@owf/mdoc 0.6.0-alpha-20260225221529

package/dist/index.mjs

@@ -0,0 +1,3499 @@
+import { Encoder, addExtension, addExtension as addExtension$1 } from "cbor-x";
+import z$1, { z } from "zod";
+import { createErrorMap, fromError } from "zod-validation-error";
+
+//#region src/utils/zod-error.ts
+z$1.config({ customError: createErrorMap() });
+function formatZodError(error) {
+	if (!error) return "";
+	return fromError(error, {
+		prefix: "",
+		prefixSeparator: "✖ ",
+		issueSeparator: "\n✖ ",
+		unionSeparator: "\n    OR ✖ "
+	}).toString();
+}
+
+//#endregion
+//#region src/error/ValidationError.ts
+var ValidationError = class extends Error {
+	constructor(message, zodError) {
+		super(message);
+		this.message = `${message}\n${zodError ? formatZodError(zodError) : ""}`;
+		Object.defineProperty(this, "zodError", {
+			value: zodError,
+			writable: false,
+			enumerable: false
+		});
+	}
+};
+
+//#endregion
+//#region src/utils/zod.ts
+const zUint8Array = z$1.instanceof(Uint8Array);
+function parseStructureWithErrorHandling(structureName, schema, data, customErrorMessage) {
+	const parseResult = z$1.safeParse(schema, data);
+	if (!parseResult.success) throw new ValidationError(customErrorMessage ?? `Error decoding ${structureName}`, parseResult.error);
+	return parseResult.data;
+}
+function decodeStructureWithErrorHandling(structureName, schema, data, customErrorMessage) {
+	const decodeResult = z$1.safeDecode(schema, data);
+	if (!decodeResult.success) throw new ValidationError(customErrorMessage ?? `Error decoding ${structureName}`, decodeResult.error);
+	return decodeResult.data;
+}
+function encodeStructureWithErrorHandling(structureName, schema, data, customErrorMessage) {
+	const encodeResult = z$1.safeEncode(schema, data);
+	if (!encodeResult.success) throw new ValidationError(customErrorMessage ?? `Error encoding ${structureName}`, encodeResult.error);
+	return encodeResult.data;
+}
+
+//#endregion
+//#region src/cbor/parser.ts
+const encoderDefaults = {
+	tagUint8Array: false,
+	useRecords: false,
+	mapsAsObjects: false,
+	unwrapTopLevelDataItem: true,
+	variableMapSize: true
+};
+const cborDecode = (input, options = encoderDefaults) => {
+	const params = {
+		...encoderDefaults,
+		...options
+	};
+	const decoded = new Encoder(params).decode(input);
+	return params.unwrapTopLevelDataItem && typeof decoded === "object" && decoded instanceof DataItem ? decoded.data : decoded;
+};
+const cborEncode = (obj, options = encoderDefaults) => {
+	const enc = new Encoder({
+		...encoderDefaults,
+		...options
+	});
+	return Uint8Array.from(enc.encode(obj));
+};
+
+//#endregion
+//#region src/cbor/data-item.ts
+/**
+* DataItem is an extension defined https://www.rfc-editor.org/rfc/rfc8949.html#name-encoded-cbor-data-item
+*  > Sometimes it is beneficial to carry an embedded CBOR data item that is
+*  > not meant to be decoded immediately at the time the enclosing data item is being decoded.
+*
+* The idea of this class is to provide lazy encode and decode of cbor data.
+*
+* Due to a bug in the cbor-x library, we are eagerly encoding the data in the constructor.
+* https://github.com/kriszyp/cbor-x/issues/83
+*
+*/
+var DataItem = class DataItem {
+	#data;
+	#buffer;
+	constructor(options) {
+		if (!("data" in options) && !("buffer" in options)) throw new Error("DataItem must be initialized with either the data or a buffer");
+		if ("data" in options) this.#data = options.data;
+		this.#buffer = "buffer" in options ? options.buffer : cborEncode(options.data);
+	}
+	get data() {
+		if (!this.#data) this.#data = cborDecode(this.#buffer);
+		return this.#data;
+	}
+	get buffer() {
+		return this.#buffer;
+	}
+	static fromData(data) {
+		return new DataItem({ data });
+	}
+	static fromBuffer(buffer) {
+		return new DataItem({ buffer });
+	}
+};
+addExtension({
+	Class: DataItem,
+	tag: 24,
+	encode: (instance, encode) => {
+		return encode(instance.buffer);
+	},
+	decode: (buffer) => {
+		return DataItem.fromBuffer(buffer);
+	}
+});
+
+//#endregion
+//#region src/cbor/cbor-structure.ts
+var CborStructure = class {
+	constructor(structure) {
+		this.structure = structure;
+	}
+	get decodedStructure() {
+		return this.structure;
+	}
+	/**
+	* Static getter for the Zod codec schema that defines the CBOR structure.
+	* Subclasses CAN override this to provide their specific schema for automatic encoding/decoding.
+	* The schema should be a Zod schema or codec that handles validation and transformation.
+	* If not provided, subclasses must override encode(), decode(), and fromEncodedStructure().
+	*/
+	static get encodingSchema() {}
+	/**
+	* Returns the encoded structure that will be serialized to CBOR.
+	* By default, returns the protected structure property.
+	* Override if custom encoding logic is needed.
+	*/
+	get encodedStructure() {
+		const encodingSchema = this.constructor.encodingSchema;
+		if (!encodingSchema) throw new Error("encodedStructure must be implemented when encodingSchema is not provided");
+		return encodeStructureWithErrorHandling(this.constructor.name, encodingSchema, this.structure);
+	}
+	/**
+	* Encodes this structure to CBOR bytes.
+	*/
+	encode(options) {
+		return cborEncode(options?.asDataItem ? DataItem.fromData(this.encodedStructure) : this.encodedStructure);
+	}
+	/**
+	* Decodes CBOR bytes into a structure instance.
+	* Uses the encodingSchema's decode() method to validate and transform the decoded data.
+	*/
+	static decode(bytes) {
+		const rawStructure = cborDecode(bytes);
+		return new this(this.fromEncodedStructure(rawStructure).decodedStructure);
+	}
+	/**
+	* Creates a structure instance from the encoded CBOR structure (after calling cborDecode).
+	*
+	* Uses the encodingSchema's decode() method to validate and transform the structure if available.
+	* Otherwise, subclasses must override this method.
+	*/
+	static fromEncodedStructure(encodedStructure) {
+		if (!this.encodingSchema) throw new Error("fromEncodedStructure must be implemented when encodingSchema is not provided");
+		return new this(decodeStructureWithErrorHandling(this.name, this.encodingSchema, encodedStructure));
+	}
+	static fromDataItem(dataItem) {
+		return new this(parseStructureWithErrorHandling(this.name, z.instanceof(DataItem).transform((di) => di.data).transform((d) => this.fromEncodedStructure(d).decodedStructure), dataItem, `Error decoding ${this.name} from DateItem`));
+	}
+	/**
+	* Creates a structure instance from the decoded structure.
+	*
+	* Uses the encodingSchema's parse method to validate the structure if available.
+	* Otherwise, subclasses must override this method.
+	*/
+	static fromDecodedStructure(decodedStructure) {
+		const encodingSchema = this.encodingSchema;
+		if (!encodingSchema) throw new Error("fromDecodedStructure must be implemented when encodingSchema is not provided");
+		const decodedSchema = encodingSchema instanceof z.ZodPipe ? encodingSchema.out : encodingSchema;
+		return new this(parseStructureWithErrorHandling(this.name, decodedSchema, decodedStructure));
+	}
+};
+
+//#endregion
+//#region src/cbor/models/date.ts
+addExtension({
+	Class: Date,
+	tag: 0,
+	encode: (date, encode) => encode(`${date.toISOString().split(".")[0]}Z`),
+	decode: (isoStringDateTime) => new Date(isoStringDateTime)
+});
+
+//#endregion
+//#region src/cbor/models/date-only.ts
+const customInspectSymbol = Symbol.for("nodejs.util.inspect.custom");
+var DateOnly = class DateOnly {
+	constructor(date) {
+		this.date = date ? new Date(date) : /* @__PURE__ */ new Date();
+	}
+	get [Symbol.toStringTag]() {
+		return DateOnly.name;
+	}
+	toString() {
+		return this.toISOString();
+	}
+	toJSON() {
+		return this.toISOString();
+	}
+	toISOString() {
+		return this.date.toISOString().split("T")[0];
+	}
+	[customInspectSymbol]() {
+		return this.toISOString();
+	}
+};
+addExtension({
+	Class: DateOnly,
+	tag: 1004,
+	encode: (date, encode) => encode(date.toISOString()),
+	decode: (isoStringDate) => new DateOnly(isoStringDate)
+});
+
+//#endregion
+//#region src/cose/error.ts
+var CoseError = class extends Error {
+	constructor(message = new.target.name) {
+		super(message);
+	}
+};
+var CoseUnsupportedMacError = class extends CoseError {};
+var CoseInvalidSignatureError = class extends CoseError {};
+var CoseInvalidAlgorithmError = class extends CoseError {};
+var CosePayloadMustBeNullError = class extends CoseError {};
+var CosePayloadMustBeDefinedError = class extends CoseError {};
+var CosePayloadInvalidStructureError = class extends CoseError {};
+var CoseInvalidTypeForKeyError = class extends CoseError {};
+var CoseInvalidValueForKtyError = class extends CoseError {};
+var CoseInvalidKtyForRawError = class extends CoseError {};
+var CoseXNotDefinedError = class extends CoseError {};
+var CoseYNotDefinedError = class extends CoseError {};
+var CoseDNotDefinedError = class extends CoseError {};
+var CoseKNotDefinedError = class extends CoseError {};
+var CoseEphemeralMacKeyIsRequiredError = class extends CoseError {};
+var CoseCertificateNotFoundError = class extends CoseError {};
+var CoseKeyTypeNotSupportedForPrivateKeyExtractionError = class extends CoseError {};
+
+//#endregion
+//#region src/cose/headers/defaults.ts
+let Header = /* @__PURE__ */ function(Header) {
+	Header[Header["Algorithm"] = 1] = "Algorithm";
+	Header[Header["Critical"] = 2] = "Critical";
+	Header[Header["ContentType"] = 3] = "ContentType";
+	Header[Header["KeyId"] = 4] = "KeyId";
+	Header[Header["Iv"] = 5] = "Iv";
+	Header[Header["PartialIv"] = 6] = "PartialIv";
+	Header[Header["CounterSignature"] = 7] = "CounterSignature";
+	Header[Header["CounterSignature0"] = 9] = "CounterSignature0";
+	Header[Header["CounterSignatureV2"] = 11] = "CounterSignatureV2";
+	Header[Header["CounterSignature0V2"] = 12] = "CounterSignature0V2";
+	Header[Header["X5Bag"] = 32] = "X5Bag";
+	Header[Header["X5Chain"] = 33] = "X5Chain";
+	Header[Header["X5T"] = 34] = "X5T";
+	Header[Header["X5U"] = 35] = "X5U";
+	return Header;
+}({});
+let SignatureAlgorithm = /* @__PURE__ */ function(SignatureAlgorithm) {
+	SignatureAlgorithm[SignatureAlgorithm["EdDSA"] = -8] = "EdDSA";
+	SignatureAlgorithm[SignatureAlgorithm["ES256"] = -7] = "ES256";
+	SignatureAlgorithm[SignatureAlgorithm["ES384"] = -35] = "ES384";
+	SignatureAlgorithm[SignatureAlgorithm["ES512"] = -36] = "ES512";
+	SignatureAlgorithm[SignatureAlgorithm["PS256"] = -37] = "PS256";
+	SignatureAlgorithm[SignatureAlgorithm["PS384"] = -38] = "PS384";
+	SignatureAlgorithm[SignatureAlgorithm["PS512"] = -39] = "PS512";
+	SignatureAlgorithm[SignatureAlgorithm["RS256"] = -257] = "RS256";
+	SignatureAlgorithm[SignatureAlgorithm["RS384"] = -258] = "RS384";
+	SignatureAlgorithm[SignatureAlgorithm["RS512"] = -259] = "RS512";
+	return SignatureAlgorithm;
+}({});
+let MacAlgorithm = /* @__PURE__ */ function(MacAlgorithm) {
+	MacAlgorithm[MacAlgorithm["HS256"] = 5] = "HS256";
+	MacAlgorithm[MacAlgorithm["HS384"] = 6] = "HS384";
+	MacAlgorithm[MacAlgorithm["HS512"] = 7] = "HS512";
+	return MacAlgorithm;
+}({});
+let EncryptionAlgorithm = /* @__PURE__ */ function(EncryptionAlgorithm) {
+	EncryptionAlgorithm[EncryptionAlgorithm["A128GCM"] = 1] = "A128GCM";
+	EncryptionAlgorithm[EncryptionAlgorithm["A192GCM"] = 2] = "A192GCM";
+	EncryptionAlgorithm[EncryptionAlgorithm["A256GCM"] = 3] = "A256GCM";
+	EncryptionAlgorithm[EncryptionAlgorithm["Direct"] = -6] = "Direct";
+	return EncryptionAlgorithm;
+}({});
+
+//#endregion
+//#region src/cose/headers/protected-headers.ts
+const protectedHeadersEncodedStructure = zUint8Array;
+const protectedHeadersDecodedStructure = z$1.map(z$1.number(), z$1.unknown());
+var ProtectedHeaders = class extends CborStructure {
+	static get encodingSchema() {
+		return z$1.codec(protectedHeadersEncodedStructure, protectedHeadersDecodedStructure, {
+			encode: (decoded) => cborEncode(decoded),
+			decode: (encoded) => cborDecode(encoded)
+		});
+	}
+	get headers() {
+		return this.structure;
+	}
+	static create(options) {
+		return this.fromDecodedStructure(options.protectedHeaders ?? /* @__PURE__ */ new Map());
+	}
+};
+
+//#endregion
+//#region src/cose/headers/unprotected-headers.ts
+const unprotectedHeadersStructure = z$1.map(z$1.number(), z$1.unknown());
+var UnprotectedHeaders = class extends CborStructure {
+	static get encodingSchema() {
+		return unprotectedHeadersStructure;
+	}
+	get headers() {
+		return this.structure;
+	}
+	static create(options) {
+		return this.fromDecodedStructure(options.unprotectedHeaders ?? /* @__PURE__ */ new Map());
+	}
+};
+
+//#endregion
+//#region src/cose/key/curve.ts
+let Curve = /* @__PURE__ */ function(Curve) {
+	Curve[Curve["P-256"] = 1] = "P-256";
+	Curve[Curve["P-384"] = 2] = "P-384";
+	Curve[Curve["P-521"] = 3] = "P-521";
+	Curve[Curve["X25519"] = 4] = "X25519";
+	Curve[Curve["X448"] = 5] = "X448";
+	Curve[Curve["Ed25519"] = 6] = "Ed25519";
+	Curve[Curve["Ed448"] = 7] = "Ed448";
+	return Curve;
+}({});
+
+//#endregion
+//#region src/utils/transformers.ts
+const BASE64_CHARS = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+const bytesToBase64 = (bytes) => {
+	let result = "";
+	let i;
+	for (i = 0; i < bytes.length - 2; i += 3) {
+		const chunk = bytes[i] << 16 | bytes[i + 1] << 8 | bytes[i + 2];
+		result += BASE64_CHARS[chunk >> 18 & 63];
+		result += BASE64_CHARS[chunk >> 12 & 63];
+		result += BASE64_CHARS[chunk >> 6 & 63];
+		result += BASE64_CHARS[chunk & 63];
+	}
+	if (i < bytes.length) {
+		const chunk = bytes[i] << 16 | (i + 1 < bytes.length ? bytes[i + 1] << 8 : 0);
+		result += BASE64_CHARS[chunk >> 18 & 63];
+		result += BASE64_CHARS[chunk >> 12 & 63];
+		result += i + 1 < bytes.length ? BASE64_CHARS[chunk >> 6 & 63] : "=";
+		result += "=";
+	}
+	return result;
+};
+const base64ToBytes = (base64) => {
+	if (!/^[A-Za-z0-9+/]*={0,2}$/.test(base64)) throw new Error("Invalid base64 string: contains invalid characters");
+	const cleanBase64 = base64.replace(/=/g, "");
+	const length = cleanBase64.length;
+	const bytes = new Uint8Array(length * 3 >> 2);
+	let byteIndex = 0;
+	for (let i = 0; i < length; i += 4) {
+		const a = BASE64_CHARS.indexOf(cleanBase64[i]);
+		const b = BASE64_CHARS.indexOf(cleanBase64[i + 1]);
+		const c = i + 2 < length ? BASE64_CHARS.indexOf(cleanBase64[i + 2]) : 0;
+		const d = i + 3 < length ? BASE64_CHARS.indexOf(cleanBase64[i + 3]) : 0;
+		bytes[byteIndex++] = a << 2 | b >> 4;
+		if (i + 2 < length) bytes[byteIndex++] = (b & 15) << 4 | c >> 2;
+		if (i + 3 < length) bytes[byteIndex++] = (c & 3) << 6 | d;
+	}
+	return bytes;
+};
+const bytesToBase64Url = (bytes) => {
+	return bytesToBase64(bytes).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+};
+const base64UrlToBytes = (base64url) => {
+	if (!/^[A-Za-z0-9_-]*$/.test(base64url)) throw new Error("Invalid base64url string: contains invalid characters");
+	let base64 = base64url.replace(/-/g, "+").replace(/_/g, "/");
+	while (base64.length % 4) base64 += "=";
+	return base64ToBytes(base64);
+};
+const bytesToHex = (bytes) => {
+	let result = "";
+	for (let i = 0; i < bytes.length; i++) {
+		const hex = bytes[i].toString(16);
+		result += hex.length === 1 ? `0${hex}` : hex;
+	}
+	return result;
+};
+const hexToBytes = (hex) => {
+	if (!/^[0-9a-fA-F]*$/.test(hex)) throw new Error("Invalid hex string: contains invalid characters");
+	if (hex.length % 2 !== 0) throw new Error("Invalid hex string: length must be even");
+	const bytes = new Uint8Array(hex.length / 2);
+	for (let i = 0; i < hex.length; i += 2) bytes[i / 2] = Number.parseInt(hex.substring(i, i + 2), 16);
+	return bytes;
+};
+const base64 = {
+	decode: base64ToBytes,
+	encode: bytesToBase64
+};
+const base64url = {
+	decode: base64UrlToBytes,
+	encode: bytesToBase64Url
+};
+const hex = {
+	decode: hexToBytes,
+	encode: bytesToHex
+};
+const bytesToString = (bytes) => {
+	let result = "";
+	let i = 0;
+	while (i < bytes.length) {
+		const byte1 = bytes[i++];
+		if (byte1 < 128) result += String.fromCharCode(byte1);
+		else if (byte1 < 224) {
+			const byte2 = bytes[i++];
+			result += String.fromCharCode((byte1 & 31) << 6 | byte2 & 63);
+		} else if (byte1 < 240) {
+			const byte2 = bytes[i++];
+			const byte3 = bytes[i++];
+			result += String.fromCharCode((byte1 & 15) << 12 | (byte2 & 63) << 6 | byte3 & 63);
+		} else {
+			const byte2 = bytes[i++];
+			const byte3 = bytes[i++];
+			const byte4 = bytes[i++];
+			const codePoint = (byte1 & 7) << 18 | (byte2 & 63) << 12 | (byte3 & 63) << 6 | byte4 & 63;
+			const surrogate1 = 55296 + (codePoint - 65536 >> 10);
+			const surrogate2 = 56320 + (codePoint - 65536 & 1023);
+			result += String.fromCharCode(surrogate1, surrogate2);
+		}
+	}
+	return result;
+};
+const stringToBytes = (str) => {
+	const bytes = [];
+	for (let i = 0; i < str.length; i++) {
+		let codePoint = str.charCodeAt(i);
+		if (codePoint >= 55296 && codePoint <= 56319 && i + 1 < str.length) {
+			const low = str.charCodeAt(i + 1);
+			if (low >= 56320 && low <= 57343) {
+				codePoint = 65536 + (codePoint - 55296 << 10) + (low - 56320);
+				i++;
+			}
+		}
+		if (codePoint < 128) bytes.push(codePoint);
+		else if (codePoint < 2048) {
+			bytes.push(192 | codePoint >> 6);
+			bytes.push(128 | codePoint & 63);
+		} else if (codePoint < 65536) {
+			bytes.push(224 | codePoint >> 12);
+			bytes.push(128 | codePoint >> 6 & 63);
+			bytes.push(128 | codePoint & 63);
+		} else {
+			bytes.push(240 | codePoint >> 18);
+			bytes.push(128 | codePoint >> 12 & 63);
+			bytes.push(128 | codePoint >> 6 & 63);
+			bytes.push(128 | codePoint & 63);
+		}
+	}
+	return new Uint8Array(bytes);
+};
+const concatBytes = (byteArrays) => {
+	const totalLength = byteArrays.reduce((sum, arr) => sum + arr.length, 0);
+	const result = new Uint8Array(totalLength);
+	let offset = 0;
+	for (const arr of byteArrays) {
+		result.set(arr, offset);
+		offset += arr.length;
+	}
+	return result;
+};
+const compareBytes = (lhs, rhs) => {
+	if (lhs === rhs) return true;
+	if (lhs.byteLength !== rhs.byteLength) return false;
+	return lhs.every((b, i) => b === rhs[i]);
+};
+
+//#endregion
+//#region src/utils/typed-map.ts
+/**
+* TypedMap provides compile-time type safety for Maps where each key has its own specific value type.
