n// ============================================================================\n\n/**\n * Identifier type URIs for legal person semantic identifiers\n */\nexport const IDENTIFIER_TYPES = {\n  /** Economic Operator Registration and Identification Number (EORI-No) */\n  EORI: 'http://data.europa.eu/eudi/id/EORI-No',\n  /** Legal Entity Identifier (LEI) */\n  LEI: 'http://data.europa.eu/eudi/id/LEI',\n  /** European Unique Identifier (EUID) */\n  EUID: 'http://data.europa.eu/eudi/id/EUID',\n  /** Value Added Tax Identification Number (VATIN) */\n  VATIN: 'http://data.europa.eu/eudi/id/VATIN',\n  /** Taxpayer Identification Number (TIN) */\n  TIN: 'http://data.europa.eu/eudi/id/TIN',\n  /** Excise Number */\n  EXCISE: 'http://data.europa.eu/eudi/id/Excise',\n} as const\n\n/**\n * Mapping from identifier type URIs to semantic identifier prefixes\n * as defined in ETSI EN 319 412-1\n */\nexport const IDENTIFIER_TYPE_TO_PREFIX: Record<string, string> = {\n  [IDENTIFIER_TYPES.EORI]: 'EOR',\n  [IDENTIFIER_TYPES.LEI]: 'LEI',\n  [IDENTIFIER_TYPES.EUID]: 'NTR',\n  [IDENTIFIER_TYPES.VATIN]: 'VAT',\n  [IDENTIFIER_TYPES.TIN]: 'TIN',\n  [IDENTIFIER_TYPES.EXCISE]: 'EXC',\n}\n\n// ============================================================================\n// Policy Type URIs (B.2.8 Class Policy)\n// ============================================================================\n\n/**\n * Policy type URIs\n */\nexport const POLICY_TYPES = {\n  /** Privacy Policy */\n  PRIVACY_POLICY: 'http://data.europa.eu/eudi/policy/privacy-policy',\n} as const\n\n// ============================================================================\n// Certificate Policy OIDs (clause 6.1.3)\n// ============================================================================\n\n/**\n * Base OID for WRPRC policies: 0.4.0.19475.3\n */\nexport const WRPRC_POLICY_BASE_OID = `${ETSI_WRPA_BASE_OID}.3`\n\n/**\n * WRPRC Policy OIDs\n */\nexport const WRPRC_POLICIES = {\n  /** WRPRC provider policy identifier */\n  WRPRC_PROVIDER: `${WRPRC_POLICY_BASE_OID}.1`,\n} as const\n\n// ============================================================================\n// Type Guards and Helpers\n// ============================================================================\n\n/**\n * Check if a given URI is a valid WRP entitlement\n */\nexport function isValidEntitlement(uri: string): boolean {\n  return ALL_ENTITLEMENTS.includes(uri as (typeof ALL_ENTITLEMENTS)[number])\n}\n\n/**\n * Check if a given URI is a PSP sub-entitlement\n */\nexport function isPSPSubEntitlement(uri: string): boolean {\n  return ALL_PSP_SUB_ENTITLEMENTS.includes(uri as (typeof ALL_PSP_SUB_ENTITLEMENTS)[number])\n}\n\n/**\n * Check if entitlements include an attestation provider role\n */\nexport function hasAttestationProviderEntitlement(entitlements: string[]): boolean {\n  return entitlements.some((e) =>\n    ATTESTATION_PROVIDER_ENTITLEMENTS.includes(e as (typeof ATTESTATION_PROVIDER_ENTITLEMENTS)[number])\n  )\n}\n\n/**\n * Get the semantic identifier prefix for a given identifier type URI\n */\nexport function getIdentifierPrefix(typeUri: string): string | undefined {\n  return IDENTIFIER_TYPE_TO_PREFIX[typeUri]\n}\n","/**\n * WRPRC Zod Schemas\n *\n * Zod schemas for ETSI TS 119 475 (Wallet-Relying Party Registration Certificates).\n * Types are derived from these schemas via z.infer<>.\n *\n * @see https://www.etsi.org/deliver/etsi_ts/119400_119499/119475/01.02.01_60/ts_119475v010201p.pdf\n */\n\nimport { z } from 'zod'\n\n// ============================================================================\n// Multilingual Value Schemas\n// ============================================================================\n\n/**\n * Multilingual string schema (B.2.6 Class MultiLangString)\n */\nexport const MultiLangStringSchema = z.object({\n  /** Language code per BCP47/RFC 5646 */\n  lang: z.string().min(2),\n  /** Localized string value */\n  content: z.string().min(1),\n})\n\n// ============================================================================\n// Identity Schemas\n// ============================================================================\n\n/**\n * Supervisory Authority schema for Data Protection Authority\n */\nexport const SupervisoryAuthoritySchema = z.object({\n  /** Email address of the Data Protection Authority */\n  email: z.email().optional(),\n  /** Telephone number of the Data Protection Authority */\n  phone: z.string().optional(),\n  /** URL of web form provided by the Data Protection Authority */\n  uri: z.url().optional(),\n})\n\n/**\n * Claim schema for credential attribute specification (B.2.10 Class Claim)\n */\nexport const ClaimSchema = z.object({\n  /** Path pointer that specifies the path to a claim within the Credential */\n  path: z.array(z.string()).min(1),\n  /** Array of expected values of the claim */\n  values: z.array(z.union([z.string(), z.number(), z.boolean()])).optional(),\n})\n\n/**\n * Credential schema for attestations (B.2.9 Class Credential)\n */\nexport const CredentialSchema = z.object({\n  /** Format of the attestation (e.g., \"dc+sd-jwt\", \"mso_mdoc\") */\n  format: z.string().min(1),\n  /** Object defining additional properties per Credential Format */\n  meta: z.record(z.string(), z.unknown()),\n  /** Array of claim objects specifying requestable attributes */\n  claim: z.array(ClaimSchema).optional(),\n})\n\n/**\n * Status list reference for certificate validity\n */\nexport const StatusListSchema = z.object({\n  /** Index in the status list */\n  idx: z.number().int().nonnegative(),\n  /** URI to the status list */\n  uri: z.url(),\n})\n\n/**\n * Status schema for WRPRC validity\n */\nexport const StatusSchema = z.object({\n  status_list: StatusListSchema,\n})\n\n/**\n * Intermediary information when WRP acts through an intermediary\n */\nexport const IntermediarySchema = z.object({\n  /** Identifier of the intermediary */\n  sub: z.string().min(1),\n  /** Name of the intermediary */\n  name: z.string().min(1),\n})\n\n// ============================================================================\n// WRPRC Payload Schema\n// ============================================================================\n\n/**\n * WRPRC Payload schema according to ETSI TS 119 475 clause 5.2.4\n */\nexport const WRPRCPayloadSchema = z.object({\n  /** The subject trade name of the WRPRC (B.2.1 tradeName) */\n  name: z.string().min(1),\n\n  /** Legal name for legal person (B.2.3 