+* Unlike Map<K, V> which has the same value type V for all keys, TypedMap<Schema, OptionalKeys>
+* allows different value types per key (heterogeneous values).
+*
+* Example:
+*   type CoseKeySchema = {
+*     [CoseKeyParameter.KeyType]: KeyType     // number key → KeyType value
+*     [CoseKeyParameter.Curve]: Curve         // number key → Curve value
+*     [CoseKeyParameter.X]: Uint8Array        // number key → Uint8Array value
+*   }
+*
+*   const map = new TypedMap<CoseKeySchema>()
+*   map.get(CoseKeyParameter.KeyType)  // TypeScript knows this is KeyType!
+*   map.get(CoseKeyParameter.Curve)    // TypeScript knows this is Curve!
+*   map.get(CoseKeyParameter.X)        // TypeScript knows this is Uint8Array!
+*
+* @template Schema - Object type mapping keys to their value types
+* @template OptionalKeys - Union of keys that are optional (can be absent)
+*/
+var TypedMap = class TypedMap {
+	constructor(entries) {
+		this.map = new Map(entries);
+	}
+	static fromMap(map) {
+		return new TypedMap(Array.from(map.entries()));
+	}
+	/**
+	* Type-safe get that returns the correct value type for each key.
+	* Required keys return T, optional keys return T | undefined.
+	*/
+	get(key) {
+		return this.map.get(key);
+	}
+	/**
+	* Type-safe set that ensures the value matches the key's type
+	*/
+	set(key, value) {
+		this.map.set(key, value);
+		return this;
+	}
+	has(key) {
+		return this.map.has(key);
+	}
+	delete(key) {
+		return this.map.delete(key);
+	}
+	clear() {
+		this.map.clear();
+	}
+	get size() {
+		return this.map.size;
+	}
+	keys() {
+		return this.map.keys();
+	}
+	values() {
+		return this.map.values();
+	}
+	entries() {
+		return this.map.entries();
+	}
+	forEach(callbackfn, thisArg) {
+		this.map.forEach(callbackfn, thisArg);
+	}
+	[Symbol.iterator]() {
+		return this.map[Symbol.iterator]();
+	}
+	toMap() {
+		return new Map(this.map);
+	}
+};
+/**
+* This checks whether the property is exact optional. exact optional means that the value cannot be undefined, but if used
+* in an object the key can be omitted. This is important for CBOR structures, as undefined will be encoded, and thus must be
+* omitted in most cases.
+*
+* Zod recommend to check for optionality by just parsing undefined.
+*/
+const isExactOptional = (schema) => !schema.safeParse(void 0).success && z.object({ test: schema }).safeParse({}).success;
+/**
+* Utility function to create a typed map codec.
+* Takes an array of [key, valueSchema] entries to support any key type (including non-string keys for CBOR).
+*
+* Example:
+*   const coseKeyMap = typedMap([
+*     [CoseKeyParameter.KeyType, z.number()],
+*     [CoseKeyParameter.Curve, z.number()],
+*     [CoseKeyParameter.X, z.instanceof(Uint8Array)]
+*   ] as const)
+*
+* The resulting schema validates a Map and transforms it to TypedMap<Schema, never>.
+*/
+function typedMap(entries, { allowAdditionalKeys = true, encode, decode } = {}) {
+	const requiredKeys = entries.filter(([, valueSchema]) => !isExactOptional(valueSchema)).map(([key]) => key);
+	const schemaMap = new Map(entries);
+	const originalEncode = (decoded) => decoded.toMap();
+	const originalDecode = (encoded) => TypedMap.fromMap(encoded);
+	return z.codec(z.map(z.unknown(), z.unknown()), z.instanceof(TypedMap).superRefine((map, ctx) => {
+		const additionalKeys = Array.from(map.keys()).filter((key) => !schemaMap.has(key));
+		if (additionalKeys.length > 0 && !allowAdditionalKeys) for (const additionalKey of additionalKeys) if (typeof additionalKey !== "string" && typeof additionalKey !== "number") ctx.addIssue({
+			code: "invalid_key",
+			origin: "map",
+			continue: true,
+			path: [],
+			input: map,
+			issues: [],
+			message: "Key found in map that is not a string or number"
+		});
+		else ctx.addIssue({
+			code: "invalid_key",
+			origin: "map",
+			continue: true,
+			path: [additionalKey],
+			input: map,
+			issues: [],
+			message: `Unexpected key '${additionalKey}' found in map, additional keys are not allowed.`
+		});
+		for (const [key, valueSchema] of schemaMap.entries()) {
+			const hasKey = map.has(key);
+			const value = map.get(key);
+			if (!hasKey && requiredKeys.includes(key)) {
+				ctx.addIssue({
+					code: "invalid_value",
+					continue: true,
+					message: `Expected key '${key}' to be defined.`,
+					path: [key],
+					values: [],
+					input: value
+				});
+				continue;
+			}
+			if (!hasKey && !requiredKeys.includes(key)) continue;
+			const parseResult = valueSchema.safeParse(value);
+			if (!parseResult.success) for (const issue of parseResult.error.issues) ctx.addIssue({
+				...issue,
+				path: [`${key}`, ...issue.path]
+			});
+		}
+	}), {
+		decode: (input) => decode ? decode(input, originalDecode) : originalDecode(input),
+		encode: (output) => encode ? encode(output, originalEncode) : originalEncode(output)
+	});
+}
+
+//#endregion
+//#region src/cose/key/key-operation.ts
+let KeyOps = /* @__PURE__ */ function(KeyOps) {
+	KeyOps[KeyOps["Sign"] = 1] = "Sign";
+	KeyOps[KeyOps["Verify"] = 2] = "Verify";
+	KeyOps[KeyOps["Encrypt"] = 3] = "Encrypt";
+	KeyOps[KeyOps["Decrypt"] = 4] = "Decrypt";
+	KeyOps[KeyOps["WrapKey"] = 5] = "WrapKey";
+	KeyOps[KeyOps["UnwrapKey"] = 6] = "UnwrapKey";
+	KeyOps[KeyOps["DeriveKey"] = 7] = "DeriveKey";
+	KeyOps[KeyOps["DeriveBits"] = 8] = "DeriveBits";
+	KeyOps[KeyOps["MACCreate"] = 9] = "MACCreate";
+	KeyOps[KeyOps["MACVerify"] = 10] = "MACVerify";
+	return KeyOps;
+}({});
+
+//#endregion
+//#region src/cose/key/key-type.ts
+let KeyType = /* @__PURE__ */ function(KeyType) {
+	KeyType[KeyType["Okp"] = 1] = "Okp";
+	KeyType[KeyType["Ec"] = 2] = "Ec";
+	KeyType[KeyType["Oct"] = 4] = "Oct";
+	KeyType[KeyType["Reserved"] = 0] = "Reserved";
+	return KeyType;
+}({});
+
+//#endregion
+//#region src/cose/key/jwk.ts
+const swapMap = (map) => Object.fromEntries(Object.entries(map).map(([key, value]) => [value, key]));
+const swapNestedMap = (nestedMap) => Object.fromEntries(Object.entries(nestedMap).map(([category, mappings]) => [category, Object.fromEntries(Object.entries(mappings).map(([key, value]) => [value, key]))]));
+const jwkCoseKeyMap = {
+	kty: {
+		OKP: KeyType.Okp,
+		EC: KeyType.Ec,
+		OCT: KeyType.Oct
+	},
+	crv: {
+		"P-256": Curve["P-256"],
+		"p-384": Curve["P-384"],
+		"p-521": Curve["P-521"],
+		X25519: Curve.X25519,
+		Ed2519: Curve.Ed25519,
+		Ed448: Curve.Ed448
+	},
+	alg: {
+		EdDSA: SignatureAlgorithm.EdDSA,
+		ES256: SignatureAlgorithm.ES256,
+		ES384: SignatureAlgorithm.ES384,
+		ES512: SignatureAlgorithm.ES512,
+		PS256: SignatureAlgorithm.PS256,
+		PS384: SignatureAlgorithm.PS384,
+		PS512: SignatureAlgorithm.PS512,
+		RS256: SignatureAlgorithm.RS256,
+		RS384: SignatureAlgorithm.RS384,
+		RS512: SignatureAlgorithm.RS512,
+		HS256: MacAlgorithm.HS256,
+		HS384: MacAlgorithm.HS384,
+		HS512: MacAlgorithm.HS512,
+		A128GCM: EncryptionAlgorithm.A128GCM,
+		A192GCM: EncryptionAlgorithm.A192GCM,
+		A256GCM: EncryptionAlgorithm.A256GCM,
+		Direct: EncryptionAlgorithm.Direct
+	},
+	keyOps: {
+		sign: KeyOps.Sign,
+		verify: KeyOps.Verify,
+		encrypt: KeyOps.Encrypt,
+		decrypt: KeyOps.Decrypt,
+		wrapKey: KeyOps.WrapKey,
+		unwrapKey: KeyOps.UnwrapKey,
+		deriveKey: KeyOps.DeriveKey,
+		deriveBits: KeyOps.DeriveBits,
+		mACCreate: KeyOps.MACCreate,
+		mACVerify: KeyOps.MACVerify
+	}
+};
+const coseKeyJwkMap = swapNestedMap(jwkCoseKeyMap);
+const jwkCoseOptionsMap = {
+	kty: "keyType",
+	kid: "keyId",
+	alg: "algorithm",
+	keyOps: "keyOps",
+	baseIv: "baseIv",
+	crv: "curve",
+	x: "x",
+	y: "y",
+	d: "d"
+};
+const coseOptionsJwkMap = swapMap(jwkCoseOptionsMap);
+const jwkToCoseKey = {
+	kty: (kty) => {
+		return jwkCoseKeyMap.kty[kty] ?? kty;
+	},
+	crv: (crv) => jwkCoseKeyMap.crv[crv] ?? crv,
+	alg: (alg) => jwkCoseKeyMap.alg[alg] ?? alg,
+	kid: (kid) => kid,
+	keyOps: (keyOps) => Array.isArray(keyOps) ? keyOps?.map((ko) => jwkCoseKeyMap.keyOps[ko] ?? ko) : void 0,
+	x: (s) => s && typeof s === "string" ? base64url.decode(s) : void 0,
+	y: (s) => s && typeof s === "string" ? base64url.decode(s) : void 0,
+	d: (s) => s && typeof s === "string" ? base64url.decode(s) : void 0
+};
+const coseKeyToJwk = {
+	keyType: (keyType) => coseKeyJwkMap.kty[keyType],
+	keyId: (keyId) => keyId,
+	algorithm: (algorithm) => algorithm ? coseKeyJwkMap.alg[algorithm] : void 0,
+	keyOps: (keyOps) => keyOps && Array.isArray(keyOps) ? keyOps.map((ko) => coseKeyJwkMap.keyOps[ko]) : void 0,
+	baseIv: (baseIv) => baseIv,
+	curve: (curve) => curve ? coseKeyJwkMap.crv[curve] : void 0,
+	x: (x) => x ? base64url.encode(x) : void 0,
+	y: (y) => y ? base64url.encode(y) : void 0,
+	d: (d) => d ? base64url.encode(d) : void 0
+};
+
+//#endregion
+//#region src/cose/key/key.ts
+let CoseKeyParameter = /* @__PURE__ */ function(CoseKeyParameter) {
+	CoseKeyParameter[CoseKeyParameter["KeyType"] = 1] = "KeyType";
+	CoseKeyParameter[CoseKeyParameter["KeyId"] = 2] = "KeyId";
+	CoseKeyParameter[CoseKeyParameter["Algorithm"] = 3] = "Algorithm";
+	CoseKeyParameter[CoseKeyParameter["KeyOps"] = 4] = "KeyOps";
+	CoseKeyParameter[CoseKeyParameter["BaseIv"] = 5] = "BaseIv";
+	CoseKeyParameter[CoseKeyParameter["CurveOrK"] = -1] = "CurveOrK";
+	CoseKeyParameter[CoseKeyParameter["X"] = -2] = "X";
+	CoseKeyParameter[CoseKeyParameter["Y"] = -3] = "Y";
+	CoseKeyParameter[CoseKeyParameter["D"] = -4] = "D";
+	return CoseKeyParameter;
+}({});
+const coseKeySchema = typedMap([
+	[CoseKeyParameter.KeyType, z.union([z.enum(KeyType), z.string()])],
+	[CoseKeyParameter.KeyId, zUint8Array.or(z.string()).exactOptional()],
+	[CoseKeyParameter.Algorithm, z.union([z.string({ error: "Cose algorithm must be a string" }), z.number({ error: "Cose algorithm must be a number" })]).exactOptional()],
+	[CoseKeyParameter.KeyOps, z.array(z.union([z.enum(KeyOps), z.string()])).exactOptional()],
+	[CoseKeyParameter.BaseIv, zUint8Array.exactOptional()],
+	[CoseKeyParameter.CurveOrK, z.union([z.enum(Curve), zUint8Array]).exactOptional()],
+	[CoseKeyParameter.X, zUint8Array.exactOptional()],
+	[CoseKeyParameter.Y, zUint8Array.exactOptional()],
+	[CoseKeyParameter.D, zUint8Array.exactOptional()]
+]);
+var CoseKey = class extends CborStructure {
+	static get encodingSchema() {
+		return coseKeySchema;
+	}
+	get keyType() {
+		return this.structure.get(CoseKeyParameter.KeyType);
+	}
+	get keyId() {
+		const keyId = this.structure.get(CoseKeyParameter.KeyId);
+		return keyId instanceof Uint8Array ? bytesToString(keyId) : keyId;
+	}
+	get algorithm() {
+		return this.structure.get(CoseKeyParameter.Algorithm);
+	}
+	get keyOps() {
+		return this.structure.get(CoseKeyParameter.KeyOps);
+	}
+	get baseIv() {
+		return this.structure.get(CoseKeyParameter.BaseIv);
+	}
+	get curve() {
+		if (this.keyType === KeyType.Ec || this.keyType === KeyType.Okp) return this.structure.get(CoseKeyParameter.CurveOrK);
+	}
+	get x() {
+		return this.structure.get(CoseKeyParameter.X);
+	}
+	get y() {
+		return this.structure.get(CoseKeyParameter.Y);
+	}
+	get d() {
+		return this.structure.get(CoseKeyParameter.D);
+	}
+	get k() {
+		if (this.keyType === KeyType.Oct) return this.structure.get(CoseKeyParameter.CurveOrK);
+	}
+	static create(options) {
+		const map = new TypedMap([[CoseKeyParameter.KeyType, options.keyType]]);
+		if (options.keyId !== void 0) map.set(CoseKeyParameter.KeyId, stringToBytes(options.keyId));
+		if (options.algorithm !== void 0) map.set(CoseKeyParameter.Algorithm, options.algorithm);
+		if (options.keyOps !== void 0) map.set(CoseKeyParameter.KeyOps, options.keyOps);
+		if (options.baseIv !== void 0) map.set(CoseKeyParameter.BaseIv, options.baseIv);
+		if (options.curve !== void 0) map.set(CoseKeyParameter.CurveOrK, options.curve);
+		if (options.x !== void 0) map.set(CoseKeyParameter.X, options.x);
+		if (options.y !== void 0) map.set(CoseKeyParameter.Y, options.y);
+		if (options.d !== void 0) map.set(CoseKeyParameter.D, options.d);
+		if (options.k !== void 0) map.set(CoseKeyParameter.CurveOrK, options.k);
+		return this.fromDecodedStructure(map);
+	}
+	static fromJwk(jwk) {
+		if (!("kty" in jwk)) throw new CoseInvalidValueForKtyError("JWK does not contain required kty value");
+		const options = Object.entries(jwk).reduce((prev, [key, value]) => {
+			const mappedKey = jwkCoseOptionsMap[key] ?? key;
+			const mapFunction = jwkToCoseKey[key];
+			const convertedValue = mapFunction ? mapFunction(value) : value;
+			if (convertedValue !== void 0) return {
+				...prev,
+				[mappedKey]: convertedValue
+			};
+			return prev;
+		}, {});
+		return this.create(options);
+	}
+	get publicKey() {
+		if (this.keyType !== KeyType.Ec) throw new CoseInvalidKtyForRawError();
+		if (!this.x) throw new CoseXNotDefinedError();
+		if (!this.y) throw new CoseYNotDefinedError();
+		return concatBytes([
+			Uint8Array.from([4]),
+			this.x,
+			this.y
+		]);
+	}
+	get privateKey() {
+		if (this.keyType === KeyType.Ec) {
+			if (!this.d) throw new CoseDNotDefinedError();
+			return this.d;
+		}
+		if (this.keyType === KeyType.Oct) {
+			if (!this.k) throw new CoseKNotDefinedError();
+			return this.k;
+		}
+		throw new CoseKeyTypeNotSupportedForPrivateKeyExtractionError();
+	}
+	get jwk() {
+		const options = {
+			keyType: this.keyType,
+			keyId: this.keyId,
+			algorithm: this.algorithm,
+			keyOps: this.keyOps,
+			baseIv: this.baseIv,
+			curve: this.curve,
+			x: this.x,
+			y: this.y,
+			d: this.d,
+			k: this.k
+		};
+		return Object.entries(options).reduce((prev, [key, value]) => ({
+			...prev,
+			[coseOptionsJwkMap[key] ?? key]: typeof coseKeyToJwk[key] === "function" ? coseKeyToJwk[key](value) : void 0
+		}), {});
+	}
+};
+
+//#endregion
+//#region src/mdoc/models/ble-options.ts
+var BleOptionsKeys = /* @__PURE__ */ function(BleOptionsKeys) {
+	BleOptionsKeys[BleOptionsKeys["PeripheralServerMode"] = 0] = "PeripheralServerMode";
+	BleOptionsKeys[BleOptionsKeys["CentralClientMode"] = 1] = "CentralClientMode";
+	BleOptionsKeys[BleOptionsKeys["PeripheralServerModeUuid"] = 10] = "PeripheralServerModeUuid";
+	BleOptionsKeys[BleOptionsKeys["CentralClientModeUuid"] = 11] = "CentralClientModeUuid";
+	BleOptionsKeys[BleOptionsKeys["PeripheralServerModeDeviceAddress"] = 20] = "PeripheralServerModeDeviceAddress";
+	return BleOptionsKeys;
+}(BleOptionsKeys || {});
+const bleOptionsSchema = typedMap([
+	[BleOptionsKeys.PeripheralServerMode, z.boolean()],
+	[BleOptionsKeys.CentralClientMode, z.boolean()],
+	[BleOptionsKeys.PeripheralServerModeUuid, zUint8Array.exactOptional()],
+	[BleOptionsKeys.CentralClientModeUuid, zUint8Array.exactOptional()],
+	[BleOptionsKeys.PeripheralServerModeDeviceAddress, zUint8Array.exactOptional()]
+]);
+var BleOptions = class extends CborStructure {
+	static get encodingSchema() {
+		return bleOptionsSchema;
+	}
+	get peripheralServerMode() {
+		return this.structure.get(BleOptionsKeys.PeripheralServerMode);
+	}
+	get centralClientMode() {
+		return this.structure.get(BleOptionsKeys.CentralClientMode);
+	}
+	get peripheralServerModeUuid() {
+		return this.structure.get(BleOptionsKeys.PeripheralServerModeUuid);
+	}
+	get centralClientModeUuid() {
+		return this.structure.get(BleOptionsKeys.CentralClientModeUuid);
+	}
+	get peripheralServerModeDeviceAddress() {
+		return this.structure.get(BleOptionsKeys.PeripheralServerModeDeviceAddress);
+	}
+	static create(options) {
+		const map = new Map([[BleOptionsKeys.PeripheralServerMode, options.peripheralServerMode], [BleOptionsKeys.CentralClientMode, options.centralClientMode]]);
+		if (options.peripheralServerModeUuid !== void 0) map.set(BleOptionsKeys.PeripheralServerModeUuid, options.peripheralServerModeUuid);
+		if (options.centralClientModeUuid !== void 0) map.set(BleOptionsKeys.CentralClientModeUuid, options.centralClientModeUuid);
+		if (options.peripheralServerModeDeviceAddress !== void 0) map.set(BleOptionsKeys.PeripheralServerModeDeviceAddress, options.peripheralServerModeDeviceAddress);
+		return this.fromEncodedStructure(map);
+	}
+};
+
+//#endregion
+//#region src/mdoc/models/nfc-options.ts
+var NfcOptionsKeys = /* @__PURE__ */ function(NfcOptionsKeys) {
+	NfcOptionsKeys[NfcOptionsKeys["MaxCommandDataLength"] = 0] = "MaxCommandDataLength";
+	NfcOptionsKeys[NfcOptionsKeys["MaxResponseDataLength"] = 1] = "MaxResponseDataLength";
+	return NfcOptionsKeys;
+}(NfcOptionsKeys || {});
+const nfcOptionsSchema = typedMap([[NfcOptionsKeys.MaxCommandDataLength, z.number()], [NfcOptionsKeys.MaxResponseDataLength, z.number()]]);
+var NfcOptions = class extends CborStructure {
+	static get encodingSchema() {
+		return nfcOptionsSchema;
+	}
+	get maxCommandDataLength() {
+		return this.structure.get(NfcOptionsKeys.MaxCommandDataLength);
+	}
+	get maxResponseDataLength() {
+		return this.structure.get(NfcOptionsKeys.MaxResponseDataLength);
+	}
+	static create(options) {
+		const map = new Map([[NfcOptionsKeys.MaxCommandDataLength, options.maxCommandDataLength], [NfcOptionsKeys.MaxResponseDataLength, options.maxResponseDataLength]]);
+		return this.fromEncodedStructure(map);
+	}
+};
+
+//#endregion
+//#region src/mdoc/models/wifi-options.ts
+var WifiOptionsKeys = /* @__PURE__ */ function(WifiOptionsKeys) {
+	WifiOptionsKeys[WifiOptionsKeys["Passphrase"] = 0] = "Passphrase";
+	WifiOptionsKeys[WifiOptionsKeys["OperatingClass"] = 1] = "OperatingClass";
+	WifiOptionsKeys[WifiOptionsKeys["ChannelNumber"] = 2] = "ChannelNumber";
+	WifiOptionsKeys[WifiOptionsKeys["SupportedBands"] = 3] = "SupportedBands";
+	return WifiOptionsKeys;
+}(WifiOptionsKeys || {});
+const wifiOptionsSchema = typedMap([
+	[WifiOptionsKeys.Passphrase, z.string().exactOptional()],
+	[WifiOptionsKeys.OperatingClass, z.number().exactOptional()],
+	[WifiOptionsKeys.ChannelNumber, z.number().exactOptional()],
+	[WifiOptionsKeys.SupportedBands, zUint8Array.exactOptional()]
+]);
+var WifiOptions = class extends CborStructure {
+	static get encodingSchema() {
+		return wifiOptionsSchema;
+	}
+	get encodedStructure() {
+		return this.structure.toMap();
+	}
+	get passphrase() {
+		return this.structure.get(WifiOptionsKeys.Passphrase);
+	}
+	get channelInfoOperatingClass() {
+		return this.structure.get(WifiOptionsKeys.OperatingClass);
+	}
+	get channelInfoChannelNumber() {
+		return this.structure.get(WifiOptionsKeys.ChannelNumber);
+	}
+	get bandInfoSupportedBands() {
+		return this.structure.get(WifiOptionsKeys.SupportedBands);
+	}
+	static create(options) {
+		const entries = [];
+		if (options.passphrase !== void 0) entries.push([WifiOptionsKeys.Passphrase, options.passphrase]);
+		if (options.channelInfoOperatingClass !== void 0) entries.push([WifiOptionsKeys.OperatingClass, options.channelInfoOperatingClass]);
+		if (options.channelInfoChannelNumber !== void 0) entries.push([WifiOptionsKeys.ChannelNumber, options.channelInfoChannelNumber]);
+		if (options.bandInfoSupportedBands !== void 0) entries.push([WifiOptionsKeys.SupportedBands, options.bandInfoSupportedBands]);
+		const map = new Map(entries);
+		return this.fromEncodedStructure(map);
+	}
+};
+
+//#endregion
+//#region src/mdoc/models/device-retrieval-method.ts
+let DeviceRetrievalMethodType = /* @__PURE__ */ function(DeviceRetrievalMethodType) {
+	DeviceRetrievalMethodType[DeviceRetrievalMethodType["Nfc"] = 1] = "Nfc";
+	DeviceRetrievalMethodType[DeviceRetrievalMethodType["Ble"] = 2] = "Ble";
+	DeviceRetrievalMethodType[DeviceRetrievalMethodType["WifiAware"] = 3] = "WifiAware";
+	return DeviceRetrievalMethodType;
+}({});
+const deviceRetrievalMethodEncodedSchema = z.tuple([
+	z.enum(DeviceRetrievalMethodType).or(z.number()),
+	z.number(),
+	z.map(z.unknown(), z.unknown())
+]);
+const deviceRetrievalMethodDecodedSchema = z.object({
+	type: z.enum(DeviceRetrievalMethodType).or(z.number()),
+	version: z.number(),
+	retrievalOptions: z.union([
+		z.instanceof(NfcOptions),
+		z.instanceof(BleOptions),
+		z.instanceof(WifiOptions),
+		z.map(z.unknown(), z.unknown())
+	])
+});
+var DeviceRetrievalMethod = class extends CborStructure {
+	static get encodingSchema() {
+		return z.codec(deviceRetrievalMethodEncodedSchema, deviceRetrievalMethodDecodedSchema, {
+			decode: ([type, version, retrievalOptions]) => {
+				let options;
+				if (type === DeviceRetrievalMethodType.Nfc) options = NfcOptions.fromEncodedStructure(retrievalOptions);
+				else if (type === DeviceRetrievalMethodType.Ble) options = BleOptions.fromEncodedStructure(retrievalOptions);
+				else if (type === DeviceRetrievalMethodType.WifiAware) options = WifiOptions.fromEncodedStructure(retrievalOptions);
+				else options = retrievalOptions;
+				return {
+					type,
+					version,
+					retrievalOptions: options
+				};
+			},
+			encode: ({ type, version, retrievalOptions }) => [
+				type,
+				version,
+				retrievalOptions instanceof CborStructure ? retrievalOptions.encodedStructure : retrievalOptions
+			]
+		});
+	}
+	get type() {
+		return this.structure.type;
+	}
+	get version() {
+		return this.structure.version;
+	}
+	get retrievalOptions() {
+		return this.structure.retrievalOptions;
+	}
+	static create(options) {
+		return this.fromDecodedStructure({
+			type: options.type,
+			version: options.version,
+			retrievalOptions: options.retrievalOptions
+		});
+	}
+};
+
+//#endregion
+//#region src/mdoc/models/protocol-info.ts
+const protocolInfoSchema = z$1.unknown();
+var ProtocolInfo = class extends CborStructure {
+	static get encodingSchema() {
+		return protocolInfoSchema;
+	}
+};
+
+//#endregion
+//#region src/mdoc/models/e-device-key.ts
+var EDeviceKey = class extends CoseKey {};
+
+//#endregion
+//#region src/mdoc/models/security.ts
+const securityEncodedSchema = z.tuple([z.number(), z.instanceof(DataItem)]);
+const securityDecodedSchema = z.object({
+	cipherSuiteIdentifier: z.number(),
+	eDeviceKey: z.instanceof(EDeviceKey)
+});
+var Security = class extends CborStructure {
+	static get encodingSchema() {
+		return z.codec(securityEncodedSchema, securityDecodedSchema, {
+			decode: (input) => ({
+				cipherSuiteIdentifier: input[0],
+				eDeviceKey: EDeviceKey.fromEncodedStructure(input[1].data)
+			}),
+			encode: (output) => [output.cipherSuiteIdentifier, DataItem.fromData(output.eDeviceKey.encodedStructure)]
+		});
+	}
+	get cipherSuiteIdentifier() {
+		return this.structure.cipherSuiteIdentifier;
+	}
+	get eDeviceKey() {
+		return this.structure.eDeviceKey;
+	}
+	static create(options) {
+		return this.fromDecodedStructure({
+			cipherSuiteIdentifier: options.cipherSuiteIdentifier,
+			eDeviceKey: options.eDeviceKey
+		});
+	}
+};
+
+//#endregion
+//#region src/mdoc/models/oidc.ts
+const oidcEncodedSchema = z.tuple([
+	z.number(),
+	z.string(),
+	z.string()
+]);
+const oidcDecodedSchema = z.object({
+	version: z.number(),
+	issuerUrl: z.string(),
+	serverRetrievalToken: z.string()
+});
+var Oidc = class Oidc extends CborStructure {
+	static get encodingSchema() {
+		return z.codec(oidcEncodedSchema, oidcDecodedSchema, {
+			decode: ([version, issuerUrl, serverRetrievalToken]) => ({
+				version,
+				issuerUrl,
+				serverRetrievalToken
+			}),
+			encode: ({ version, issuerUrl, serverRetrievalToken }) => [
+				version,
+				issuerUrl,
+				serverRetrievalToken
+			]
+		});
+	}
+	get version() {
+		return this.structure.version;
+	}
+	get issuerUrl() {
+		return this.structure.issuerUrl;
+	}
+	get serverRetrievalToken() {
+		return this.structure.serverRetrievalToken;
+	}
+	static create(options) {
+		return new Oidc({
+			version: options.version,
+			issuerUrl: options.issuerUrl,
+			serverRetrievalToken: options.serverRetrievalToken
+		});
+	}
+};
+
+//#endregion
+//#region src/mdoc/models/web-api.ts
+const webApiEncodedSchema = z.tuple([
+	z.number(),
+	z.string(),
+	z.string()
+]);
+const webApiDecodedSchema = z.object({
+	version: z.number(),
+	issuerUrl: z.string(),
+	serverRetrievalToken: z.string()
+});
+var WebApi = class extends CborStructure {
+	static get encodingSchema() {
+		return z.codec(webApiEncodedSchema, webApiDecodedSchema, {
+			encode: ({ version, issuerUrl, serverRetrievalToken }) => [
+				version,
+				issuerUrl,
+				serverRetrievalToken
+			],
+			decode: ([version, issuerUrl, serverRetrievalToken]) => ({
+				version,
+				issuerUrl,
+				serverRetrievalToken
+			})
+		});
+	}
+	get version() {
+		return this.structure.version;
+	}
+	get issuerUrl() {
+		return this.structure.issuerUrl;
+	}
+	get serverRetrievalToken() {
+		return this.structure.serverRetrievalToken;
+	}
+	static create(options) {
+		return this.fromDecodedStructure(options);
+	}
+};
+
+//#endregion
+//#region src/mdoc/models/server-retrieval-method.ts
+const serverRetrievalMethodSchema = typedMap([["webApi", z.instanceof(WebApi).exactOptional()], ["oidc", z.instanceof(Oidc).exactOptional()]]);
+var ServerRetrievalMethod = class extends CborStructure {
+	static get encodingSchema() {
+		return z.codec(serverRetrievalMethodSchema.in, serverRetrievalMethodSchema.out, {
+			decode: (input) => {
+				const map = TypedMap.fromMap(input);
+				if (input.has("webApi")) map.set("webApi", WebApi.fromEncodedStructure(input.get("webApi")));
+				if (input.has("oidc")) map.set("oidc", Oidc.fromEncodedStructure(input.get("oidc")));
+				return map;
+			},
+			encode: (output) => {
+				const map = output.toMap();
+				const webApi = output.get("webApi");
+				if (webApi) map.set("webApi", webApi.encodedStructure);
+				const oidc = output.get("oidc");
+				if (oidc) map.set("oidc", oidc.encodedStructure);
+				return map;
+			}
+		});
+	}
+	get webApi() {
+		return this.structure.get("webApi");
+	}
+	get oidc() {
+		return this.structure.get("oidc");
+	}
+	static create(options) {
+		const map = new TypedMap([]);
+		if (options.webApi) map.set("webApi", options.webApi);
+		if (options.oidc) map.set("oidc", options.oidc);
+		return this.fromDecodedStructure(map);
+	}
+};
+
+//#endregion
+//#region src/mdoc/models/device-engagement.ts
+var DeviceEngagementKeys = /* @__PURE__ */ function(DeviceEngagementKeys) {
+	DeviceEngagementKeys[DeviceEngagementKeys["Version"] = 0] = "Version";
+	DeviceEngagementKeys[DeviceEngagementKeys["Security"] = 1] = "Security";
+	DeviceEngagementKeys[DeviceEngagementKeys["DeviceRetrievalMethods"] = 2] = "DeviceRetrievalMethods";