legalName) */\n  sub_ln: z.string().optional(),\n\n  /** Given name for natural person (B.2.4 givenName) */\n  sub_gn: z.string().optional(),\n\n  /** Family name for natural person (B.2.4 familyName) */\n  sub_fn: z.string().optional(),\n\n  /** WRP identifier following semantic identifier rules */\n  sub: z.string().min(1),\n\n  /** Country code (ISO 3166-1 Alpha-2) */\n  country: z.string().length(2),\n\n  /** URL pointing to the national registry API endpoint */\n  registry_uri: z.url(),\n\n  /** Descriptions of the services provided by the WRP */\n  srv_description: z.array(z.array(MultiLangStringSchema)).optional(),\n\n  /** List of entitlements assigned to the WRP */\n  entitlements: z.array(z.url()).min(1),\n\n  /** URL to the WRP's privacy policy */\n  privacy_policy: z.url().optional(),\n\n  /** URL general-purpose web address */\n  info_uri: z.url().optional(),\n\n  /** URL or email for data deletion/portability requests */\n  support_uri: z.url().or(z.email()).optional(),\n\n  /** Data Protection Authority supervising the WRP */\n  supervisory_authority: SupervisoryAuthoritySchema.optional(),\n\n  /** Policy identifier as defined in clause 6.1.3 */\n  policy_id: z.array(z.string()).optional(),\n\n  /** URL to the certificate policy and practice statement */\n  certificate_policy: z.url().optional(),\n\n  /** Unix timestamp indicating when the WRPRC was issued */\n  iat: z.number().int().positive(),\n\n  /** Status list for WRPRC validity */\n  status: StatusSchema.optional(),\n\n  /** Purpose of the intended data processing */\n  purpose: z.array(MultiLangStringSchema).optional(),\n\n  /** Set of credentials intended to be requested by the WRP */\n  credentials: z.array(CredentialSchema).optional(),\n\n  /** Set of credentials issued by the WRP (for attestation providers) */\n  provides_attestations: z.array(CredentialSchema).optional(),\n\n  /** Intermediary information when WRP acts through an intermediary */\n  intermediary: IntermediarySchema.optional(),\n})\n\n// ============================================================================\n// WRPRC Header Schemas\n// ============================================================================\n\n/**\n * JWT Header schema according to ETSI TS 119 475 clause 5.2.2\n */\nexport const WRPRCJWTHeaderSchema = z.object({\n  /** Type of the Web Token - must be \"rc-wrp+jwt\" for JWT */\n  typ: z.literal('rc-wrp+jwt'),\n  /** Algorithm used to sign the JWT */\n  alg: z.enum(['ES256', 'ES384', 'ES512', 'RS256', 'RS384', 'RS512']),\n  /** Certificate chain to verify the JWT */\n  x5c: z.array(z.string()).min(1),\n  /** Key ID */\n  kid: z.string().optional(),\n})\n\n/**\n * CWT Header schema according to ETSI TS 119 475 clause 5.2.3\n */\nexport const WRPRCCWTHeaderSchema = z.object({\n  /** Type of the Web Token - must be \"rc-wrp+cwt\" for CWT */\n  typ: z.literal('rc-wrp+cwt'),\n  /** Algorithm used to sign the CWT per RFC 9052 */\n  alg: z.number().int(),\n  /** Certificate chain to verify the CWT per RFC 9360 */\n  x5chain: z.array(z.instanceof(Uint8Array)).min(1),\n})\n\n// ============================================================================\n// Complete WRPRC Document Schemas\n// ============================================================================\n\n/**\n * Complete JWT WRPRC schema\n */\nexport const WRPRCJWTSchema = z.object({\n  header: WRPRCJWTHeaderSchema,\n  payload: WRPRCPayloadSchema,\n})\n\n/**\n * Complete CWT WRPRC schema\n */\nexport const WRPRCCWTSchema = z.object({\n  header: WRPRCCWTHeaderSchema,\n  payload: WRPRCPayloadSchema,\n})\n\n// ============================================================================\n// Legal Person Subject Schema (for validation)\n// ============================================================================\n\n/**\n * Schema for legal person WRPRC subject\n */\nexport const LegalPersonSubjectSchema = WRPRCPayloadSchema.extend({\n  sub_ln: z.string().min(1),\n}).omit({\n  sub_gn: true,\n  sub_fn: true,\n})\n\n/**\n * Schema for natural person WRPRC subject\n */\nexport const NaturalPersonSubjectSchema = WRPRCPayloadSchema.extend({\n  sub_gn: z.string().min(1),\n  sub_fn: z.string().min(1),\n}).omit({\n  sub_ln: true,\n})\n","import { IdentityException } from '@owf/identity-common'\n\n/**\n * WRPRCException is a custom error class for WRPRC-related exceptions.\n */\nexport class WRPRCException extends IdentityException {\n  constructor(message: string, details?: unknown) {\n    super(message, details)\n    Object.setPrototypeOf(this, WRPRCException.prototype)\n    this.name = 'WRPRCException'\n  }\n}\n","/**\n * WRPRC Builders\n *\n * Fluent builders for creating ETSI TS 119 475 Wallet-Relying Party Registration Certificates.\n *\n * @see https://www.etsi.org/deliver/etsi_ts/119400_119499/119475/01.02.01_60/ts_119475v010201p.pdf\n */\n\nimport { ENTITLEMENT_SERVICE_PROVIDER, type WRP_ENTITLEMENTS } from './entitlements'\nimport { WRPRCPayloadSchema } from './schemas'\nimport type {\n  Claim,\n  Credential,\n  Intermediary,\n  LegalPersonWRPRCInput,\n  MultiLangString,\n  NaturalPersonWRPRCInput,\n  Status,\n  SupervisoryAuthority,\n  WRPRCPayload,\n} from './types'\nimport { WRPRCException } from './wrprc-exception'\n\n// ============================================================================\n// Partial Payload Type\n// ============================================================================\n\n/**\n * A partial WRPRC payload used during building\n */\ninterface PartialWRPRCPayload {\n  name?: string\n  sub_ln?: string\n  sub_gn?: string\n  sub_fn?: string\n  sub?: string\n  country?: string\n  registry_uri?: string\n  srv_description?: MultiLangString[][]\n  entitlements?: string[]\n  privacy_policy?: string\n  info_uri?: string\n  support_uri?: string\n  supervisory_authority?: SupervisoryAuthority\n  policy_id?: string[]\n  certificate_policy?: string\n  iat?: number\n  status?: Status\n  purpose?: MultiLangString[]\n  credentials?: Credential[]\n  provides_attestations?: string[]\n  intermediary?: Intermediary\n}\n\n// ============================================================================\n// WRPRC Payload Builder\n// ============================================================================\n\n/**\n * Builder for creating WRPRC payloads with a fluent API\n */\nexport class WRPRCBuilder {\n  private payload: PartialWRPRCPayload = {}\n\n  /**\n   * Set the trade name (display name) of