+	DeviceEngagementKeys[DeviceEngagementKeys["ServerRetrievalMethods"] = 3] = "ServerRetrievalMethods";
+	DeviceEngagementKeys[DeviceEngagementKeys["ProtocolInfo"] = 4] = "ProtocolInfo";
+	return DeviceEngagementKeys;
+}(DeviceEngagementKeys || {});
+const deviceEngagementSchema = typedMap([
+	[DeviceEngagementKeys.Version, z.string()],
+	[DeviceEngagementKeys.Security, z.instanceof(Security)],
+	[DeviceEngagementKeys.DeviceRetrievalMethods, z.array(z.instanceof(DeviceRetrievalMethod)).exactOptional()],
+	[DeviceEngagementKeys.ServerRetrievalMethods, z.array(z.instanceof(ServerRetrievalMethod)).exactOptional()],
+	[DeviceEngagementKeys.ProtocolInfo, z.instanceof(ProtocolInfo).exactOptional()]
+]);
+var DeviceEngagement = class extends CborStructure {
+	static get encodingSchema() {
+		return z.codec(deviceEngagementSchema.in, deviceEngagementSchema.out, {
+			decode: (input) => {
+				const map = TypedMap.fromMap(input);
+				map.set(DeviceEngagementKeys.Security, Security.fromEncodedStructure(input.get(DeviceEngagementKeys.Security)));
+				if (input.has(DeviceEngagementKeys.DeviceRetrievalMethods)) {
+					const deviceMethods = input.get(DeviceEngagementKeys.DeviceRetrievalMethods);
+					map.set(DeviceEngagementKeys.DeviceRetrievalMethods, deviceMethods.map((encoded) => DeviceRetrievalMethod.fromEncodedStructure(encoded)));
+				}
+				if (input.has(DeviceEngagementKeys.ServerRetrievalMethods)) {
+					const serverMethods = input.get(DeviceEngagementKeys.ServerRetrievalMethods);
+					map.set(DeviceEngagementKeys.ServerRetrievalMethods, serverMethods.map((encoded) => ServerRetrievalMethod.fromEncodedStructure(encoded)));
+				}
+				if (input.has(DeviceEngagementKeys.ProtocolInfo)) map.set(DeviceEngagementKeys.ProtocolInfo, ProtocolInfo.fromEncodedStructure(input.get(DeviceEngagementKeys.ProtocolInfo)));
+				return map;
+			},
+			encode: (output) => {
+				const map = output.toMap();
+				map.set(DeviceEngagementKeys.Security, output.get(DeviceEngagementKeys.Security).encodedStructure);
+				const deviceRetrievalMethods = output.get(DeviceEngagementKeys.DeviceRetrievalMethods);
+				if (deviceRetrievalMethods) map.set(DeviceEngagementKeys.DeviceRetrievalMethods, deviceRetrievalMethods.map((drm) => drm.encodedStructure));
+				const serverRetrievalMethods = output.get(DeviceEngagementKeys.ServerRetrievalMethods);
+				if (serverRetrievalMethods) map.set(DeviceEngagementKeys.ServerRetrievalMethods, serverRetrievalMethods.map((srm) => srm.encodedStructure));
+				const protocolInfo = output.get(DeviceEngagementKeys.ProtocolInfo);
+				if (protocolInfo) map.set(DeviceEngagementKeys.ProtocolInfo, protocolInfo.encodedStructure);
+				return map;
+			}
+		});
+	}
+	get version() {
+		return this.structure.get(DeviceEngagementKeys.Version);
+	}
+	get security() {
+		return this.structure.get(DeviceEngagementKeys.Security);
+	}
+	get deviceRetrievalMethods() {
+		return this.structure.get(DeviceEngagementKeys.DeviceRetrievalMethods);
+	}
+	get serverRetrievalMethods() {
+		return this.structure.get(DeviceEngagementKeys.ServerRetrievalMethods);
+	}
+	get protocolInfo() {
+		return this.structure.get(DeviceEngagementKeys.ProtocolInfo);
+	}
+	static create(options) {
+		const map = new Map([[DeviceEngagementKeys.Version, options.version], [DeviceEngagementKeys.Security, options.security]]);
+		if (options.deviceRetrievalMethods !== void 0) map.set(DeviceEngagementKeys.DeviceRetrievalMethods, options.deviceRetrievalMethods);
+		if (options.serverRetrievalMethods !== void 0) map.set(DeviceEngagementKeys.ServerRetrievalMethods, options.serverRetrievalMethods);
+		if (options.protocolInfo !== void 0) map.set(DeviceEngagementKeys.ProtocolInfo, options.protocolInfo);
+		return this.fromEncodedStructure(map);
+	}
+};
+
+//#endregion
+//#region src/mdoc/models/e-reader-key.ts
+var EReaderKey = class extends CoseKey {};
+
+//#endregion
+//#region src/mdoc/models/handover.ts
+var Handover = class extends CborStructure {
+	static tryDecodeHandover(structure) {
+		try {
+			return new this(this.fromEncodedStructure(structure).decodedStructure);
+		} catch {
+			return null;
+		}
+	}
+	/**
+	* Whether this handover structure requires a reader key. Can
+	* be overridden in extending handover classes.
+	*/
+	get requiresReaderKey() {
+		return false;
+	}
+	/**
+	* Whether this handover structure requires device engagement structure. Can
+	* be overridden in extending handover classes.
+	*/
+	get requiresDeviceEngagement() {
+		return false;
+	}
+};
+
+//#endregion
+//#region src/mdoc/models/nfc-handover.ts
+const nfcHandoverEncodedSchema = z$1.tuple([zUint8Array, zUint8Array.nullable()]);
+const nfcHandoverDecodedSchema = z$1.object({
+	selectMessage: zUint8Array,
+	requestMessage: zUint8Array.nullable()
+});
+var NfcHandover = class extends Handover {
+	static get encodingSchema() {
+		return z$1.codec(nfcHandoverEncodedSchema, nfcHandoverDecodedSchema, {
+			encode: ({ selectMessage, requestMessage }) => [selectMessage, requestMessage],
+			decode: ([selectMessage, requestMessage]) => ({
+				selectMessage,
+				requestMessage
+			})
+		});
+	}
+	get selectMessage() {
+		return this.structure.selectMessage;
+	}
+	get requestMessage() {
+		return this.structure.requestMessage;
+	}
+	static create(options) {
+		return this.fromDecodedStructure({
+			requestMessage: options.requestMessage ?? null,
+			selectMessage: options.selectMessage
+		});
+	}
+	get requiresReaderKey() {
+		return true;
+	}
+	get requiresDeviceEngagement() {
+		return true;
+	}
+};
+
+//#endregion
+//#region src/mdoc/models/oid4vp-dc-api-draft24-handover-info.ts
+const oid4vpDcApiDraft24HandoverInfoSchema = z$1.tuple([
+	z$1.string(),
+	z$1.string(),
+	z$1.string()
+]);
+const oid4vpDcApiDraft24HandoverInfoDecodedSchema = z$1.object({
+	origin: z$1.string(),
+	clientId: z$1.string(),
+	nonce: z$1.string()
+});
+var Oid4vpDcApiDraft24HandoverInfo = class extends CborStructure {
+	static get encodingSchema() {
+		return z$1.codec(oid4vpDcApiDraft24HandoverInfoSchema, oid4vpDcApiDraft24HandoverInfoDecodedSchema, {
+			encode: ({ origin, clientId, nonce }) => [
+				origin,
+				clientId,
+				nonce
+			],
+			decode: ([origin, clientId, nonce]) => ({
+				origin,
+				clientId,
+				nonce
+			})
+		});
+	}
+	get origin() {
+		return this.structure.origin;
+	}
+	get clientId() {
+		return this.structure.clientId;
+	}
+	get nonce() {
+		return this.structure.nonce;
+	}
+	static create(options) {
+		return this.fromDecodedStructure({
+			origin: options.origin,
+			clientId: options.clientId,
+			nonce: options.nonce
+		});
+	}
+};
+
+//#endregion
+//#region src/mdoc/models/oid4vp-dc-api-handover.ts
+const oid4vpDcApiHandoverEncodedSchema = z$1.tuple([z$1.literal("OpenID4VPDCAPIHandover"), zUint8Array]);
+const oid4vpDcApiHandoverDecodedSchema = zUint8Array;
+var Oid4vpDcApiHandover = class extends Handover {
+	static get encodingSchema() {
+		return z$1.codec(oid4vpDcApiHandoverEncodedSchema, oid4vpDcApiHandoverDecodedSchema, {
+			encode: (handoverInfoHash) => ["OpenID4VPDCAPIHandover", handoverInfoHash],
+			decode: ([, handoverInfoHash]) => handoverInfoHash
+		});
+	}
+	static createFromHash(oid4vpDcApiHandoverInfoHash) {
+		return this.fromDecodedStructure(oid4vpDcApiHandoverInfoHash);
+	}
+	static async create(options, ctx) {
+		const oid4vpDcApiHandoverInfoHash = await ctx.crypto.digest({
+			digestAlgorithm: "SHA-256",
+			bytes: options.oid4vpDcApiHandoverInfo.encode()
+		});
+		return this.fromDecodedStructure(oid4vpDcApiHandoverInfoHash);
+	}
+};
+
+//#endregion
+//#region src/mdoc/models/oid4vp-dc-api-handover-info.ts
+const oid4vpDcApiHandoverInfoEncodedSchema = z$1.tuple([
+	z$1.string(),
+	z$1.string(),
+	zUint8Array.nullable()
+]);
+const oid4vpDcApiHandoverInfoDecodedSchema = z$1.object({
+	origin: z$1.string(),
+	nonce: z$1.string(),
+	jwkThumbprint: zUint8Array.nullable()
+});
+var Oid4vpDcApiHandoverInfo = class extends CborStructure {
+	static get encodingSchema() {
+		return z$1.codec(oid4vpDcApiHandoverInfoEncodedSchema, oid4vpDcApiHandoverInfoDecodedSchema, {
+			encode: ({ origin, nonce, jwkThumbprint }) => [
+				origin,
+				nonce,
+				jwkThumbprint
+			],
+			decode: ([origin, nonce, jwkThumbprint]) => ({
+				origin,
+				nonce,
+				jwkThumbprint
+			})
+		});
+	}
+	get origin() {
+		return this.structure.origin;
+	}
+	get nonce() {
+		return this.structure.nonce;
+	}
+	get jwkThumbprint() {
+		return this.structure.jwkThumbprint;
+	}
+	static create(options) {
+		return this.fromDecodedStructure({
+			origin: options.origin,
+			nonce: options.nonce,
+			jwkThumbprint: options.jwkThumbprint ?? null
+		});
+	}
+};
+
+//#endregion
+//#region src/mdoc/models/oid4vp-draft18-handover.ts
+const oid4vpDraft18HandoverEncodedSchema = z$1.tuple([
+	zUint8Array,
+	zUint8Array,
+	z$1.string()
+]);
+const oid4vpDraft18HandoverDecodedSchema = z$1.object({
+	clientIdHash: zUint8Array,
+	responseUriHash: zUint8Array,
+	nonce: z$1.string()
+});
+var Oid4vpDraft18Handover = class extends Handover {
+	static get encodingSchema() {
+		return z$1.codec(oid4vpDraft18HandoverEncodedSchema, oid4vpDraft18HandoverDecodedSchema, {
+			encode: ({ clientIdHash, responseUriHash, nonce }) => [
+				clientIdHash,
+				responseUriHash,
+				nonce
+			],
+			decode: ([clientIdHash, responseUriHash, nonce]) => ({
+				clientIdHash,
+				responseUriHash,
+				nonce
+			})
+		});
+	}
+	static async create(options, ctx) {
+		const clientIdHash = await ctx.crypto.digest({
+			digestAlgorithm: "SHA-256",
+			bytes: cborEncode([options.clientId, options.mdocGeneratedNonce])
+		});
+		const responseUriHash = await ctx.crypto.digest({
+			digestAlgorithm: "SHA-256",
+			bytes: cborEncode([options.responseUri, options.mdocGeneratedNonce])
+		});
+		return this.fromDecodedStructure({
+			clientIdHash,
+			responseUriHash,
+			nonce: options.nonce
+		});
+	}
+};
+
+//#endregion
+//#region src/mdoc/models/oid4vp-handover.ts
+const oid4vpHandoverEncodedSchema = z$1.tuple([z$1.literal("OpenID4VPHandover"), zUint8Array]);
+const oid4vpHandoverDecodedSchema = zUint8Array;
+var Oid4vpHandover = class extends Handover {
+	static get encodingSchema() {
+		return z$1.codec(oid4vpHandoverEncodedSchema, oid4vpHandoverDecodedSchema, {
+			encode: (handoverInfoHash) => ["OpenID4VPHandover", handoverInfoHash],
+			decode: ([, handoverInfoHash]) => handoverInfoHash
+		});
+	}
+	get handoverInfoHash() {
+		return this.structure;
+	}
+	static createFromHash(oid4vpHandoverInfoHash) {
+		return this.fromDecodedStructure(oid4vpHandoverInfoHash);
+	}
+	static async create(options, ctx) {
+		const oid4vpHandoverInfoHash = await ctx.crypto.digest({
+			digestAlgorithm: "SHA-256",
+			bytes: options.oid4vpHandoverInfo.encode()
+		});
+		return this.fromDecodedStructure(oid4vpHandoverInfoHash);
+	}
+};
+
+//#endregion
+//#region src/mdoc/models/oid4vp-handover-info.ts
+const oid4vpHandoverInfoEncodedSchema = z$1.tuple([
+	z$1.string(),
+	z$1.string(),
+	zUint8Array.nullable(),
+	z$1.string()
+]);
+const oid4vpHandoverInfoDecodedSchema = z$1.object({
+	clientId: z$1.string(),
+	nonce: z$1.string(),
+	jwkThumbprint: zUint8Array.nullable(),
+	responseUri: z$1.string()
+});
+var Oid4vpHandoverInfo = class extends CborStructure {
+	static get encodingSchema() {
+		return z$1.codec(oid4vpHandoverInfoEncodedSchema, oid4vpHandoverInfoDecodedSchema, {
+			encode: ({ clientId, nonce, jwkThumbprint, responseUri }) => [
+				clientId,
+				nonce,
+				jwkThumbprint,
+				responseUri
+			],
+			decode: ([clientId, nonce, jwkThumbprint, responseUri]) => ({
+				clientId,
+				nonce,
+				jwkThumbprint,
+				responseUri
+			})
+		});
+	}
+	get clientId() {
+		return this.structure.clientId;
+	}
+	get nonce() {
+		return this.structure.nonce;
+	}
+	get jwkThumbprint() {
+		return this.structure.jwkThumbprint;
+	}
+	get responseUri() {
+		return this.structure.responseUri;
+	}
+	static create(options) {
+		return this.fromDecodedStructure({
+			clientId: options.clientId,
+			nonce: options.nonce,
+			jwkThumbprint: options.jwkThumbprint ?? null,
+			responseUri: options.responseUri
+		});
+	}
+};
+
+//#endregion
+//#region src/mdoc/models/oid4vp-iae-handover.ts
+const oid4vpIaeHandoverEncodedSchema = z$1.tuple([z$1.literal("OpenID4VCIIAEHandover"), zUint8Array]);
+const oid4vpIaeHandoverDecodedSchema = zUint8Array;
+var Oid4vpIaeHandover = class extends Handover {
+	static get encodingSchema() {
+		return z$1.codec(oid4vpIaeHandoverEncodedSchema, oid4vpIaeHandoverDecodedSchema, {
+			encode: (handoverInfoHash) => ["OpenID4VCIIAEHandover", handoverInfoHash],
+			decode: ([, handoverInfoHash]) => handoverInfoHash
+		});
+	}
+	static createFromHash(oid4vpIaeHandoverInfoHash) {
+		return this.fromDecodedStructure(oid4vpIaeHandoverInfoHash);
+	}
+	static async create(options, ctx) {
+		const oid4vpIaeHandoverInfoHash = await ctx.crypto.digest({
+			digestAlgorithm: "SHA-256",
+			bytes: options.oid4vpIaeHandoverInfo.encode()
+		});
+		return this.fromDecodedStructure(oid4vpIaeHandoverInfoHash);
+	}
+};
+
+//#endregion