the WRP\n   */\n  name(value: string): this {\n    this.payload.name = value\n    return this\n  }\n\n  /**\n   * Set the legal name for a legal person WRP\n   */\n  legalName(value: string): this {\n    this.payload.sub_ln = value\n    return this\n  }\n\n  /**\n   * Set the given name for a natural person WRP\n   */\n  givenName(value: string): this {\n    this.payload.sub_gn = value\n    return this\n  }\n\n  /**\n   * Set the family name for a natural person WRP\n   */\n  familyName(value: string): this {\n    this.payload.sub_fn = value\n    return this\n  }\n\n  /**\n   * Set the WRP identifier (semantic identifier)\n   *\n   * @param identifier - The semantic identifier following ETSI EN 319 412-1\n   *                     Format: PREFIX (3 chars) + COUNTRY (2 chars) + \"-\" + ID\n   *                     Examples: \"LEIXG-529900T8BM49AURSDO55\", \"TINIT-RSSMRA85T10A562S\"\n   */\n  identifier(identifier: string): this {\n    this.payload.sub = identifier\n    return this\n  }\n\n  /**\n   * Set the country code (ISO 3166-1 Alpha-2)\n   */\n  country(code: string): this {\n    this.payload.country = code\n    return this\n  }\n\n  /**\n   * Set the URL to the national registry API endpoint\n   */\n  registryUri(uri: string): this {\n    this.payload.registry_uri = uri\n    return this\n  }\n\n  /**\n   * Add a service description in a specific language\n   */\n  serviceDescription(description: string, lang = 'en'): this {\n    this.payload.srv_description = this.payload.srv_description ?? []\n    // Each service description is an array of localized strings\n    const existing = this.payload.srv_description.find((group) => group.some((d) => d.lang === lang))\n    if (existing) {\n      existing.push({ lang, content: description })\n    } else {\n      this.payload.srv_description.push([{ lang, content: description }])\n    }\n    return this\n  }\n\n  /**\n   * Add multiple service descriptions (one array per service, with multiple languages)\n   */\n  addServiceDescriptions(descriptions: MultiLangString[]): this {\n    this.payload.srv_description = this.payload.srv_description ?? []\n    this.payload.srv_description.push(descriptions)\n    return this\n  }\n\n  /**\n   * Add an entitlement\n   *\n   * @param entitlement - The entitlement URI or key from WRP_ENTITLEMENTS\n   */\n  addEntitlement(entitlement: string | (typeof WRP_ENTITLEMENTS)[keyof typeof WRP_ENTITLEMENTS]): this {\n    this.payload.entitlements = this.payload.entitlements ?? []\n    if (!this.payload.entitlements.includes(entitlement)) {\n      this.payload.entitlements.push(entitlement)\n    }\n    return this\n  }\n\n  /**\n   * Set all entitlements (replaces existing)\n   */\n  entitlements(entitlements: string[]): this {\n    this.payload.entitlements = [...entitlements]\n    return this\n  }\n\n  /**\n   * Set the privacy policy URL\n   */\n  privacyPolicy(uri: string): this {\n    this.payload.privacy_policy = uri\n    return this\n  }\n\n  /**\n   * Set the info URI (general-purpose web address)\n   */\n  infoUri(uri: string): this {\n    this.payload.info_uri = uri\n    return this\n  }\n\n  /**\n   * Set the support URI for data requests\n   */\n  supportUri(uri: string): this {\n    this.payload.support_uri = uri\n    return this\n  }\n\n  /**\n   * Set the supervisory authority (Data Protection Authority)\n   */\n  supervisoryAuthority(authority: SupervisoryAuthority): this {\n    this.payload.supervisory_authority = authority\n    return this\n  }\n\n  /**\n   * Set the policy ID(s)\n   */\n  policyId(ids: string[]): this {\n    this.payload.policy_id = ids\n    return this\n  }\n\n  /**\n   * Set the certificate policy URL\n   */\n  certificatePolicy(uri: string): this {\n    this.payload.certificate_policy = uri\n    return this\n  }\n\n  /**\n   * Set the issued-at timestamp (Unix timestamp)\n   * If not set, will default to current time when building\n   */\n  issuedAt(timestamp: number | Date): this {\n    this.payload.iat = typeof timestamp === 'number' ? timestamp : Math.floor(timestamp.getTime() / 1000)\n    return this\n  }\n\n  /**\n   * Set the status reference for certificate validity\n   */\n  status(status: Status): this {\n    this.payload.status = status\n    return this\n  }\n\n  /**\n   * Add a purpose description\n   */\n  addPurpose(description: string, lang = 'en'): this {\n    this.payload.purpose = this.payload.purpose ?? []\n    this.payload.purpose.push({ lang, content: description })\n    return this\n  }\n\n  /**\n   * Set all purposes (replaces existing)\n   */\n  purposes(purposes: MultiLangString[]): this {\n    this.payload.purpose = purposes\n    return this\n  }\n\n  /**\n   * Add a credential that the WRP intends to request\n   */\n  addCredential(credential: Credential): this {\n    this.payload.credentials = this.payload.credentials ?? []\n    this.payload.credentials.push(credential)\n    return this\n  }\n\n  /**\n   * Add a schema metadata that the WRP provides (for attestation providers)\n   */\n  addProvidedAttestation(schemaMetadata: string): this {\n    this.payload.provides_attestations = this.payload.provides_attestations ?? []\n    this.payload.provides_attestations.push(schemaMetadata)\n    return this\n  }\n\n  /**\n   * Set intermediary information\n   */\n  intermediary(intermediary: Intermediary): this {\n    this.payload.intermediary = intermediary\n    return this\n  }\n\n  /**\n   * Build the WRPRC payload\n   *\n   * @throws WRPRCException if the payload is invalid\n   */\n  build(): WRPRCPayload {\n    // Set default iat if not provided\n    if (!this.payload.iat) {\n      this.payload.iat = Math.floor(Date.now() / 1000)\n    }\n\n    const result = WRPRCPayloadSchema.safeParse(this.payload)\n\n    if (!result.success) {\n      const messages = result.error.issues.map((i) => `${i.path.join('.')}: ${i.message}`).join('\\n')\n      throw new WRPRCException(`Invalid WRPRC payload:\\n${messages}`, result.error.issues)\n    }\n\n    return result.data\n  }\n}\n\n// ============================================================================\n// Credential Builder\n// ============================================================================\n\n/**\n * Builder for creating Credential objects\n */\nexport class CredentialBuilder {\n  private credential: Partial<Credential> = {}\n\n  /**\n   * Set the credential format\n   *\n   * @param format - The format identifier (e.g., \"dc+sd-jwt\", \"mso_mdoc\")\n   */\n  format(format: string): this {\n    this.credential.format = format\n    return this\n  }\n\n  /**\n   * Set the credential metadata\n   *\n   * @param meta - Metadata object per credential format specification\n   */\n  meta(meta: Record<string, unknown>): this {\n    this.credential.meta = meta\n    return this\n  }\n\n  /**\n   * Set SD-JWT credential metadata (vct_values)\n   */\n  sdJwtMeta(vctValues: string[]): this {\n    this.credential.format = 'dc+sd-jwt'\n    this.credential.meta = { vct_values: vctValues }\n    return this\n  }\n\n  /**\n   * Set mDL/mDoc credential metadata (doctype_value)\n   */\n  mdocMeta(doctypeValue: string): this {\n    this.credential.format = 'mso_mdoc'\n    this.credential.meta = { doctype_value: doctypeValue }\n    return this\n  }\n\n  /**\n   * Add a claim to request\n   */\n  addClaim(claim: Claim): this {\n    this.credential.claim = this.credential.claim ?? []\n    this.credential.claim.push(claim)\n    return this\n  }\n\n  /**\n   * Add a simple path claim\n   */\n  addPathClaim(...path: string[]): this {\n    this.credential.claim = this.credential.claim ?? []\n    this.credential.claim.push({ path })\n    return this\n  }\n\n  /**\n   * Build the Credential object\n   */\n  build(): Credential {\n    if (!this.credential.format) {\n      throw new WRPRCException('Credential format is required')\n    }\n    if (!this.credential.meta) {\n      throw new WRPRCException('Credential meta is required')\n    }\n    return this.credential as Credential\n  }\n}\n\n// ============================================================================\n// Factory Functions\n// ============================================================================\n\n/**\n * Create a new WRPRCBuilder\n */\nexport function wrprc(): WRPRCBuilder {\n  return new WRPRCBuilder()\n}\n\n/**\n * Create a new CredentialBuilder\n */\nexport function credential(): CredentialBuilder {\n  return new CredentialBuilder()\n}\n\n/**\n * Create a WRPRC payload for a legal person\n */\nexport function createLegalPersonWRPRC(input: LegalPersonWRPRCInput): WRPRCPayload {\n  return wrprc()\n    .name(input.name)\n    .legalName(input.legalName)\n    .identifier(input.identifier)\n    .country(input.country)\n    .registryUri(input.registryUri)\n    .entitlements(input.entitlements)\n    .build()\n}\n\n/**\n * Create a WRPRC payload for a natural person\n */\nexport function createNaturalPersonWRPRC(input: NaturalPersonWRPRCInput): WRPRCPayload {\n  return wrprc()\n    .name(input.name)\n    .givenName(input.givenName)\n    .familyName(input.familyName)\n    .identifier(input.identifier)\n    .country(input.country)\n    .registryUri(input.registryUri)\n    .entitlements(input.entitlements)\n    .build()\n}\n\n/**\n * Create a simple service provider WRPRC\n */\nexport function createServiceProviderWRPRC(\n  name: string,\n  legalName: string,\n  identifier: string,\n  country: string,\n  registryUri: string\n): WRPRCPayload {\n  return wrprc()\n    .name(name)\n    .legalName(legalName)\n    .identifier(identifier)\n    .country(country)\n    .registryUri(registryUri)\n    .addEntitlement(ENTITLEMENT_SERVICE_PROVIDER)\n    .build()\n}\n","/**\n * WRPRC Validator\n *\n * Validation functions for ETSI TS 119 475 Wallet-Relying Party Registration Certificates.\n *\n * @see https://www.etsi.org/deliver/etsi_ts/119400_119499/119475/01.02.01_60/ts_119475v010201p.pdf\n */\n\nimport { ALL_ENTITLEMENTS, ALL_PSP_SUB_ENTITLEMENTS, ATTESTATION_PROVIDER_ENTITLEMENTS } from './entitlements'\nimport {\n  LegalPersonSubjectSchema,\n  NaturalPersonSubjectSchema,\n  WRPRCJWTHeaderSchema,\n  WRPRCPayloadSchema,\n} from './schemas'\nimport type { WRPRCPayload } from './types'\nimport { WRPRCException } from './wrprc-exception'\n\n// ============================================================================\n// Validation Result Types\n// ============================================================================\n\n/**\n * A single validation error\n */\nexport interface ValidationError {\n  /** Path to the invalid field */\n  path: string[]\n  /** Error message */\n  message: string\n  /** Error code */\n  code: string\n}\n\n/**\n * Result of WRPRC validation\n */\nexport interface ValidationResult {\n  /** Whether the WRPRC is valid */\n  valid: boolean\n  /** List of validation errors (empty if valid) */\n  errors: ValidationError[]\n  /** Warnings that don't invalidate the certificate but should be noted */\n  warnings: ValidationError[]\n}\n\n// ============================================================================\n// Core Validation Functions\n// ============================================================================\n\n/**\n * Validate a WRPRC payload against the schema\n */\nexport function validateWRPRCPayload(payload: unknown): ValidationResult {\n  const result = WRPRCPayloadSchema.safeParse(payload)\n  const errors: ValidationError[] = []\n  const warnings: ValidationError[] = []\n\n  if (!result.success) {\n    for (const issue of result.error.issues) {\n      errors.push({\n        path: issue.path.map(String),\n        message: issue.message,\n        code: issue.code,\n      })\n    }\n    return { valid: false, errors, warnings }\n  }\n\n  // Additional semantic validations\n  const validPayload: WRPRCPayload = result.data\n\n  // Check entitlements are valid URIs from the standard\n  for (const entitlement of validPayload.entitlements) {\n    if (!ALL_ENTITLEMENTS.includes(entitlement as (typeof ALL_ENTITLEMENTS)[number])) {\n      // Check if it's a sub-entitlement\n      if (!ALL_PSP_SUB_ENTITLEMENTS.includes(entitlement as (typeof ALL_PSP_SUB_ENTITLEMENTS)[number])) {\n        warnings.push({\n          path: ['entitlements'],\n          message: `Unknown entitlement URI: ${entitlement}. This may be a national or EU-defined extension.