+//#region src/mdoc/models/oid4vp-iae-handover-info.ts
+const oid4vpIaeHandoverInfoEncodedSchema = z$1.tuple([
+	z$1.string(),
+	z$1.string(),
+	zUint8Array.nullable()
+]);
+const oid4vpIaeHandoverInfoDecodedSchema = z$1.object({
+	interactiveAuthorizationEndpoint: z$1.string(),
+	nonce: z$1.string(),
+	jwkThumbprint: zUint8Array.nullable()
+});
+var Oid4vpIaeHandoverInfo = class extends CborStructure {
+	static get encodingSchema() {
+		return z$1.codec(oid4vpIaeHandoverInfoEncodedSchema, oid4vpIaeHandoverInfoDecodedSchema, {
+			encode: ({ interactiveAuthorizationEndpoint, nonce, jwkThumbprint }) => [
+				interactiveAuthorizationEndpoint,
+				nonce,
+				jwkThumbprint
+			],
+			decode: ([interactiveAuthorizationEndpoint, nonce, jwkThumbprint]) => ({
+				interactiveAuthorizationEndpoint,
+				nonce,
+				jwkThumbprint
+			})
+		});
+	}
+	get interactiveAuthorizationEndpoint() {
+		return this.structure.interactiveAuthorizationEndpoint;
+	}
+	get nonce() {
+		return this.structure.nonce;
+	}
+	get jwkThumbprint() {
+		return this.structure.jwkThumbprint;
+	}
+	static create(options) {
+		return this.fromDecodedStructure({
+			interactiveAuthorizationEndpoint: options.interactiveAuthorizationEndpoint,
+			nonce: options.nonce,
+			jwkThumbprint: options.jwkThumbprint ?? null
+		});
+	}
+};
+
+//#endregion
+//#region src/mdoc/models/qr-handover.ts
+const qrHandoverSchema = z$1.null();
+var QrHandover = class extends Handover {
+	static get encodingSchema() {
+		return qrHandoverSchema;
+	}
+	get requiresReaderKey() {
+		return true;
+	}
+	get requiresDeviceEngagement() {
+		return true;
+	}
+	static create() {
+		return this.fromDecodedStructure(null);
+	}
+};
+
+//#endregion
+//#region src/mdoc/models/session-transcript.ts
+const supportedHandoverStructures = [
+	Oid4vpHandover,
+	Oid4vpDcApiHandover,
+	Oid4vpIaeHandover,
+	NfcHandover,
+	QrHandover,
+	Oid4vpDraft18Handover
+];
+const sessionTranscriptEncodedSchema = z.tuple([
+	z.instanceof(DataItem).nullable(),
+	z.instanceof(DataItem).nullable(),
+	z.unknown()
+]);
+const sessionTranscriptDecodedSchema = z.object({
+	deviceEngagement: z.instanceof(DeviceEngagement).nullable(),
+	eReaderKey: z.instanceof(EReaderKey).nullable(),
+	handover: z.instanceof(Handover)
+});
+var SessionTranscript = class extends CborStructure {
+	static get encodingSchema() {
+		return z.codec(sessionTranscriptEncodedSchema, sessionTranscriptDecodedSchema, {
+			decode: ([deviceEngagementDataItem, eReaderKeyDataItem, handoverData]) => {
+				let handover = null;
+				for (const HandoverStructure of supportedHandoverStructures) {
+					handover = HandoverStructure.tryDecodeHandover(handoverData);
+					if (handover) break;
+				}
+				if (!handover) throw new Error("Could not establish handover structure for session transcript");
+				return {
+					deviceEngagement: deviceEngagementDataItem ? DeviceEngagement.fromEncodedStructure(deviceEngagementDataItem.data) : null,
+					eReaderKey: eReaderKeyDataItem ? EReaderKey.fromEncodedStructure(eReaderKeyDataItem.data) : null,
+					handover
+				};
+			},
+			encode: ({ deviceEngagement, eReaderKey, handover }) => {
+				if (handover.requiresDeviceEngagement && !deviceEngagement) throw new Error(`Session transcript has no deviceEngagement but ${handover.constructor.name} handover requires deviceEngagement`);
+				if (!handover.requiresDeviceEngagement && deviceEngagement) throw new Error(`Session transcript has deviceEngagement but ${handover.constructor.name} handover does not expect deviceEngagement.`);
+				if (handover.requiresReaderKey && !eReaderKey) throw new Error(`Session transcript has no eReaderKey but ${handover.constructor.name} handover requires eReaderKey`);
+				if (!handover.requiresReaderKey && eReaderKey) throw new Error(`Session transcript has eReaderKey but ${handover.constructor.name} handover does not expect eReaderKey.`);
+				return [
+					deviceEngagement ? DataItem.fromData(deviceEngagement.encodedStructure) : null,
+					eReaderKey ? DataItem.fromData(eReaderKey.encodedStructure) : null,
+					handover.encodedStructure
+				];
+			}
+		});
+	}
+	get deviceEngagement() {
+		return this.structure.deviceEngagement;
+	}
+	get eReaderKey() {
+		return this.structure.eReaderKey;
+	}
+	get handover() {
+		return this.structure.handover;
+	}
+	static create(options) {
+		return this.fromDecodedStructure({
+			deviceEngagement: options.deviceEngagement ?? null,
+			eReaderKey: options.eReaderKey ?? null,
+			handover: options.handover
+		});
+	}
+	/**
+	* Create a SessionTranscript for QR handover (ISO 18013-5 proximity presentation).
+	*
+	* For QR handover, exact CBOR bytes matter for session key derivation.
+	* Use DeviceEngagement.decode() and EReaderKey.decode() to preserve original bytes -
+	* calling encode() on decoded objects will return the identical bytes.
+	*/
+	static forQrHandover(options) {
+		return this.fromDecodedStructure({
+			deviceEngagement: options.deviceEngagement,
+			eReaderKey: options.eReaderKey,
+			handover: QrHandover.create()
+		});
+	}
+	static async forOid4VpDcApiDraft24(options, ctx) {
+		const info = Oid4vpDcApiDraft24HandoverInfo.create(options);
+		const handover = await Oid4vpDcApiHandover.create({ oid4vpDcApiHandoverInfo: info }, ctx);
+		return this.fromDecodedStructure({
+			deviceEngagement: null,
+			eReaderKey: null,
+			handover
+		});
+	}
+	static async forOid4VpDcApi(options, ctx) {
+		const info = Oid4vpDcApiHandoverInfo.create(options);
+		const handover = await Oid4vpDcApiHandover.create({ oid4vpDcApiHandoverInfo: info }, ctx);
+		return this.fromDecodedStructure({
+			deviceEngagement: null,
+			eReaderKey: null,
+			handover
+		});
+	}
+	static async forOid4VpIae(options, ctx) {
+		const info = Oid4vpIaeHandoverInfo.create(options);
+		const handover = await Oid4vpIaeHandover.create({ oid4vpIaeHandoverInfo: info }, ctx);
+		return this.fromDecodedStructure({
+			deviceEngagement: null,
+			eReaderKey: null,
+			handover
+		});
+	}
+	static async forOid4Vp(options, ctx) {
+		const info = Oid4vpHandoverInfo.create(options);
+		const handover = await Oid4vpHandover.create({ oid4vpHandoverInfo: info }, ctx);
+		return this.fromDecodedStructure({
+			deviceEngagement: null,
+			eReaderKey: null,
+			handover
+		});
+	}
+	/**
+	* Calculate the session transcript bytes as defined in 18013-7 first edition, based
+	* on OpenID4VP draft 18.
+	*/
+	static async forOid4VpDraft18(options, ctx) {
+		const handover = await Oid4vpDraft18Handover.create({
+			clientId: options.clientId,
+			nonce: options.verifierGeneratedNonce,
+			mdocGeneratedNonce: options.mdocGeneratedNonce,
+			responseUri: options.responseUri
+		}, ctx);
+		return this.fromDecodedStructure({
+			deviceEngagement: null,
+			eReaderKey: null,
+			handover
+		});
+	}
+};
+
+//#endregion
+//#region src/cose/mac0.ts
+const mac0EncodedSchema = z.tuple([
+	zUint8Array,
+	z.map(z.unknown(), z.unknown()),
+	zUint8Array.nullable(),
+	zUint8Array
+]);
+const mac0DecodedSchema = z.object({
+	protectedHeaders: z.instanceof(ProtectedHeaders),
+	unprotectedHeaders: z.instanceof(UnprotectedHeaders),
+	payload: zUint8Array.nullable(),
+	tag: zUint8Array
+});
+var Mac0 = class Mac0 extends CborStructure {
+	static {
+		this.tag = 17;
+	}
+	static get encodingSchema() {
+		return z.codec(mac0EncodedSchema, mac0DecodedSchema, {
+			decode: ([protectedHeadersBytes, unprotectedHeadersMap, payload, tag]) => ({
+				protectedHeaders: ProtectedHeaders.fromEncodedStructure(protectedHeadersBytes),
+				unprotectedHeaders: UnprotectedHeaders.fromEncodedStructure(unprotectedHeadersMap),
+				payload,
+				tag
+			}),
+			encode: ({ protectedHeaders, unprotectedHeaders, payload, tag }) => [
+				protectedHeaders.encodedStructure,
+				unprotectedHeaders.encodedStructure,
+				payload,
+				tag
+			]
+		});
+	}
+	get protectedHeaders() {
+		return this.structure.protectedHeaders;
+	}
+	get unprotectedHeaders() {
+		return this.structure.unprotectedHeaders;
+	}
+	get payload() {
+		return this.structure.payload;
+	}
+	get tag() {
+		return this.structure.tag;
+	}
+	get toBeAuthenticated() {
+		const payload = this.payload ?? this.detachedPayload;
+		if (!payload) throw new CosePayloadMustBeDefinedError();
+		return Mac0.toBeAuthenticated({
+			payload,
+			protectedHeaders: this.protectedHeaders,
+			externalAad: this.externalAad
+		});
+	}
+	/**
+	* Decodes CBOR bytes into a Sign1 instance.
+	* Uses the encodingSchema's decode() method to validate and transform the decoded data.
+	*/
+	static decode(bytes) {
+		const rawStructure = cborDecode(bytes);
+		return new this(rawStructure instanceof Mac0 ? rawStructure.decodedStructure : this.fromEncodedStructure(rawStructure).decodedStructure);
+	}
+	static toBeAuthenticated(options) {
+		const toBeAuthenticated = ["MAC0", options.protectedHeaders.encodedStructure];
+		if (options.externalAad) toBeAuthenticated.push(options.externalAad);
+		toBeAuthenticated.push(options.payload);
+		return cborEncode(toBeAuthenticated);
+	}
+	get signatureAlgorithmName() {
+		const algorithm = this.protectedHeaders.headers?.get(Header.Algorithm) ?? this.unprotectedHeaders.headers?.get(Header.Algorithm);
+		if (!algorithm) throw new CoseInvalidAlgorithmError();
+		const algorithmName = coseKeyToJwk.algorithm(algorithm);
+		if (!algorithmName) throw new CoseInvalidAlgorithmError();
+		return algorithmName;
+	}
+	static async create(options, ctx) {
+		const protectedHeaders = options.protectedHeaders instanceof ProtectedHeaders ? options.protectedHeaders : ProtectedHeaders.create({ protectedHeaders: options.protectedHeaders });
+		const unprotectedHeaders = options.unprotectedHeaders instanceof UnprotectedHeaders ? options.unprotectedHeaders : UnprotectedHeaders.create({ unprotectedHeaders: options.unprotectedHeaders });
+		const ephemeralMacKey = await ctx.crypto.calculateEphemeralMacKey({
+			privateKey: options.privateKey.encode(),
+			publicKey: options.ephemeralKey.encode(),
+			sessionTranscriptBytes: options.sessionTranscript instanceof SessionTranscript ? options.sessionTranscript.encode({ asDataItem: true }) : options.sessionTranscript,
+			info: "EMacKey"
+		});
+		const payload = options.payload ?? options.detachedPayload;
+		if (!payload) throw new CosePayloadMustBeDefinedError();
+		const tag = await ctx.cose.mac0.sign({
+			toBeAuthenticated: Mac0.toBeAuthenticated({
+				payload,
+				protectedHeaders,
+				externalAad: options.externalAad
+			}),
+			key: ephemeralMacKey
+		});
+		const mac0 = this.fromDecodedStructure({
+			protectedHeaders,
+			unprotectedHeaders,
+			payload: options.payload ?? null,
+			tag
+		});
+		mac0.externalAad = options.externalAad;
+		mac0.detachedPayload = options.detachedPayload;
+		return mac0;
+	}
+};
+addExtension$1({
+	Class: Mac0,
+	tag: Mac0.tag,
+	encode(instance, encodeFn) {
+		return encodeFn(instance.encodedStructure);
+	},
+	decode: (encoded) => Mac0.fromEncodedStructure(encoded)
+});
+
+//#endregion
+//#region src/cose/sign1.ts
+const sign1EncodedSchema = z$1.tuple([
+	protectedHeadersEncodedStructure,
+	unprotectedHeadersStructure,
+	zUint8Array.nullable(),
+	zUint8Array
+]);
+const sign1DecodedSchema = z$1.object({
+	protected: z$1.instanceof(ProtectedHeaders),
+	unprotected: z$1.instanceof(UnprotectedHeaders),
+	payload: sign1EncodedSchema.def.items[2],
+	signature: sign1EncodedSchema.def.items[3]
+});
+var Sign1 = class Sign1 extends CborStructure {
+	static {
+		this.tag = 18;
+	}
+	static get encodingSchema() {
+		return z$1.codec(sign1EncodedSchema, sign1DecodedSchema, {
+			encode: (decoded) => [
+				decoded.protected.encodedStructure,
+				decoded.unprotected.encodedStructure,
+				decoded.payload,
+				decoded.signature
+			],
+			decode: ([protectedHeaders, unprotected, payload, signature]) => ({
+				protected: ProtectedHeaders.fromEncodedStructure(protectedHeaders),
+				unprotected: UnprotectedHeaders.fromEncodedStructure(unprotected),
+				payload,
+				signature
+			})
+		});
+	}
+	get protectedHeaders() {
+		return this.structure.protected;
+	}
+	get unprotectedHeaders() {
+		return this.structure.unprotected;
+	}
+	get payload() {
+		return this.structure.payload;
+	}
+	get signature() {
+		return this.structure.signature;
+	}
+	get certificateChain() {
+		return this.x5chain ?? [];
+	}
+	get certificate() {
+		const [certificate] = this.certificateChain;
+		if (!certificate) throw new CoseCertificateNotFoundError();
+		return certificate;
+	}
+	getIssuingCountry(ctx) {
+		return ctx.x509.getIssuerNameField({
+			certificate: this.certificate,
+			field: "C"
+		})[0];
+	}
+	getIssuingStateOrProvince(ctx) {
+		return ctx.x509.getIssuerNameField({
+			certificate: this.certificate,
+			field: "ST"
+		})[0];
+	}
+	get toBeSigned() {
+		const payload = this.payload ?? this.detachedPayload;
+		if (!payload) throw new CosePayloadMustBeDefinedError();
+		return Sign1.toBeSigned({
+			payload,
+			protectedHeaders: this.protectedHeaders,
+			externalAad: this.externalAad
+		});
+	}
+	/**
+	* Decodes CBOR bytes into a Sign1 instance.