`,\n          code: 'unknown_entitlement',\n        })\n      }\n    }\n  }\n\n  // GEN-5.2.4-03: At least one entitlement must be specified\n  if (validPayload.entitlements.length === 0) {\n    errors.push({\n      path: ['entitlements'],\n      message: 'At least one entitlement must be specified (GEN-5.2.4-03)',\n      code: 'missing_entitlement',\n    })\n  }\n\n  // GEN-5.2.4-04: If sub-entitlements are present, a base entitlement must also be present\n  const hasSubEntitlement = validPayload.entitlements.some((e) =>\n    ALL_PSP_SUB_ENTITLEMENTS.includes(e as (typeof ALL_PSP_SUB_ENTITLEMENTS)[number])\n  )\n  const hasServiceProvider = validPayload.entitlements.includes(\n    'https://uri.etsi.org/19475/Entitlement/Service_Provider'\n  )\n  if (hasSubEntitlement && !hasServiceProvider) {\n    errors.push({\n      path: ['entitlements'],\n      message: 'Service provider sub-entitlements require Service_Provider entitlement (GEN-5.2.4-04)',\n      code: 'missing_base_entitlement',\n    })\n  }\n\n  // GEN-5.2.4-05: Attestation providers should have provides_attestations\n  const hasAttestationProviderRole = validPayload.entitlements.some((e) =>\n    ATTESTATION_PROVIDER_ENTITLEMENTS.includes(e as (typeof ATTESTATION_PROVIDER_ENTITLEMENTS)[number])\n  )\n  if (hasAttestationProviderRole && !validPayload.provides_attestations) {\n    warnings.push({\n      path: ['provides_attestations'],\n      message:\n        'Attestation providers should include provides_attestations field (GEN-5.2.4-05). This is recommended but not required.',\n      code: 'missing_provides_attestations',\n    })\n  }\n\n  // Validate subject identifier format (semantic identifier)\n  const subResult = validateSemanticIdentifier(validPayload.sub)\n  if (!subResult.valid) {\n    errors.push({\n      path: ['sub'],\n      message: subResult.message,\n      code: 'invalid_semantic_identifier',\n    })\n  }\n\n  return { valid: errors.length === 0, errors, warnings }\n}\n\n/**\n * Validate a JWT header for WRPRC\n */\nexport function validateWRPRCJWTHeader(header: unknown): ValidationResult {\n  const result = WRPRCJWTHeaderSchema.safeParse(header)\n  const errors: ValidationError[] = []\n  const warnings: ValidationError[] = []\n\n  if (!result.success) {\n    for (const issue of result.error.issues) {\n      errors.push({\n        path: issue.path.map(String),\n        message: issue.message,\n        code: issue.code,\n      })\n    }\n  }\n\n  return { valid: errors.length === 0, errors, warnings }\n}\n\n/**\n * Validate a complete WRPRC (header + payload)\n */\nexport function validateWRPRC(header: unknown, payload: unknown): ValidationResult {\n  const headerResult = validateWRPRCJWTHeader(header)\n  const payloadResult = validateWRPRCPayload(payload)\n\n  const errors = [\n    ...headerResult.errors.map((e) => ({ ...e, path: ['header', ...e.path] })),\n    ...payloadResult.errors.map((e) => ({ ...e, path: ['payload', ...e.path] })),\n  ]\n\n  const warnings = [\n    ...headerResult.warnings.map((w) => ({ ...w, path: ['header', ...w.path] })),\n    ...payloadResult.warnings.map((w) => ({ ...w, path: ['payload', ...w.path] })),\n  ]\n\n  return { valid: errors.length === 0, errors, warnings }\n}\n\n// ============================================================================\n// Subject Type Validation\n// ============================================================================\n\n/**\n * Check if payload represents a legal person\n */\nexport function isLegalPersonWRPRC(payload: WRPRCPayload): boolean {\n  return typeof payload.sub_ln === 'string' && payload.sub_ln.length > 0\n}\n\n/**\n * Check if payload represents a natural person\n */\nexport function isNaturalPersonWRPRC(payload: WRPRCPayload): boolean {\n  return (\n    typeof payload.sub_gn === 'string' &&\n    payload.sub_gn.length > 0 &&\n    typeof payload.sub_fn === 'string' &&\n    payload.sub_fn.length > 0\n  )\n}\n\n/**\n * Validate as legal person WRPRC\n */\nexport function validateLegalPersonWRPRC(payload: unknown): ValidationResult {\n  const result = LegalPersonSubjectSchema.safeParse(payload)\n  const errors: ValidationError[] = []\n  const warnings: ValidationError[] = []\n\n  if (!result.success) {\n    for (const issue of result.error.issues) {\n      errors.push({\n        path: issue.path.map(String),\n        message: issue.message,\n        code: issue.code,\n      })\n    }\n  }\n\n  // Additional validation for legal person identifier format\n  if (result.success) {\n    const sub: string = result.data.sub\n    // Legal person identifiers should follow ETSI EN 319 412-1 clause 5.1.4\n    // Format: 3-letter prefix + 2-letter country code + hyphen + identifier\n    if (!/^[A-Z]{3}[A-Z]{2}-.+$/.test(sub)) {\n      warnings.push({\n        path: ['sub'],\n        message:\n          'Legal person identifier should follow format: PREFIX + COUNTRY + \"-\" + ID (e.g., \"LEIXG-529900T8BM49AURSDO55\")',\n        code: 'identifier_format_warning',\n      })\n    }\n  }\n\n  return { valid: errors.length === 0, errors, warnings }\n}\n\n/**\n * Validate as natural person WRPRC\n */\nexport function validateNaturalPersonWRPRC(payload: unknown): ValidationResult {\n  const result = NaturalPersonSubjectSchema.safeParse(payload)\n  const errors: ValidationError[] = []\n  const warnings: ValidationError[] = []\n\n  if (!result.success) {\n    for (const issue of result.error.issues) {\n      errors.push({\n        path: issue.path.map(String),\n        message: issue.message,\n        code: issue.code,\n      })\n    }\n  }\n\n  // Additional validation for natural person identifier format\n  if (result.success) {\n    const sub: string = result.data.sub\n    // Natural person identifiers should follow ETSI EN 319 412-1 clause 5.1.3\n    // Format: 3-letter prefix + 2-letter country code + hyphen + identifier\n    if (!/^[A-Z]{3}[A-Z]{2}-.+$/.test(sub)) {\n      warnings.push({\n        path: ['sub'],\n        message:\n          'Natural person identifier should follow format: PREFIX + COUNTRY + \"-\" + ID (e.g., \"TINIT-RSSMRA85T10A562S\")',\n        code: 'identifier_format_warning',\n      })\n    }\n  }\n\n  return { valid: errors.length === 0, errors, warnings }\n}\n\n// ============================================================================\n// Semantic Identifier Validation\n// ============================================================================\n\n/**\n * Valid semantic identifier prefixes for legal persons (ETSI EN 319 412-1 clause 5.1.4)\n */\nconst LEGAL_PERSON_PREFIXES = ['EOR', 'LEI', 'NTR', 'VAT', 'TIN', 'EXC']\n\n/**\n * Valid semantic identifier prefixes for natural persons (ETSI EN 319 412-1 clause 5.1.3)\n */\nconst NATURAL_PERSON_PREFIXES = ['TIN', 'PAS', 'IDC', 'PNO', 'TAX']\n\n/**\n * Validate a semantic identifier format\n */\nfunction validateSemanticIdentifier(identifier: string): { valid: boolean; message: string } {\n  // Format: PREFIX (3 chars) + COUNTRY (2 chars) + \"-\" + ID\n  const match = identifier.match(/^([A-Z]{3})([A-Z]{2})-(.