+	* Uses the encodingSchema's decode() method to validate and transform the decoded data.
+	*/
+	static decode(bytes) {
+		const rawStructure = cborDecode(bytes);
+		return new this(rawStructure instanceof Sign1 ? rawStructure.decodedStructure : this.fromEncodedStructure(rawStructure).decodedStructure);
+	}
+	static toBeSigned(options) {
+		return cborEncode([
+			"Signature1",
+			options.protectedHeaders.encodedStructure,
+			options.externalAad ?? new Uint8Array(),
+			options.payload
+		]);
+	}
+	get signatureAlgorithmName() {
+		const algorithm = this.protectedHeaders.headers?.get(Header.Algorithm) ?? this.unprotectedHeaders.headers?.get(Header.Algorithm);
+		if (!algorithm) throw new CoseInvalidAlgorithmError();
+		const algorithmName = coseKeyToJwk.algorithm(algorithm);
+		if (!algorithmName) throw new CoseInvalidAlgorithmError();
+		return algorithmName;
+	}
+	get x5chain() {
+		const x5chain = this.protectedHeaders.headers?.get(Header.X5Chain) ?? this.unprotectedHeaders.headers?.get(Header.X5Chain);
+		if (!x5chain?.[0]) return;
+		return Array.isArray(x5chain) ? x5chain : [x5chain];
+	}
+	async verifySignature(options, ctx) {
+		const publicKey = options.key ?? await ctx.x509.getPublicKey({
+			certificate: this.certificate,
+			alg: this.signatureAlgorithmName
+		});
+		return await ctx.cose.sign1.verify({
+			sign1: this,
+			key: publicKey
+		});
+	}
+	static async create(options, ctx) {
+		const payload = options.payload ?? options.detachedPayload;
+		if (!payload) throw new CosePayloadMustBeDefinedError();
+		const protectedHeaders = options.protectedHeaders instanceof ProtectedHeaders ? options.protectedHeaders : options.protectedHeaders ? ProtectedHeaders.fromDecodedStructure(options.protectedHeaders) : ProtectedHeaders.create({});
+		const signature = await ctx.cose.sign1.sign({
+			toBeSigned: Sign1.toBeSigned({
+				payload,
+				protectedHeaders,
+				externalAad: options.externalAad
+			}),
+			key: options.signingKey
+		});
+		const sign1 = this.fromDecodedStructure({
+			payload: options.payload ?? null,
+			protected: protectedHeaders,
+			unprotected: options.unprotectedHeaders instanceof UnprotectedHeaders ? options.unprotectedHeaders : options.unprotectedHeaders ? UnprotectedHeaders.fromEncodedStructure(options.unprotectedHeaders) : UnprotectedHeaders.create({}),
+			signature
+		});
+		sign1.detachedPayload = options.detachedPayload;
+		sign1.externalAad = options.externalAad;
+		return sign1;
+	}
+};
+addExtension$1({
+	Class: Sign1,
+	tag: Sign1.tag,
+	encode(instance, encodeFn) {
+		return encodeFn(instance);
+	},
+	decode: (encoded) => Sign1.fromEncodedStructure(encoded)
+});
+
+//#endregion
+//#region src/mdoc/errors.ts
+var MdlError = class extends Error {
+	constructor(message = new.target.name) {
+		super(message);
+	}
+};
+var MdlParseError = class extends MdlError {};
+var PresentationDefinitionOrDocRequestsAreRequiredError = class extends MdlError {};
+var SessionTranscriptOrSessionTranscriptBytesAreRequiredError = class extends MdlError {};
+var DuplicateNamespaceInIssuerNamespacesError = class extends MdlError {};
+var DuplicateDocumentInDeviceResponseError = class extends MdlError {};
+var EitherSignatureOrMacMustBeProvidedError = class extends MdlError {};
+
+//#endregion
+//#region src/mdoc/check-callback.ts
+const defaultVerificationCallback = (verification) => {
+	if (verification.status !== "FAILED") return;
+	throw new MdlError(verification.reason ?? verification.check);
+};
+const onCategoryCheck = (onCheck, category) => {
+	return (item) => {
+		onCheck({
+			...item,
+			category
+		});
+	};
+};
+
+//#endregion
+//#region src/mdoc/models/device-signed-items.ts
+const deviceSignedItemsSchema = z.map(z.string(), z.unknown());
+var DeviceSignedItems = class extends CborStructure {
+	static get encodingSchema() {
+		return deviceSignedItemsSchema;
+	}
+	get deviceSignedItems() {
+		return this.structure;
+	}
+	static create(options) {
+		return this.fromEncodedStructure(options.deviceSignedItems);
+	}
+};
+
+//#endregion
+//#region src/mdoc/models/device-namespaces.ts
+const deviceNamespacesEncodedSchema = z.map(z.string(), deviceSignedItemsSchema);
+const deviceNamespacesDecodedSchema = z.map(z.string(), z.instanceof(DeviceSignedItems));
+var DeviceNamespaces = class extends CborStructure {
+	static get encodingSchema() {
+		return z.codec(deviceNamespacesEncodedSchema, deviceNamespacesDecodedSchema, {
+			decode: (input) => {
+				const deviceNamespaces = /* @__PURE__ */ new Map();
+				input.forEach((value, key) => {
+					deviceNamespaces.set(key, DeviceSignedItems.fromEncodedStructure(value));
+				});
+				return deviceNamespaces;
+			},
+			encode: (output) => {
+				const map = /* @__PURE__ */ new Map();
+				output.forEach((value, key) => {
+					map.set(key, value.encodedStructure);
+				});
+				return map;
+			}
+		});
+	}
+	get deviceNamespaces() {
+		return this.structure;
+	}
+	static create(options) {
+		return this.fromDecodedStructure(options.deviceNamespaces);
+	}
+};
+
+//#endregion
+//#region src/mdoc/models/device-authentication.ts
+const deviceAuthenticationEncodedSchema = z.tuple([
+	z.literal("DeviceAuthentication"),
+	sessionTranscriptEncodedSchema,
+	z.string(),
+	z.instanceof(DataItem)
+]);
+const deviceAuthenticationDecodedSchema = z.object({
+	sessionTranscript: z.instanceof(SessionTranscript),
+	docType: z.string(),
+	deviceNamespaces: z.instanceof(DeviceNamespaces)
+});
+var DeviceAuthentication = class extends CborStructure {
+	static get encodingSchema() {
+		return z.codec(deviceAuthenticationEncodedSchema, deviceAuthenticationDecodedSchema, {
+			decode: ([, sessionTranscript, docType, deviceNamespacesDataItem]) => ({
+				sessionTranscript: SessionTranscript.fromEncodedStructure(sessionTranscript),
+				docType,
+				deviceNamespaces: DeviceNamespaces.fromEncodedStructure(deviceNamespacesDataItem.data)
+			}),
+			encode: ({ sessionTranscript, docType, deviceNamespaces }) => [
+				"DeviceAuthentication",
+				sessionTranscript.encodedStructure,
+				docType,
+				DataItem.fromData(deviceNamespaces.encodedStructure)
+			]
+		});
+	}
+	get sessionTranscript() {
+		return this.structure.sessionTranscript;
+	}
+	get docType() {
+		return this.structure.docType;
+	}
+	get deviceNamespaces() {
+		return this.structure.deviceNamespaces;
+	}
+	static create(options) {
+		const sessionTranscript = options.sessionTranscript instanceof SessionTranscript ? options.sessionTranscript : SessionTranscript.decode(options.sessionTranscript);
+		return this.fromDecodedStructure({
+			sessionTranscript,
+			docType: options.docType,
+			deviceNamespaces: options.deviceNamespaces
+		});
+	}
+};
+
+//#endregion
+//#region src/mdoc/models/device-mac.ts
+var DeviceMac = class extends Mac0 {
+	async verify(options, ctx) {
+		const key = await ctx.crypto.calculateEphemeralMacKey({
+			privateKey: options.privateKey.privateKey,
+			publicKey: options.publicKey.publicKey,
+			sessionTranscriptBytes: options.sessionTranscript instanceof SessionTranscript ? options.sessionTranscript.encode({ asDataItem: true }) : options.sessionTranscript,
+			info: options.info ?? "EMacKey"
+		});
+		return ctx.cose.mac0.verify({
+			mac0: this,
+			key
+		});
+	}
+	static async create(options, ctx) {
+		return super.create(options, ctx);
+	}
+};
+
+//#endregion
+//#region src/mdoc/models/device-signature.ts
+var DeviceSignature = class extends Sign1 {
+	static create(options, ctx) {
+		return super.create(options, ctx);
+	}
+};
+
+//#endregion
+//#region src/mdoc/models/device-auth.ts
+const deviceAuthSchema = typedMap([["deviceSignature", z.instanceof(DeviceSignature).exactOptional()], ["deviceMac", z.instanceof(DeviceMac).exactOptional()]]).refine((map) => [map.get("deviceMac"), map.get("deviceSignature")].filter((i) => i !== void 0).length === 1, { error: () => "deviceAuth must contain either a deviceMac or deviceSignature, but not both or neither" });
+var DeviceAuth = class extends CborStructure {
+	static get encodingSchema() {
+		return z.codec(deviceAuthSchema.in, deviceAuthSchema.out, {
+			decode: (input) => {
+				const map = TypedMap.fromMap(input);
+				if (input.has("deviceSignature")) map.set("deviceSignature", DeviceSignature.fromEncodedStructure(input.get("deviceSignature")));
+				if (input.has("deviceMac")) map.set("deviceMac", DeviceMac.fromEncodedStructure(input.get("deviceMac")));
+				return map;
+			},
+			encode: (output) => {
+				const map = output.toMap();
+				const deviceSignature = output.get("deviceSignature");
+				if (deviceSignature) map.set("deviceSignature", deviceSignature.encodedStructure);
+				const deviceMac = output.get("deviceMac");
+				if (deviceMac) map.set("deviceMac", deviceMac.encodedStructure);
+				return map;
+			}
+		});
+	}
+	get deviceSignature() {
+		return this.structure.get("deviceSignature");
+	}
+	get deviceMac() {
+		return this.structure.get("deviceMac");
+	}
+	async verify(options, ctx) {
+		const onCheck = onCategoryCheck(options.verificationCallback ?? defaultVerificationCallback, "DEVICE_AUTH");
+		const { deviceKey } = options.document.issuerSigned.issuerAuth.mobileSecurityObject.deviceKeyInfo;
+		const deviceMac = this.structure.get("deviceMac");
+		const deviceSignature = this.structure.get("deviceSignature");
+		if (!deviceMac && !deviceSignature) {
+			onCheck({
+				status: "FAILED",
+				check: "Device Auth must contain a deviceSignature or deviceMac element"
+			});
+			return;
+		}
+		const deviceAuthenticationBytes = DeviceAuthentication.create({
+			sessionTranscript: options.sessionTranscript,
+			docType: options.document.docType,
+			deviceNamespaces: options.document.deviceSigned.deviceNamespaces
+		}).encode({ asDataItem: true });
+		if (deviceSignature) {
+			try {
+				deviceSignature.detachedPayload = deviceAuthenticationBytes;
+				onCheck({
+					status: await ctx.cose.sign1.verify({
+						sign1: deviceSignature,
+						key: deviceKey
+					}) ? "PASSED" : "FAILED",
+					check: "Device signature must be valid"
+				});
+			} catch (err) {
+				onCheck({
+					status: "FAILED",
+					check: "Device signature must be valid",
+					reason: `Unable to verify deviceAuth signature (ECDSA/EdDSA): ${err instanceof Error ? err.message : "Unknown error"}`
+				});
+			}
+			return;
+		}
+		if (deviceMac) {
+			if (deviceMac.signatureAlgorithmName !== MacAlgorithm.HS256) {
+				onCheck({
+					status: "FAILED",
+					check: "Device MAC must use alg 5 (HMAC 256/256)"
+				});
+				return;
+			}
+			onCheck({
+				status: options.ephemeralMacPrivateKey ? "PASSED" : "FAILED",
+				check: "Ephemeral private key must be present when using MAC authentication"
+			});
+			if (!options.ephemeralMacPrivateKey) return;
+			try {
+				deviceMac.detachedPayload = deviceAuthenticationBytes;
+				onCheck({
+					status: await deviceMac.verify({
+						publicKey: deviceKey,
+						privateKey: options.ephemeralMacPrivateKey,
+						sessionTranscript: options.sessionTranscript,
+						info: "EMacKey"
+					}, ctx) ? "PASSED" : "FAILED",
+					check: "Device MAC must be valid"
+				});
+			} catch (err) {
+				onCheck({
+					status: "FAILED",
+					check: "Device MAC must be valid",
+					reason: `Unable to verify deviceAuth MAC: ${err instanceof Error ? err.message : "Unknown error"}`
+				});
+			}
+		}
+		onCheck({
+			status: "FAILED",
+			check: "No Device Signature or Device Mac found on Device Auth",
+			reason: "No Device Signature or Device Mac found on Device Auth"
+		});
+	}
+	static create(options) {
+		const map = new TypedMap([]);
+		if (options.deviceSignature) map.set("deviceSignature", options.deviceSignature);
+		if (options.deviceMac) map.set("deviceMac", options.deviceMac);
+		return this.fromDecodedStructure(map);
+	}
+};
+
+//#endregion
+//#region src/mdoc/models/device-key.ts
+var DeviceKey = class extends CoseKey {};
+
+//#endregion
+//#region src/mdoc/models/key-authorizations.ts
+const keyAuthorizationsSchema = typedMap([["nameSpaces", z.array(z.string()).exactOptional()], ["dataElements", z.map(z.string(), z.array(z.string())).exactOptional()]]);
+var KeyAuthorizations = class extends CborStructure {
+	static get encodingSchema() {
+		return keyAuthorizationsSchema;
+	}
+	get namespaces() {
+		return this.structure.get("nameSpaces");
+	}
+	get dataElements() {
+		return this.structure.get("dataElements");
+	}
+	static create(options) {
+		const map = new TypedMap([]);
+		if (options.namespaces !== void 0) map.set("nameSpaces", options.namespaces);
+		if (options.dataElements !== void 0) map.set("dataElements", options.dataElements);
+		return this.fromDecodedStructure(map);
+	}
+};
+
+//#endregion
+//#region src/mdoc/models/key-info.ts
+const keyInfoSchema = z.map(z.number(), z.unknown());
+var KeyInfo = class extends CborStructure {
+	static get encodingSchema() {
+		return keyInfoSchema;
+	}
+	get keyInfo() {
+		return this.structure;
+	}
+	static create(options) {
+		return this.fromEncodedStructure(options.keyInfo);
+	}
+};
+
+//#endregion
+//#region src/mdoc/models/device-key-info.ts
+const deviceKeyInfoSchema = typedMap([
+	["deviceKey", z.instanceof(DeviceKey)],
+	["keyAuthorizations", z.instanceof(KeyAuthorizations).exactOptional()],
+	["keyInfo", z.instanceof(KeyInfo).exactOptional()]
+]);
+var DeviceKeyInfo = class extends CborStructure {
+	static get encodingSchema() {
+		return z.codec(deviceKeyInfoSchema.in, deviceKeyInfoSchema.out, {
+			decode: (input) => {
+				const map = TypedMap.fromMap(input);
+				map.set("deviceKey", DeviceKey.fromEncodedStructure(input.get("deviceKey")));
+				if (input.has("keyAuthorizations")) map.set("keyAuthorizations", KeyAuthorizations.fromEncodedStructure(input.get("keyAuthorizations")));
+				if (input.has("keyInfo")) map.set("keyInfo", KeyInfo.fromEncodedStructure(input.get("keyInfo")));
+				return map;
+			},
+			encode: (output) => {
+				const map = output.toMap();
+				map.set("deviceKey", output.get("deviceKey").encodedStructure);
+				const keyAuthorizations = output.get("keyAuthorizations");
+				if (keyAuthorizations) map.set("keyAuthorizations", keyAuthorizations.encodedStructure);
+				const keyInfo = output.get("keyInfo");
+				if (keyInfo) map.set("keyInfo", keyInfo.encodedStructure);
+				return map;
+			}
+		});
+	}
+	get deviceKey() {
+		return this.structure.get("deviceKey");
+	}
+	get keyAuthorizations() {
+		return this.structure.get("keyAuthorizations");
+	}
+	get keyInfo() {
+		return this.structure.get("keyInfo");
+	}
+	static create(options) {
+		const map = new TypedMap([["deviceKey", options.deviceKey]]);
+		if (options.keyAuthorizations) map.set("keyAuthorizations", options.keyAuthorizations);
+		if (options.keyInfo) map.set("keyInfo", options.keyInfo);
+		return this.fromDecodedStructure(map);
+	}
+};
+
+//#endregion
+//#region src/mdoc/models/items-request.ts
+const namespacesSchema = z.map(z.string(), z.map(z.string(), z.boolean()));
+const itemsRequestSchema = typedMap([["docType", z.string()], ["nameSpaces", namespacesSchema]]);
+var ItemsRequest = class extends CborStructure {
+	static get encodingSchema() {
+		return itemsRequestSchema;
+	}
+	get docType() {
+		return this.structure.get("docType");
+	}
+	get namespaces() {
+		return this.structure.get("nameSpaces");
+	}
+	static create(options) {
+		const namespaces = options.namespaces instanceof Map ? options.namespaces : new Map(Object.entries(options.namespaces).map(([ns, inner]) => [ns, new Map(Object.entries(inner))]));
+		const structure = new Map([["docType", options.docType], ["nameSpaces", namespaces]]);
+		return this.fromEncodedStructure(structure);
+	}
+};
+
+//#endregion
+//#region src/mdoc/models/reader-authentication.ts
+const readerAuthenticationEncodedSchema = z.tuple([
+	z.literal("ReaderAuthentication"),
+	sessionTranscriptEncodedSchema,
+	z.instanceof(DataItem)
+]);
+const readerAuthenticationDecodedSchema = z.object({
+	sessionTranscript: z.instanceof(SessionTranscript),
+	itemsRequest: z.instanceof(ItemsRequest)
+});
+var ReaderAuthentication = class extends CborStructure {
+	static get encodingSchema() {
+		return z.codec(readerAuthenticationEncodedSchema, readerAuthenticationDecodedSchema, {
+			decode: ([, sessionTranscript, itemsRequestDataItem]) => ({
+				sessionTranscript: SessionTranscript.fromEncodedStructure(sessionTranscript),
+				itemsRequest: ItemsRequest.fromEncodedStructure(itemsRequestDataItem.data)
+			}),
+			encode: ({ sessionTranscript, itemsRequest }) => [
+				"ReaderAuthentication",
+				sessionTranscript.encodedStructure,
+				DataItem.fromData(itemsRequest.encodedStructure)
+			]
+		});
+	}
+	get sessionTranscript() {
+		return this.structure.sessionTranscript;
+	}
+	get itemsRequest() {
+		return this.structure.itemsRequest;
+	}
+	static create(options) {
+		return this.fromDecodedStructure({
+			sessionTranscript: options.sessionTranscript,
+			itemsRequest: options.itemsRequest
+		});
+	}
+};
+
+//#endregion
+//#region src/mdoc/models/reader-auth.ts
+var ReaderAuth = class extends Sign1 {
+	async verify(options, ctx) {
+		const readerAuthentication = options.readerAuthentication instanceof ReaderAuthentication ? options.readerAuthentication : new ReaderAuthentication(options.readerAuthentication);
+		const onCheck = onCategoryCheck(options.verificationCallback ?? defaultVerificationCallback, "READER_AUTH");
+		this.detachedPayload = readerAuthentication.encode({ asDataItem: true });
+		onCheck({
+			status: await this.verifySignature({}, ctx) ? "PASSED" : "FAILED",
+			check: "Signature is invalid on the reader auth",
+			reason: "Signature is invalid on the reader auth"
+		});
+	}
+	static create(options, ctx) {
+		return super.create(options, ctx);
+	}
+};
+
+//#endregion
+//#region src/mdoc/models/doc-request.ts
+const docRequestSchema = typedMap([["itemsRequest", z.instanceof(ItemsRequest)], ["readerAuth", z.instanceof(ReaderAuth).exactOptional()]]);
+var DocRequest = class extends CborStructure {
+	static get encodingSchema() {
+		return z.codec(docRequestSchema.in, docRequestSchema.out, {
+			decode: (input) => {
+				const map = TypedMap.fromMap(input);
+				const itemsRequestData = input.get("itemsRequest");
+				map.set("itemsRequest", ItemsRequest.fromEncodedStructure(itemsRequestData.data));
+				if (input.has("readerAuth")) map.set("readerAuth", ReaderAuth.fromEncodedStructure(input.get("readerAuth")));
+				return map;
+			},
+			encode: (output) => {
+				const map = output.toMap();
+				map.set("itemsRequest", DataItem.fromData(output.get("itemsRequest").encodedStructure));
+				const readerAuth = output.get("readerAuth");
+				if (readerAuth) map.set("readerAuth", readerAuth.encodedStructure);
+				return map;
+			}
+		});
+	}
+	get itemsRequest() {
+		return this.structure.get("itemsRequest");
+	}
+	get readerAuth() {
+		return this.structure.get("readerAuth");
+	}
+	static create(options) {
+		const map = new TypedMap([["itemsRequest", options.itemsRequest]]);
+		if (options.readerAuth) map.set("readerAuth", options.readerAuth);
+		return this.fromDecodedStructure(map);
+	}
+};
+
+//#endregion
+//#region src/mdoc/models/device-request.ts
+const deviceRequestSchema = typedMap([["version", z.string()], ["docRequests", z.array(z.instanceof(DocRequest))]]);
+var DeviceRequest = class extends CborStructure {
+	static get encodingSchema() {
+		return z.codec(deviceRequestSchema.in, deviceRequestSchema.out, {
+			decode: (input) => {
+				const map = TypedMap.fromMap(input);
+				const docRequests = input.get("docRequests");
+				map.set("docRequests", docRequests.map((dr) => DocRequest.fromEncodedStructure(dr)));
+				return map;
+			},
+			encode: (output) => {
+				const map = output.toMap();
+				map.set("docRequests", output.get("docRequests").map((dr) => dr.encodedStructure));
+				return map;
+			}
+		});
+	}
+	get version() {
+		return this.structure.get("version");
+	}
+	get docRequests() {
+		return this.structure.get("docRequests");
+	}
+	static create(options) {
+		const map = new TypedMap([["version", options.version ?? "1.0"], ["docRequests", options.docRequests]]);
+		return this.fromDecodedStructure(map);
+	}
+};
+
+//#endregion
+//#region src/utils/findIssuerSigned.ts
+const findIssuerSigned = (is, docType) => {
+	const issuerSigned = is.filter((i) => i.issuerAuth.mobileSecurityObject.docType === docType);
+	if (!issuerSigned || !issuerSigned[0]) throw new Error(`No Issuer Signed matching docType '${docType}'`);
+	if (issuerSigned.length > 1) throw new Error(`Multiple Issuer Signed matching docType '${docType}'`);
+	return issuerSigned[0];
+};
+
+//#endregion
+//#region src/mdoc/models/issuer-signed-item.ts
+const issuerSignedItemSchema = typedMap([
+	["digestID", z.number()],
+	["random", zUint8Array],
+	["elementIdentifier", z.string()],
+	["elementValue", z.unknown()]
+]);
+var IssuerSignedItem = class extends CborStructure {
+	static get encodingSchema() {
+		return issuerSignedItemSchema;
+	}
+	get random() {
+		return this.structure.get("random");
+	}
+	get elementIdentifier() {
+		return this.structure.get("elementIdentifier");
+	}
+	get elementValue() {
+		return this.structure.get("elementValue");
+	}
+	get digestId() {
+		return this.structure.get("digestID");
+	}
+	async isValid(namespace, issuerAuth, ctx) {
+		const digest = await ctx.crypto.digest({
+			digestAlgorithm: issuerAuth.mobileSecurityObject.digestAlgorithm,
+			bytes: this.encode({ asDataItem: true })
+		});
+		const digests = issuerAuth.mobileSecurityObject.valueDigests.valueDigests.get(namespace);
+		if (!digests) return false;
+		const expectedDigest = digests.get(this.digestId);
+		return expectedDigest !== void 0 && compareBytes(digest, expectedDigest);
+	}
+	matchCertificate(issuerAuth, ctx) {
+		if (this.elementIdentifier === "issuing_country") return this.elementValue === issuerAuth.getIssuingCountry(ctx);
+		if (this.elementIdentifier === "issuing_jurisdiction") return this.elementValue === issuerAuth.getIssuingStateOrProvince(ctx);
+		return false;
+	}
+	static fromOptions(options) {
+		const map = new Map([
+			["digestID", options.digestId],
+			["random", options.random],
+			["elementIdentifier", options.elementIdentifier],
+			["elementValue", options.elementValue]
+		]);
+		return this.fromEncodedStructure(map);
+	}
+};
+
+//#endregion
+//#region src/mdoc/models/issuer-namespaces.ts
+const issuerNamespacesEncodedSchema = z$1.map(z$1.string(), z$1.array(z$1.instanceof(DataItem)));
+const issuerNamespacesDecodedSchema = z$1.map(z$1.string(), z$1.array(z$1.instanceof(IssuerSignedItem)));
+var IssuerNamespaces = class extends CborStructure {
+	static get encodingSchema() {
+		return z$1.codec(issuerNamespacesEncodedSchema, issuerNamespacesDecodedSchema, {
+			decode: (encoded) => {
+				const issuerNamespaces = /* @__PURE__ */ new Map();
+				encoded.forEach((value, key) => {
+					issuerNamespaces.set(key, value.map((isi) => IssuerSignedItem.fromEncodedStructure(isi.data)));
+				});
+				return issuerNamespaces;
+			},
+			encode: (decoded) => {
+				const issuerNamespaces = /* @__PURE__ */ new Map();
+				decoded.forEach((value, key) => {
+					issuerNamespaces.set(key, value.map((isi) => DataItem.fromData(isi.encodedStructure)));
+				});
+				return issuerNamespaces;
+			}
+		});
+	}
+	get issuerNamespaces() {
+		return this.structure;
+	}
+	getIssuerNamespace(namespace) {
+		return this.structure.get(namespace);
+	}
+	setIssuerNamespace(namespace, issuerSignedItems) {
+		return this.structure.set(namespace, issuerSignedItems);
+	}
+	static create(options) {
+		return this.fromDecodedStructure(options.issuerNamespaces);
+	}
+};
+
+//#endregion
+//#region src/utils/limitDisclosure.ts
+const limitDisclosureToDeviceRequestNameSpaces = (issuerSigned, docRequest) => {
+	const issuerNamespaces = /* @__PURE__ */ new Map();
+	for (const [namespace, nameSpaceFields] of docRequest.itemsRequest.namespaces.entries()) {
+		const nsAttrs = issuerSigned.issuerNamespaces?.issuerNamespaces.get(namespace) ?? [];
+		const issuerSignedItems = Array.from(nameSpaceFields.entries()).map(([elementIdentifier, _]) => {
+			const issuerSignedItem = prepareIssuerSignedItem(elementIdentifier, nsAttrs);
+			if (!issuerSignedItem) throw new Error(`No matching field found for '${elementIdentifier}'`);
+			return issuerSignedItem;
+		});
+		issuerNamespaces.set(namespace, issuerSignedItems);
+	}
+	return IssuerNamespaces.create({ issuerNamespaces });
+};
+const prepareIssuerSignedItem = (elementIdentifier, nsAttrs) => {
+	if (elementIdentifier.startsWith("age_over_")) return handleAgeOverNN(elementIdentifier, nsAttrs);
+	return nsAttrs.find((d) => d.elementIdentifier === elementIdentifier) ?? null;
+};
+const handleAgeOverNN = (request, attributes) => {
+	const ageOverList = attributes.map((a, i) => {
+		const { elementIdentifier: key, elementValue: value } = a;
+		return {
+			key,
+			value,
+			index: i
+		};
+	}).filter((i) => i.key.startsWith("age_over_")).map((i) => ({
+		nn: Number.parseInt(i.key.replace("age_over_", ""), 10),
+		...i
+	})).sort((a, b) => a.nn - b.nn);
+	const reqNN = Number.parseInt(request.replace("age_over_", ""), 10);
+	let item;
+	item = ageOverList.find((i) => i.value === true && i.nn >= reqNN);
+	if (!item) item = ageOverList.sort((a, b) => b.nn - a.nn).find((i) => i.value === false && i.nn <= reqNN);
+	if (!item) return null;
+	return attributes[item.index];
+};
+
+//#endregion
+//#region src/utils/verifyDocRequestsWithIssuerSigned.ts
+const verifyDocRequestsWithIssuerSigned = (docRequests, is) => {
+	for (const docRequest of docRequests) {
+		const issuerSigned = findIssuerSigned(is, docRequest.itemsRequest.docType);
+		for (const [namespace, values] of docRequest.itemsRequest.namespaces) {
+			const issuerSignedItems = issuerSigned.getIssuerNamespace(namespace);
+			if (!issuerSignedItems) throw new Error(`Could not find issuer namespace for the requested namespace '${namespace}'`);
+			for (const identifier of values.keys()) if (!issuerSignedItems.find((isi) => isi.elementIdentifier === identifier)) throw new Error(`Found issuer namespace '${namespace}', but could not find the element for identifier '${identifier}'`);
+		}
+	}
+};
+
+//#endregion
+//#region src/mdoc/models/device-signed.ts
+const deviceSignedSchema = typedMap([["nameSpaces", z.instanceof(DeviceNamespaces)], ["deviceAuth", z.instanceof(DeviceAuth)]]);
+var DeviceSigned = class extends CborStructure {
+	static get encodingSchema() {
+		return z.codec(deviceSignedSchema.in, deviceSignedSchema.out, {
+			decode: (input) => {
+				const map = TypedMap.fromMap(input);
+				const nameSpaces = input.get("nameSpaces");
+				map.set("nameSpaces", DeviceNamespaces.fromEncodedStructure(nameSpaces.data));
+				map.set("deviceAuth", DeviceAuth.fromEncodedStructure(input.get("deviceAuth")));
+				return map;
+			},
+			encode: (output) => {
+				const map = output.toMap();
+				map.set("nameSpaces", DataItem.fromData(output.get("nameSpaces").encodedStructure));
+				map.set("deviceAuth", output.get("deviceAuth").encodedStructure);
+				return map;
+			}
+		});
+	}
+	get deviceNamespaces() {
+		return this.structure.get("nameSpaces");
+	}
+	get deviceAuth() {
+		return this.structure.get("deviceAuth");
+	}
+	static create(options) {
+		const map = new TypedMap([["nameSpaces", options.deviceNamespaces], ["deviceAuth", options.deviceAuth]]);
+		return this.fromDecodedStructure(map);
+	}
+};
+
+//#endregion
+//#region src/mdoc/models/validity-info.ts
+const validityInfoSchema = typedMap([
+	["signed", z.date()],
+	["validFrom", z.date()],
+	["validUntil", z.date()],
+	["expectedUpdate", z.date().exactOptional()]
+]);
+var ValidityInfo = class extends CborStructure {
+	static get encodingSchema() {
+		return validityInfoSchema;
+	}
+	get signed() {
+		return this.structure.get("signed");
+	}
+	get validFrom() {
+		return this.structure.get("validFrom");
+	}
+	get validUntil() {
+		return this.structure.get("validUntil");
+	}
+	get expectedUpdate() {
+		return this.structure.get("expectedUpdate");
+	}
+	isSignedBetweenDates(notBefore, notAfter, skewSeconds = 30) {
+		const skewMs = skewSeconds * 1e3;
+		const notBeforeWithSkew = new Date(notBefore.getTime() - skewMs);
+		const notAfterWithSkew = new Date(notAfter.getTime() + skewMs);
+		return this.signed > notBeforeWithSkew && this.signed < notAfterWithSkew;
+	}
+	isValidUntilAfterNow(now = /* @__PURE__ */ new Date(), skewSeconds = 30) {
+		const skewMs = skewSeconds * 1e3;
+		return new Date(this.validUntil.getTime() + skewMs) >= now;
+	}
+	isValidFromBeforeNow(now = /* @__PURE__ */ new Date(), skewSeconds = 30) {
+		const skewMs = skewSeconds * 1e3;
+		return new Date(this.validFrom.getTime() - skewMs) <= now;
+	}
+	static create(options) {
+		const encodedStructure = new Map([
+			["signed", options.signed],
+			["validFrom", options.validFrom],
+			["validUntil", options.validUntil]
+		]);
+		if (options.expectedUpdate !== void 0) encodedStructure.set("expectedUpdate", options.expectedUpdate);
+		return this.fromEncodedStructure(encodedStructure);
+	}
+};
+
+//#endregion
+//#region src/mdoc/models/value-digests.ts
+const valueDigestsSchema = z.map(z.string(), z.map(z.number(), zUint8Array));
+var ValueDigests = class extends CborStructure {
+	static get encodingSchema() {
+		return valueDigestsSchema;
+	}
+	get valueDigests() {
+		return this.structure;
+	}
+	static create(options) {
+		return this.fromEncodedStructure(options.digests);
+	}
+	getDigestForNamespace(namespace, digestId) {
+		return this.structure.get(namespace)?.get(digestId);
+	}
+	hasDigestForNamespace(namespace, digestId) {
+		return this.structure.get(namespace)?.has(digestId) ?? false;
+	}
+	getNamespaces() {
+		return Array.from(this.structure.keys());
+	}
+	getDigestIdsForNamespace(namespace) {
+		const namespaceDigests = this.structure.get(namespace);