+)$/)\n\n  if (!match) {\n    return {\n      valid: false,\n      message: 'Semantic identifier must follow format: PREFIX (3 chars) + COUNTRY (2 chars) + \"-\" + ID',\n    }\n  }\n\n  const [, prefix, , id] = match\n\n  // Check if prefix is known\n  const allPrefixes = [...LEGAL_PERSON_PREFIXES, ...NATURAL_PERSON_PREFIXES]\n  if (!allPrefixes.includes(prefix)) {\n    // Unknown prefix is allowed per spec (national schemes may define additional prefixes)\n    // but we validate the format is correct\n  }\n\n  if (!id || id.length === 0) {\n    return {\n      valid: false,\n      message: 'Semantic identifier must have a non-empty ID part after the hyphen',\n    }\n  }\n\n  return { valid: true, message: '' }\n}\n\n// ============================================================================\n// Assertion Functions\n// ============================================================================\n\n/**\n * Assert that a WRPRC payload is valid, throws WRPRCException if not\n */\nexport function assertValidWRPRCPayload(payload: unknown): asserts payload is WRPRCPayload {\n  const result = validateWRPRCPayload(payload)\n  if (!result.valid) {\n    const messages = result.errors.map((e) => `${e.path.join('.')}: ${e.message}`).join('\\n')\n    throw new WRPRCException(`Invalid WRPRC payload:\\n${messages}`, result.errors)\n  }\n}\n\n/**\n * Assert that a WRPRC is valid (header + payload), throws WRPRCException if not\n */\nexport function assertValidWRPRC(header: unknown, payload: unknown): void {\n  const result = validateWRPRC(header, payload)\n  if (!result.valid) {\n    const messages = result.errors.map((e) => `${e.path.join('.')}: ${e.message}`).join('\\n')\n    throw new WRPRCException(`Invalid WRPRC:\\n${messages}`, result.errors)\n  }\n}\n","/**\n * WRPRC Signer\n *\n * Functions for creating and signing ETSI TS 119 475 Wallet-Relying Party Registration Certificates.\n *\n * @see https://www.etsi.org/deliver/etsi_ts/119400_119499/119475/01.02.01_60/ts_119475v010201p.pdf\n */\n\nimport { pemToDer } from '@owf/crypto'\nimport { base64urlEncode, decodeJwt } from '@owf/identity-common'\nimport type { SignedWRPRC, SignOptions, WRPRCJWTHeader, WRPRCPayload } from './types'\nimport { assertValidWRPRCPayload } from './validator'\nimport { WRPRCException } from './wrprc-exception'\n\n// ============================================================================\n// JWT Signing\n// ============================================================================\n\n/**\n * Sign a WRPRC payload to create a JWT\n *\n * @param options - Signing options including payload, algorithm, certificates, and signer\n * @returns Signed WRPRC with JWS string and decoded parts\n */\nexport async function signWRPRC(options: SignOptions): Promise<SignedWRPRC> {\n  const { payload, algorithm = 'ES256', certificates, keyId, signer } = options\n\n  // Validate payload\n  assertValidWRPRCPayload(payload)\n\n  if (!certificates || certificates.length === 0) {\n    throw new WRPRCException('At least one certificate is required for x5c header')\n  }\n\n  // Extract base64 content from PEM certificates\n  const x5c = certificates.map((cert) => {\n    const content = pemToDer(cert)\n    if (!content) {\n      throw new WRPRCException('Invalid PEM certificate format')\n    }\n    return content\n  })\n\n  // Create JWT header\n  const header: WRPRCJWTHeader = {\n    typ: 'rc-wrp+jwt',\n    alg: algorithm,\n    x5c,\n    ...(keyId && { kid: keyId }),\n  }\n\n  // Encode header and payload\n  const encodedHeader = base64urlEncode(JSON.stringify(header))\n  const encodedPayload = base64urlEncode(JSON.stringify(payload))\n  const signingInput = `${encodedHeader}.${encodedPayload}`\n\n  // Sign\n  const signature = await signer(signingInput)\n\n  // Create compact JWS\n  const jws = `${signingInput}.${signature}`\n\n  return {\n    jws,\n    header,\n    payload,\n  }\n}\n\n// ============================================================================\n// JWT Decoding\n// ============================================================================\n\n/**\n * Decode a signed WRPRC JWT (without verification)\n *\n * @param jws - The compact JWS string\n * @returns Decoded WRPRC with header and payload\n */\nexport function decodeWRPRC(jws: string): SignedWRPRC {\n  const decoded = decodeJwt(jws)\n\n  // Validate typ header\n  if (decoded.header.typ !== 'rc-wrp+jwt') {\n    throw new WRPRCException(`Invalid WRPRC type: expected \"rc-wrp+jwt\", got \"${decoded.header.typ}\"`)\n  }\n\n  // Validate payload structure\n  assertValidWRPRCPayload(decoded.payload)\n\n  return {\n    jws,\n    header: decoded.header as WRPRCJWTHeader,\n    payload: decoded.payload as WRPRCPayload,\n  }\n}\n\n/**\n * Parse a WRPRC JWT without validation (for inspection purposes)\n *\n * @param jws - The compact JWS string\n * @returns Decoded parts without validation\n */\nexport function parseWRPRC(jws: string): { header: unknown; payload: unknown; signature: string } {\n  const decoded = decodeJwt(jws)\n  const parts = jws.split('.')\n\n  return {\n    header: decoded.header,\n    payload: decoded.payload,\n    signature: parts[2],\n  }\n}\n\n// ============================================================================\n// WRPRC Creation Helpers\n// ============================================================================\n\n/**\n * Create a WRPRC with automatic timestamp\n *\n * @param payload - Partial payload (iat will be set automatically if not provided)\n * @returns Complete payload with timestamp\n */\nexport function createWRPRCPayload(payload: Omit<WRPRCPayload, 'iat'> & { iat?: number }): WRPRCPayload {\n  const completePayload: WRPRCPayload = {\n    ...payload,\n    iat: payload.iat ?? Math.floor(Date.now() / 1000),\n  }\n\n  assertValidWRPRCPayload(completePayload)\n\n  return completePayload\n}\n"],"mappings":";;;;;;;AAgCA,MAAa,+BAA+B;;;;;AAM5C,MAAa,4BAA4B;;;;;AAMzC,MAAa,iCAAiC;;;;;AAM9C,MAAa,+BAA+B;;;;;AAM5C,MAAa,2BAA2B;;;;AAwCxC,MAAa,mBAAmB;CAC9B,kBAAkB;CAClB,eAAe;CACf,oBAAoB;CACpB,kBAAkB;CAClB,cAAc;CACd,0BAA0B;CAC1B,yBAAyB;CACzB,oBAAoB;CACpB,mBAAmB;CACnB,8BAA8B;AAChC;;;;AAKA,MAAa,mBAAmB,OAAO,OAAO,gBAAgB;;;;AAK9D,MAAa,oCAAoC;CAC/C;CACA;CACA;CACA;AACF;;;;;AAUA,MAAa,uBAAuB;;CAElC,mBAAmB;;CAEnB,oBAAoB;;CAEpB,qBAAqB;;CAErB,YAAY;;CAEZ,aAAa;AACf;;;;AAKA,MAAa,2BAA2B,OAAO,OAAO,oBAAoB;;;;AAS1E,MAAa,mBAAmB;;CAE9B,MAAM;;CAEN,KAAK;;CAEL,MAAM;;CAEN,OAAO;;CAEP,KAAK;;CAEL,QAAQ;AACV;AAOG,iBAAiB,MACjB,iBAAiB,KACjB,iBAAiB,MACjB,iBAAiB,OACjB,iBAAiB,KACjB,iBAAiB;;;;AAuCpB,SAAgB,mBAAmB,KAAsB;CACvD,OAAO,iBAAiB,SAAS,GAAwC;AAC3E;;;;AAKA,SAAgB,oBAAoB,KAAsB;CACxD,OAAO,yBAAyB,SAAS,GAAgD;AAC3F;;;;AAKA,SAAgB,kCAAkC,cAAiC;CACjF,OAAO,aAAa,MAAM,MACxB,kCAAkC,SAAS,CAAuD,CACpG;AACF;;;;;;;;;;;;;;AC7NA,MAAa,wBAAwB,EAAE,OAAO;;CAE5C,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;;CAEtB,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;AAC3B,CAAC;;;;AASD,MAAa,6BAA6B,EAAE,OAAO;;CAEjD,OAAO,EAAE,MAAM,CAAC,CAAC,SAAS;;CAE1B,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS;;CAE3B,KAAK,EAAE,IAAI,CAAC,CAAC,SAAS;AACxB,CAAC;;;;AAKD,MAAa,cAAc,EAAE,OAAO;;CAElC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;;CAE/B,QAAQ,EAAE,MAAM,EAAE,MAAM;EAAC,EAAE,OAAO;EAAG,EAAE,OAAO;EAAG,EAAE,QAAQ;CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;AAC3E,CAAC;;;;AAKD,MAAa,mBAAmB,EAAE,OAAO;;CAEvC,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;;CAExB,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;;CAEtC,OAAO,EAAE,MAAM,WAAW,CAAC,CAAC,SAAS;AACvC,CAAC;;;;AAKD,MAAa,mBAAmB,EAAE,OAAO;;CAEvC,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY;;CAElC,KAAK,EAAE,IAAI;AACb,CAAC;;;;AAKD,MAAa,eAAe,EAAE,OAAO,EACnC,aAAa,iBACf,CAAC;;;;AAKD,MAAa,qBAAqB,EAAE,OAAO;;CAEzC,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;;CAErB,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;AACxB,CAAC;;;;AASD,MAAa,qBAAqB,EAAE,OAAO;;CAEzC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;;CAGtB,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;;CAG5B,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;;CAG5B,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;;CAG5B,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;;CAGrB,SAAS,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC;;CAG5B,cAAc,EAAE,IAAI;;CAGpB,iBAAiB,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC,CAAC,CAAC,SAAS;;CAGlE,cAAc,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;;CAGpC,gBAAgB,EAAE,IAAI,CAAC,CAAC,SAAS;;CAGjC,UAAU,EAAE,IAAI,CAAC,CAAC,SAAS;;CAG3B,aAAa,EAAE,IAAI,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS;;CAG5C,uBAAuB,2BAA2B,SAAS;;CAG3D,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;;CAGxC,oBAAoB,EAAE,IAAI,CAAC,CAAC,SAAS;;CAGrC,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;;CAG/B,QAAQ,aAAa,SAAS;;CAG9B,SAAS,EAAE,MAAM,qBAAqB,CAAC,CAAC,SAAS;;CAGjD,aAAa,EAAE,MAAM,gBAAgB,CAAC,CAAC,SAAS;;CAGhD,uBAAuB,EAAE,MAAM,gBAAgB,CAAC,CAAC,SAAS;;CAG1D,cAAc,mBAAmB,SAAS;AAC5C,CAAC;;;;AASD,MAAa,uBAAuB,EAAE,OAAO;;CAE3C,KAAK,EAAE,QAAQ,YAAY;;CAE3B,KAAK,EAAE,KAAK;EAAC;EAAS;EAAS;EAAS;EAAS;EAAS;CAAO,CAAC;;CAElE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;;CAE9B,KAAK,EAAE,OAAO,CAAC,CAAC,SAAS;AAC3B,CAAC;;;;AAKD,MAAa,uBAAuB,EAAE,OAAO;;CAE3C,KAAK,EAAE,QAAQ,YAAY;;CAE3B,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI;;CAEpB,SAAS,EAAE,MAAM,EAAE,WAAW,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAS6B,EAAE,OAAO;CACrC,QAAQ;CACR,SAAS;AACX,CAAC;AAK6B,EAAE,OAAO;CACrC,QAAQ;CACR,SAAS;AACX,CAAC;;;;AASD,MAAa,2BAA2B,mBAAmB,OAAO,EAChE,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAC1B,CAAC,CAAC,CAAC,KAAK;CACN,QAAQ;CACR,QAAQ;AACV,CAAC;;;;AAKD,MAAa,6BAA6B,mBAAmB,OAAO;CAClE,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACxB,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;AAC1B,CAAC,CAAC,CAAC,KAAK,EACN,QAAQ,KACV,CAAC;;;;;;ACrOD,IAAa,iBAAb,MAAa,uBAAuB,kBAAkB;CACpD,YAAY,SAAiB,SAAmB;EAC9C,MAAM,SAAS,OAAO;EACtB,OAAO,eAAe,MAAM,eAAe,SAAS;EACpD,KAAK,OAAO;CACd;AACF;;;;;;;;;;;;;ACkDA,IAAa,eAAb,MAA0B;;iBACe,CAAC;;;;;CAKxC,KAAK,OAAqB;EACxB,KAAK,QAAQ,OAAO;EACpB,OAAO;CACT;;;;CAKA,UAAU,OAAqB;EAC7B,KAAK,QAAQ,SAAS;EACtB,OAAO;CACT;;;;CAKA,UAAU,OAAqB;EAC7B,KAAK,QAAQ,SAAS;EACtB,OAAO;CACT;;;;CAKA,WAAW,OAAqB;EAC9B,KAAK,QAAQ,SAAS;EACtB,OAAO;CACT;;;;;;;;CASA,WAAW,YAA0B;EACnC,KAAK,QAAQ,MAAM;EACnB,OAAO;CACT;;;;CAKA,QAAQ,MAAoB;EAC1B,KAAK,QAAQ,UAAU;EACvB,OAAO;CACT;;;;CAKA,YAAY,KAAmB;EAC7B,KAAK,QAAQ,eAAe;EAC5B,OAAO;CACT;;;;CAKA,mBAAmB,aAAqB,OAAO,MAAY;EACzD,KAAK,QAAQ,kBAAkB,KAAK,QAAQ,mBAAmB,CAAC;EAEhE,MAAM,WAAW,KAAK,QAAQ,gBAAgB,MAAM,UAAU,MAAM,MAAM,MAAM,EAAE,SAAS,IAAI,CAAC;EAChG,IAAI,UACF,SAAS,KAAK;GAAE;GAAM,SAAS;EAAY,CAAC;OAE5C,KAAK,QAAQ,gBAAgB,KAAK,CAAC;GAAE;GAAM,SAAS;EAAY,CAAC,CAAC;EAEpE,OAAO;CACT;;;;CAKA,uBAAuB,cAAuC;EAC5D,KAAK,QAAQ,kBAAkB,KAAK,QAAQ,mBAAmB,CAAC;EAChE,KAAK,QAAQ,gBAAgB,KAAK,YAAY;EAC9C,OAAO;CACT;;;;;;CAOA,eAAe,aAAsF;EACnG,KAAK,QAAQ,eAAe,KAAK,QAAQ,gBAAgB,CAAC;EAC1D,IAAI,CAAC,KAAK,QAAQ,aAAa,SAAS,WAAW,GACjD,KAAK,QAAQ,aAAa,KAAK,WAAW;EAE5C,OAAO;CACT;;;;CAKA,aAAa,cAA8B;EACzC,KAAK,QAAQ,eAAe,CAAC,GAAG,YAAY;EAC5C,OAAO;CACT;;;;CAKA,cAAc,KAAmB;EAC/B,KAAK,QAAQ,iBAAiB;EAC9B,OAAO;CACT;;;;CAKA,QAAQ,KAAmB;EACzB,KAAK,QAAQ,WAAW;EACxB,OAAO;CACT;;;;CAKA,WAAW,KAAmB;EAC5B,KAAK,QAAQ,cAAc;EAC3B,OAAO;CACT;;;;CAKA,qBAAqB,WAAuC;EAC1D,KAAK,QAAQ,wBAAwB;EACrC,OAAO;CACT;;;;CAKA,SAAS,KAAqB;EAC5B,KAAK,QAAQ,YAAY;EACzB,OAAO;CACT;;;;CAKA,kBAAkB,KAAmB;EACnC,KAAK,QAAQ,qBAAqB;EAClC,OAAO;CACT;;;;;CAMA,SAAS,WAAgC;EACvC,KAAK,QAAQ,MAAM,OAAO,cAAc,WAAW,YAAY,KAAK,MAAM,UAAU,QAAQ,IAAI,GAAI;EACpG,OAAO;CACT;;;;CAKA,OAAO,QAAsB;EAC3B,KAAK,QAAQ,SAAS;EACtB,OAAO;CACT;;;;CAKA,WAAW,aAAqB,OAAO,MAAY;EACjD,KAAK,QAAQ,UAAU,KAAK,QAAQ,WAAW,CAAC;EAChD,KAAK,QAAQ,QAAQ,KAAK;GAAE;GAAM,SAAS;EAAY,CAAC;EACxD,OAAO;CACT;;;;CAKA,SAAS,UAAmC;EAC1C,KAAK,QAAQ,UAAU;EACvB,OAAO;CACT;;;;CAKA,cAAc,YAA8B;EAC1C,KAAK,QAAQ,cAAc,KAAK,QAAQ,eAAe,CAAC;EACxD,KAAK,QAAQ,YAAY,KAAK,UAAU;EACxC,OAAO;CACT;;;;CAKA,uBAAuB,gBAA8B;EACnD,KAAK,QAAQ,wBAAwB,KAAK,QAAQ,yBAAyB,CAAC;EAC5E,KAAK,QAAQ,sBAAsB,KAAK,cAAc;EACtD,OAAO;CACT;;;;CAKA,aAAa,cAAkC;EAC7C,KAAK,QAAQ,eAAe;EAC5B,OAAO;CACT;;;;;;CAOA,QAAsB;EAEpB,IAAI,CAAC,KAAK,QAAQ,KAChB,KAAK,QAAQ,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;EAGjD,MAAM,SAAS,mBAAmB,UAAU,KAAK,OAAO;EAExD,IAAI,CAAC,OAAO,SAEV,MAAM,IAAI,eAAe,2BADR,OAAO,MAAM,OAAO,KAAK,MAAM,GAAG,EAAE,KAAK,KAAK,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,KAAK,IAC/B,KAAK,OAAO,MAAM,MAAM;EAGrF,OAAO,OAAO;CAChB;AACF;;;;AASA,IAAa,oBAAb,MAA+B;;oBACa,CAAC;;;;;;;CAO3C,OAAO,QAAsB;EAC3B,KAAK,WAAW,SAAS;EACzB,OAAO;CACT;;;;;;CAOA,KAAK,MAAqC;EACxC,KAAK,WAAW,OAAO;EACvB,OAAO;CACT;;;;CAKA,UAAU,WAA2B;EACnC,KAAK,WAAW,SAAS;EACzB,KAAK,WAAW,OAAO,EAAE,YAAY,UAAU;EAC/C,OAAO;CACT;;;;CAKA,SAAS,cAA4B;EACnC,KAAK,WAAW,SAAS;EACzB,KAAK,WAAW,OAAO,EAAE,eAAe,aAAa;EACrD,OAAO;CACT;;;;CAKA,SAAS,OAAoB;EAC3B,KAAK,WAAW,QAAQ,KAAK,WAAW,SAAS,CAAC;EAClD,KAAK,WAAW,MAAM,KAAK,KAAK;EAChC,OAAO;CACT;;;;CAKA,aAAa,GAAG,MAAsB;EACpC,KAAK,WAAW,QAAQ,KAAK,WAAW,SAAS,CAAC;EAClD,KAAK,WAAW,MAAM,KAAK,EAAE,KAAK,CAAC;EACnC,OAAO;CACT;;;;CAKA,QAAoB;EAClB,IAAI,CAAC,KAAK,WAAW,QACnB,MAAM,IAAI,eAAe,+BAA+B;EAE1D,IAAI,CAAC,KAAK,WAAW,MACnB,MAAM,IAAI,eAAe,6BAA6B;EAExD,OAAO,KAAK;CACd;AACF;;;;AASA,SAAgB,QAAsB;CACpC,OAAO,IAAI,aAAa;AAC1B;;;;AAKA,SAAgB,aAAgC;CAC9C,OAAO,IAAI,kBAAkB;AAC/B;;;;AAKA,SAAgB,uBAAuB,OAA4C;CACjF,OAAO,MAAM,CAAC,CACX,KAAK,MAAM,IAAI,CAAC,CAChB,UAAU,MAAM,SAAS,CAAC,CAC1B,WAAW,MAAM,UAAU,CAAC,CAC5B,QAAQ,MAAM,OAAO,CAAC,CACtB,YAAY,MAAM,WAAW,CAAC,CAC9B,aAAa,MAAM,YAAY,CAAC,CAChC,MAAM;AACX;;;;AAKA,SAAgB,yBAAyB,OAA8C;CACrF,OAAO,MAAM,CAAC,CACX,KAAK,MAAM,IAAI,CAAC,CAChB,UAAU,MAAM,SAAS,CAAC,CAC1B,WAAW,MAAM,UAAU,CAAC,CAC5B,WAAW,MAAM,UAAU,CAAC,CAC5B,QAAQ,MAAM,OAAO,CAAC,CACtB,YAAY,MAAM,WAAW,CAAC,CAC9B,aAAa,MAAM,YAAY,CAAC,CAChC,MAAM;AACX;;;;AAKA,SAAgB,2BACd,MACA,WACA,YACA,SACA,aACc;CACd,OAAO,MAAM,CAAC,CACX,KAAK,IAAI,CAAC,CACV,UAAU,SAAS,CAAC,CACpB,WAAW,UAAU,CAAC,CACtB,QAAQ,OAAO,CAAC,CAChB,YAAY,WAAW,CAAC,CACxB,eAAe,4BAA4B,CAAC,CAC5C,MAAM;AACX;;;;;;;;;;;;;ACvYA,SAAgB,qBAAqB,SAAoC;CACvE,MAAM,SAAS,mBAAmB,UAAU,OAAO;CACnD,MAAM,SAA4B,CAAC;CACnC,MAAM,WAA8B,CAAC;CAErC,IAAI,CAAC,OAAO,SAAS;EACnB,KAAK,MAAM,SAAS,OAAO,MAAM,QAC/B,OAAO,KAAK;GACV,MAAM,MAAM,KAAK,IAAI,MAAM;GAC3B,SAAS,MAAM;GACf,MAAM,MAAM;EACd,CAAC;EAEH,OAAO;GAAE,OAAO;GAAO;GAAQ;EAAS;CAC1C;CAGA,MAAM,eAA6B,OAAO;CAG1C,KAAK,MAAM,eAAe,aAAa,cACrC,IAAI,CAAC,iBAAiB,SAAS,WAAgD;MAEzE,CAAC,yBAAyB,SAAS,WAAwD,GAC7F,SAAS,KAAK;GACZ,MAAM,CAAC,cAAc;GACrB,SAAS,4BAA4B,YAAY;GACjD,MAAM;EACR,CAAC;CAAA;CAMP,IAAI,aAAa,aAAa,WAAW,GACvC,OAAO,KAAK;EACV,MAAM,CAAC,cAAc;EACrB,SAAS;EACT,MAAM;CACR,CAAC;CAIH,MAAM,oBAAoB,aAAa,aAAa,MAAM,MACxD,yBAAyB,SAAS,CAA8C,CAClF;CACA,MAAM,qBAAqB,aAAa,aAAa,SACnD,yDACF;CACA,IAAI,qBAAqB,CAAC,oBACxB,OAAO,KAAK;EACV,MAAM,CAAC,cAAc;EACrB,SAAS;EACT,MAAM;CACR,CAAC;CAOH,IAHmC,aAAa,aAAa,MAAM,MACjE,kCAAkC,SAAS,CAAuD,CAEvE,KAAK,CAAC,aAAa,uBAC9C,SAAS,KAAK;EACZ,MAAM,CAAC,uBAAuB;EAC9B,SACE;EACF,MAAM;CACR,CAAC;CAIH,MAAM,YAAY,2BAA2B,aAAa,GAAG;CAC7D,IAAI,CAAC,UAAU,OACb,OAAO,KAAK;EACV,MAAM,CAAC,KAAK;EACZ,SAAS,UAAU;EACnB,MAAM;CACR,CAAC;CAGH,OAAO;EAAE,OAAO,OAAO,WAAW;EAAG;EAAQ;CAAS;AACxD;;;;AAKA,SAAgB,uBAAuB,QAAmC;CACxE,MAAM,SAAS,qBAAqB,UAAU,MAAM;CACpD,MAAM,SAA4B,CAAC;CACnC,MAAM,WAA8B,CAAC;CAErC,IAAI,CAAC,OAAO,SACV,KAAK,MAAM,SAAS,OAAO,MAAM,QAC/B,OAAO,KAAK;EACV,MAAM,MAAM,KAAK,IAAI,MAAM;EAC3B,SAAS,MAAM;EACf,MAAM,MAAM;CACd,CAAC;CAIL,OAAO;EAAE,OAAO,OAAO,WAAW;EAAG;EAAQ;CAAS;AACxD;;;;AAKA,SAAgB,cAAc,QAAiB,SAAoC;CACjF,MAAM,eAAe,uBAAuB,MAAM;CAClD,MAAM,gBAAgB,qBAAqB,OAAO;CAElD,MAAM,SAAS,CACb,GAAG,aAAa,OAAO,KAAK,OAAO;EAAE,GAAG;EAAG,MAAM,CAAC,UAAU,GAAG,EAAE,IAAI;CAAE,EAAE,GACzE,GAAG,cAAc,OAAO,KAAK,OAAO;EAAE,GAAG;EAAG,MAAM,CAAC,WAAW,GAAG,EAAE,IAAI;CAAE,EAAE,CAC7E;CAEA,MAAM,WAAW,CACf,GAAG,aAAa,SAAS,KAAK,OAAO;EAAE,GAAG;EAAG,MAAM,CAAC,UAAU,GAAG,EAAE,IAAI;CAAE,EAAE,GAC3E,GAAG,cAAc,SAAS,KAAK,OAAO;EAAE,GAAG;EAAG,MAAM,CAAC,WAAW,GAAG,EAAE,IAAI;CAAE,EAAE,CAC/E;CAEA,OAAO;EAAE,OAAO,OAAO,WAAW;EAAG;EAAQ;CAAS;AACxD;;;;AASA,SAAgB,mBAAmB,SAAgC;CACjE,OAAO,OAAO,QAAQ,WAAW,YAAY,QAAQ,OAAO,SAAS;AACvE;;;;AAKA,SAAgB,qBAAqB,SAAgC;CACnE,OACE,OAAO,QAAQ,WAAW,YAC1B,QAAQ,OAAO,SAAS,KACxB,OAAO,QAAQ,WAAW,YAC1B,QAAQ,OAAO,SAAS;AAE5B;;;;AAKA,SAAgB,yBAAyB,SAAoC;CAC3E,MAAM,SAAS,yBAAyB,UAAU,OAAO;CACzD,MAAM,SAA4B,CAAC;CACnC,MAAM,WAA8B,CAAC;CAErC,IAAI,CAAC,OAAO,SACV,KAAK,MAAM,SAAS,OAAO,MAAM,QAC/B,OAAO,KAAK;EACV,MAAM,MAAM,KAAK,IAAI,MAAM;EAC3B,SAAS,MAAM;EACf,MAAM,MAAM;CACd,CAAC;CAKL,IAAI,OAAO,SAAS;EAClB,MAAM,MAAc,OAAO,KAAK;EAGhC,IAAI,CAAC,wBAAwB,KAAK,GAAG,GACnC,SAAS,KAAK;GACZ,MAAM,CAAC,KAAK;GACZ,SACE;GACF,MAAM;EACR,CAAC;CAEL;CAEA,OAAO;EAAE,OAAO,OAAO,WAAW;EAAG;EAAQ;CAAS;AACxD;;;;AAKA,SAAgB,2BAA2B,SAAoC;CAC7E,MAAM,SAAS,2BAA2B,UAAU,OAAO;CAC3D,MAAM,SAA4B,CAAC;CACnC,MAAM,WAA8B,CAAC;CAErC,IAAI,CAAC,OAAO,SACV,KAAK,MAAM,SAAS,OAAO,MAAM,QAC/B,OAAO,KAAK;EACV,MAAM,MAAM,KAAK,IAAI,MAAM;EAC3B,SAAS,MAAM;EACf,MAAM,MAAM;CACd,CAAC;CAKL,IAAI,OAAO,SAAS;EAClB,MAAM,MAAc,OAAO,KAAK;EAGhC,IAAI,CAAC,wBAAwB,KAAK,GAAG,GACnC,SAAS,KAAK;GACZ,MAAM,CAAC,KAAK;GACZ,SACE;GACF,MAAM;EACR,CAAC;CAEL;CAEA,OAAO;EAAE,OAAO,OAAO,WAAW;EAAG;EAAQ;CAAS;AACxD;;;;AASA,MAAM,wBAAwB;CAAC;CAAO;CAAO;CAAO;CAAO;CAAO;AAAK;;;;AAKvE,MAAM,0BAA0B;CAAC;CAAO;CAAO;CAAO;CAAO;AAAK;;;;AAKlE,SAAS,2BAA2B,YAAyD;CAE3F,MAAM,QAAQ,WAAW,MAAM,6BAA6B;CAE5D,IAAI,CAAC,OACH,OAAO;EACL,OAAO;EACP,SAAS;CACX;CAGF,MAAM,GAAG,UAAU,MAAM;CAIzB,IAAI,CAAC,CADgB,GAAG,uBAAuB,GAAG,uBACnC,CAAC,CAAC,SAAS,MAAM,GAAG,CAGnC;CAEA,IAAI,CAAC,MAAM,GAAG,WAAW,GACvB,OAAO;EACL,OAAO;EACP,SAAS;CACX;CAGF,OAAO;EAAE,OAAO;EAAM,SAAS;CAAG;AACpC;;;;AASA,SAAgB,wBAAwB,SAAmD;CACzF,MAAM,SAAS,qBAAqB,OAAO;CAC3C,IAAI,CAAC,OAAO,OAEV,MAAM,IAAI,eAAe,2BADR,OAAO,OAAO,KAAK,MAAM,GAAG,EAAE,KAAK,KAAK,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,KAAK,IACzB,KAAK,OAAO,MAAM;AAEjF;;;;AAKA,SAAgB,iBAAiB,QAAiB,SAAwB;CACxE,MAAM,SAAS,cAAc,QAAQ,OAAO;CAC5C,IAAI,CAAC,OAAO,OAEV,MAAM,IAAI,eAAe,mBADR,OAAO,OAAO,KAAK,MAAM,GAAG,EAAE,KAAK,KAAK,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,KAAK,IACjC,KAAK,OAAO,MAAM;AAEzE;;;;;;;;;;;;;;;;AC/TA,eAAsB,UAAU,SAA4C;CAC1E,MAAM,EAAE,SAAS,YAAY,SAAS,cAAc,OAAO,WAAW;CAGtE,wBAAwB,OAAO;CAE/B,IAAI,CAAC,gBAAgB,aAAa,WAAW,GAC3C,MAAM,IAAI,eAAe,qDAAqD;CAahF,MAAM,SAAyB;EAC7B,KAAK;EACL,KAAK;EACL,KAZU,aAAa,KAAK,SAAS;GACrC,MAAM,UAAU,SAAS,IAAI;GAC7B,IAAI,CAAC,SACH,MAAM,IAAI,eAAe,gCAAgC;GAE3D,OAAO;EACT,CAMI;EACF,GAAI,SAAS,EAAE,KAAK,MAAM;CAC5B;CAKA,MAAM,eAAe,GAFC,gBAAgB,KAAK,UAAU,MAAM,CAEvB,EAAE,GADf,gBAAgB,KAAK,UAAU,OAAO,CACP;CAQtD,OAAO;EACL,KAAA,GAHa,aAAa,GAAG,MAHP,OAAO,YAAY;EAOzC;EACA;CACF;AACF;;;;;;;AAYA,SAAgB,YAAY,KAA0B;CACpD,MAAM,UAAU,UAAU,GAAG;CAG7B,IAAI,QAAQ,OAAO,QAAQ,cACzB,MAAM,IAAI,eAAe,mDAAmD,QAAQ,OAAO,IAAI,EAAE;CAInG,wBAAwB,QAAQ,OAAO;CAEvC,OAAO;EACL;EACA,QAAQ,QAAQ;EAChB,SAAS,QAAQ;CACnB;AACF;;;;;;;AAQA,SAAgB,WAAW,KAAuE;CAChG,MAAM,UAAU,UAAU,GAAG;CAC7B,MAAM,QAAQ,IAAI,MAAM,GAAG;CAE3B,OAAO;EACL,QAAQ,QAAQ;EAChB,SAAS,QAAQ;EACjB,WAAW,MAAM;CACnB;AACF;;;;;;;AAYA,SAAgB,mBAAmB,SAAqE;CACtG,MAAM,kBAAgC;EACpC,GAAG;EACH,KAAK,QAAQ,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;CAClD;CAEA,wBAAwB,eAAe;CAEvC,OAAO;AACT"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owf/eudi-wrprc",
-  "version": "0.3.1",
+  "version": "0.3.2-alpha-20260630211531",
   "description": "ETSI TS 119 475 Wallet-Relying Party Registration Certificate (WRPRC) implementation",
   "files": [
     "dist"
@@ -39,8 +39,8 @@
   },
   "dependencies": {
     "zod": "^4.4.3",
-    "@owf/crypto": "0.3.1",
-    "@owf/identity-common": "0.3.1"
+    "@owf/crypto": "0.3.2-alpha-20260630211531",
+    "@owf/identity-common": "0.3.2-alpha-20260630211531"
   },
   "devDependencies": {
     "vitest": "^4.1.9"