+		if (!namespaceDigests) return [];
+		return Array.from(namespaceDigests.keys());
+	}
+};
+
+//#endregion
+//#region src/mdoc/models/mobile-security-object.ts
+const mobileSecurityObjectSchema = typedMap([
+	["version", z.literal("1.0")],
+	["digestAlgorithm", z.enum([
+		"SHA-256",
+		"SHA-384",
+		"SHA-512"
+	])],
+	["docType", z.string()],
+	["valueDigests", z.instanceof(ValueDigests)],
+	["deviceKeyInfo", z.instanceof(DeviceKeyInfo)],
+	["validityInfo", z.instanceof(ValidityInfo)]
+]);
+var MobileSecurityObject = class extends CborStructure {
+	static get encodingSchema() {
+		return z.codec(mobileSecurityObjectSchema.in, mobileSecurityObjectSchema.out, {
+			decode: (input) => {
+				const map = TypedMap.fromMap(input);
+				map.set("valueDigests", ValueDigests.fromEncodedStructure(input.get("valueDigests")));
+				map.set("deviceKeyInfo", DeviceKeyInfo.fromEncodedStructure(input.get("deviceKeyInfo")));
+				map.set("validityInfo", ValidityInfo.fromEncodedStructure(input.get("validityInfo")));
+				return map;
+			},
+			encode: (output) => {
+				const map = output.toMap();
+				map.set("valueDigests", output.get("valueDigests").encodedStructure);
+				map.set("deviceKeyInfo", output.get("deviceKeyInfo").encodedStructure);
+				map.set("validityInfo", output.get("validityInfo").encodedStructure);
+				return map;
+			}
+		});
+	}
+	get version() {
+		return this.structure.get("version");
+	}
+	get digestAlgorithm() {
+		return this.structure.get("digestAlgorithm");
+	}
+	get docType() {
+		return this.structure.get("docType");
+	}
+	get validityInfo() {
+		return this.structure.get("validityInfo");
+	}
+	get valueDigests() {
+		return this.structure.get("valueDigests");
+	}
+	get deviceKeyInfo() {
+		return this.structure.get("deviceKeyInfo");
+	}
+	static create(options) {
+		const map = new TypedMap([
+			["version", options.version ?? "1.0"],
+			["digestAlgorithm", options.digestAlgorithm],
+			["valueDigests", options.valueDigests],
+			["deviceKeyInfo", options.deviceKeyInfo],
+			["docType", options.docType],
+			["validityInfo", options.validityInfo]
+		]);
+		return this.fromDecodedStructure(map);
+	}
+};
+
+//#endregion
+//#region src/mdoc/models/issuer-auth.ts
+var IssuerAuth = class extends Sign1 {
+	static create(options, ctx) {
+		return super.create({
+			...options,
+			payload: options.payload instanceof MobileSecurityObject ? options.payload.encode({ asDataItem: true }) : options.payload
+		}, ctx);
+	}
+	get mobileSecurityObject() {
+		if (!this.payload) throw new CosePayloadMustBeDefinedError();
+		return zUint8Array.transform((payload) => cborDecode(payload, { unwrapTopLevelDataItem: false })).pipe(z$1.instanceof(DataItem).transform((di) => MobileSecurityObject.fromEncodedStructure(di.data))).parse(this.payload);
+	}
+	async verify(options, ctx) {
+		const verificationCallback = options.verificationCallback ?? defaultVerificationCallback;
+		const now = options.now ?? /* @__PURE__ */ new Date();
+		const disableCertificateChainValidation = options.disableCertificateChainValidation ?? false;
+		const trustedCertificates = options.trustedCertificates ?? [];
+		const skewSeconds = options.skewSeconds ?? 30;
+		const onCheck = onCategoryCheck(verificationCallback, "ISSUER_AUTH");
+		onCheck({
+			status: this.getIssuingCountry(ctx) ? "PASSED" : "FAILED",
+			check: "Country name (C) must be present in the issuer certificate's subject distinguished name"
+		});
+		if (!disableCertificateChainValidation) try {
+			if (!trustedCertificates[0]) throw new Error("No trusted certificates found. Cannot verify issuer signature.");
+			await ctx.x509.verifyCertificateChain({
+				trustedCertificates,
+				x5chain: this.certificateChain,
+				now
+			});
+			onCheck({
+				status: "PASSED",
+				check: "Issuer certificate must be valid"
+			});
+		} catch (err) {
+			onCheck({
+				status: "FAILED",
+				check: "Issuer certificate must be valid",
+				reason: err instanceof Error ? err.message : "Unknown error"
+			});
+		}
+		onCheck({
+			status: await this.verifySignature({}, ctx) ? "PASSED" : "FAILED",
+			check: "Issuer auth signature is invalid"
+		});
+		const { validityInfo } = this.mobileSecurityObject;
+		const { notAfter, notBefore } = await ctx.x509.getCertificateData({ certificate: this.certificate });
+		onCheck({
+			status: validityInfo.isSignedBetweenDates(notBefore, notAfter, skewSeconds) ? "PASSED" : "FAILED",
+			check: "The MSO signed date must be within the validity period of the certificate",
+			reason: `The MSO signed date (${validityInfo.signed.toUTCString()}) must be within the validity period of the certificate (${notBefore.toUTCString()} to ${notAfter.toUTCString()})`
+		});
+		onCheck({
+			status: validityInfo.isValidFromBeforeNow(now, skewSeconds) && validityInfo.isValidUntilAfterNow(now, skewSeconds) ? "PASSED" : "FAILED",
+			check: "The MSO must be valid at the time of verification",
+			reason: `The MSO must be valid at the time of verification (${now.toUTCString()})`
+		});
+	}
+};
+
+//#endregion
+//#region src/mdoc/models/issuer-signed.ts
+const issuerSignedSchema = typedMap([["nameSpaces", z.instanceof(IssuerNamespaces)], ["issuerAuth", z.instanceof(IssuerAuth)]]);
+var IssuerSigned = class extends CborStructure {
+	static get encodingSchema() {
+		return z.codec(issuerSignedSchema.in, issuerSignedSchema.out, {
+			decode: (input) => {
+				const map = TypedMap.fromMap(input);
+				map.set("nameSpaces", IssuerNamespaces.fromEncodedStructure(input.get("nameSpaces")));
+				map.set("issuerAuth", IssuerAuth.fromEncodedStructure(input.get("issuerAuth")));
+				return map;
+			},
+			encode: (output) => {
+				const map = output.toMap();
+				map.set("nameSpaces", output.get("nameSpaces").encodedStructure);
+				map.set("issuerAuth", output.get("issuerAuth").encodedStructure);
+				return map;
+			}
+		});
+	}
+	get issuerNamespaces() {
+		return this.structure.get("nameSpaces");
+	}
+	get issuerAuth() {
+		return this.structure.get("issuerAuth");
+	}
+	getIssuerNamespace(namespace) {
+		return this.issuerNamespaces.getIssuerNamespace(namespace);
+	}
+	getPrettyClaims(namespace) {
+		const issuerSignedItems = this.getIssuerNamespace(namespace);
+		if (!issuerSignedItems) return void 0;
+		return issuerSignedItems.reduce((prev, curr) => ({
+			...prev,
+			[curr.elementIdentifier]: curr.elementValue
+		}), {});
+	}
+	get encodedForOid4Vci() {
+		return base64url.encode(this.encode());
+	}
+	static fromEncodedForOid4Vci(encoded) {
+		return this.decode(base64url.decode(encoded));
+	}
+	async verify(options, ctx) {
+		const { valueDigests, digestAlgorithm } = this.issuerAuth.mobileSecurityObject;
+		const onCheck = onCategoryCheck(options.verificationCallback ?? defaultVerificationCallback, "DATA_INTEGRITY");
+		onCheck({
+			status: digestAlgorithm ? "PASSED" : "FAILED",
+			check: "Issuer Auth must include a supported digestAlgorithm element"
+		});
+		const namespaces = this.issuerNamespaces?.issuerNamespaces ?? /* @__PURE__ */ new Map();
+		await Promise.all(Array.from(namespaces.entries()).map(async ([ns, nsItems]) => {
+			onCheck({
+				status: valueDigests?.valueDigests.has(ns) ? "PASSED" : "FAILED",
+				check: `Issuer Auth must include digests for namespace: ${ns}`
+			});
+			const verifications = await Promise.all(nsItems.map(async (ev) => {
+				return {
+					ev,
+					ns,
+					isValid: await ev.isValid(ns, this.issuerAuth, ctx)
+				};
+			}));
+			for (const verification of verifications.filter((v) => v.isValid)) onCheck({
+				status: "PASSED",
+				check: `The calculated digest for ${ns}/${verification.ev.elementIdentifier} attribute must match the digest in the issuerAuth element`
+			});
+			for (const verification of verifications.filter((v) => !v.isValid)) onCheck({
+				status: "FAILED",
+				check: `The calculated digest for ${ns}/${verification.ev.elementIdentifier} attribute must match the digest in the issuerAuth element`
+			});
+			if (ns === "org.iso.18013.5.1") if (!(await ctx.x509.getCertificateData({ certificate: this.issuerAuth.certificate })).issuerName) onCheck({
+				status: "FAILED",
+				check: "The 'issuing_country' if present must match the 'countryName' in the subject field within the DS certificate",
+				reason: "The 'issuing_country' and 'issuing_jurisdiction' cannot be verified because the DS certificate was not provided"
+			});
+			else {
+				const invalidCountry = verifications.filter((v) => v.ns === ns && v.ev.elementIdentifier === "issuing_country").find((v) => !v.isValid || !v.ev.matchCertificate(this.issuerAuth, ctx));
+				onCheck({
+					status: invalidCountry ? "FAILED" : "PASSED",
+					check: "The 'issuing_country' if present must match the 'countryName' in the subject field within the DS certificate",
+					reason: invalidCountry ? `The 'issuing_country' (${invalidCountry.ev.elementValue}) must match the 'countryName' (${this.issuerAuth.getIssuingCountry(ctx)}) in the subject field within the issuer certificate` : void 0
+				});
+				const invalidJurisdiction = verifications.filter((v) => v.ns === ns && v.ev.elementIdentifier === "issuing_jurisdiction").find((v) => !v.isValid || !v.ev.matchCertificate(this.issuerAuth, ctx));
+				onCheck({
+					status: invalidJurisdiction ? "FAILED" : "PASSED",
+					check: "The 'issuing_jurisdiction' if present must match the 'stateOrProvinceName' in the subject field within the DS certificate",
+					reason: invalidJurisdiction ? `The 'issuing_jurisdiction' (${invalidJurisdiction.ev.elementValue}) must match the 'stateOrProvinceName' (${this.issuerAuth.getIssuingStateOrProvince(ctx)}) in the subject field within the issuer certificate` : void 0
+				});
+			}
+		}));
+	}
+	static create(options) {
+		const map = new TypedMap([]);
+		if (options.issuerNamespaces) map.set("nameSpaces", options.issuerNamespaces);
+		map.set("issuerAuth", options.issuerAuth);
+		return this.fromDecodedStructure(map);
+	}
+};
+
+//#endregion
+//#region src/mdoc/models/document.ts
+const documentSchema = typedMap([
+	["docType", z.string()],
+	["issuerSigned", z.instanceof(IssuerSigned)],
+	["deviceSigned", z.instanceof(DeviceSigned)],
+	["errors", z.map(z.string(), z.unknown()).exactOptional()]
+]);
+var Document = class extends CborStructure {
+	static get encodingSchema() {
+		return z.codec(documentSchema.in, documentSchema.out, {
+			decode: (input) => {
+				const map = TypedMap.fromMap(input);
+				map.set("issuerSigned", IssuerSigned.fromEncodedStructure(input.get("issuerSigned")));
+				map.set("deviceSigned", DeviceSigned.fromEncodedStructure(input.get("deviceSigned")));
+				if (input.has("errors")) map.set("errors", input.get("errors"));
+				return map;
+			},
+			encode: (output) => {
+				const map = output.toMap();
+				map.set("issuerSigned", output.get("issuerSigned").encodedStructure);
+				map.set("deviceSigned", output.get("deviceSigned").encodedStructure);
+				return map;
+			}
+		});
+	}
+	get docType() {
+		return this.structure.get("docType");
+	}
+	get issuerSigned() {
+		return this.structure.get("issuerSigned");
+	}
+	get deviceSigned() {
+		return this.structure.get("deviceSigned");
+	}
+	get errors() {
+		return this.structure.get("errors");
+	}
+	getIssuerNamespace(namespace) {
+		const issuerNamespaces = this.structure.get("issuerSigned")?.issuerNamespaces?.issuerNamespaces;
+		if (!issuerNamespaces) return;
+		return issuerNamespaces.get(namespace);
+	}
+	static create(options) {
+		const map = new TypedMap([
+			["docType", options.docType],
+			["issuerSigned", options.issuerSigned],
+			["deviceSigned", options.deviceSigned]
+		]);
+		if (options.errors) map.set("errors", options.errors);
+		return this.fromDecodedStructure(map);
+	}
+};
+
+//#endregion
+//#region src/mdoc/models/document-error.ts
+const documentErrorSchema = z.map(z.string(), z.number());
+var DocumentError = class DocumentError extends CborStructure {
+	static get encodingSchema() {
+		return documentErrorSchema;
+	}
+	/**
+	* Map where keys are namespaces and values are error codes
+	*/
+	get documentError() {
+		return this.structure;
+	}
+	static create(options) {
+		return new DocumentError(options.documentError);
+	}
+};
+
+//#endregion
+//#region src/mdoc/models/device-response.ts
+const deviceResponseEncodedSchema = typedMap([
+	["version", z.string()],
+	["status", z.number()],
+	["documents", z.array(z.unknown()).exactOptional()],
+	["documentErrors", z.array(z.unknown()).exactOptional()]
+]);
+const deviceResponseDecodedSchema = typedMap([
+	["version", z.string()],
+	["status", z.number()],
+	["documents", z.array(z.instanceof(Document)).exactOptional()],
+	["documentErrors", z.array(z.instanceof(DocumentError)).exactOptional()]
+]);
+var DeviceResponse = class DeviceResponse extends CborStructure {
+	static get encodingSchema() {
+		return z.codec(deviceResponseEncodedSchema.in, deviceResponseDecodedSchema.out, {
+			decode: (input) => {
+				const map = TypedMap.fromMap(input);
+				if (input.has("documents")) map.set("documents", input.get("documents").map((d) => Document.fromEncodedStructure(d)));
+				if (input.has("documentErrors")) map.set("documentErrors", input.get("documentErrors").map((d) => DocumentError.fromEncodedStructure(d)));
+				return map;
+			},
+			encode: (output) => {
+				const map = output.toMap();
+				const documents = output.get("documents");
+				if (documents !== void 0) map.set("documents", documents.map((d) => d.encodedStructure));
+				const documentErrors = output.get("documentErrors");
+				if (documentErrors !== void 0) map.set("documentErrors", documentErrors.map((d) => d.encodedStructure));
+				return map;
+			}
+		});
+	}
+	get version() {
+		return this.structure.get("version");
+	}
+	get documents() {
+		return this.structure.get("documents");
+	}
+	get documentErrors() {
+		return this.structure.get("documentErrors");
+	}
+	get status() {
+		return this.structure.get("status");
+	}
+	async verify(options, ctx) {
+		const onCheck = options.onCheck ?? defaultVerificationCallback;
+		onCheck({
+			status: this.structure.get("version") ? "PASSED" : "FAILED",
+			check: "Device Response must include \"version\" element.",
+			category: "DOCUMENT_FORMAT"
+		});
+		const documents = this.structure.get("documents");
+		onCheck({
+			status: !documents || documents.length > 0 ? "PASSED" : "FAILED",
+			check: "Device Response must not include documents or at least one document.",
+			category: "DOCUMENT_FORMAT"
+		});
+		for (const document of documents ?? []) {
+			await document.issuerSigned.issuerAuth.verify({
+				disableCertificateChainValidation: options.disableCertificateChainValidation,
+				now: options.now,
+				trustedCertificates: options.trustedCertificates,
+				verificationCallback: onCheck,
+				skewSeconds: options.skewSeconds
+			}, ctx);
+			await document.deviceSigned.deviceAuth.verify({
+				document,
+				ephemeralMacPrivateKey: options.ephemeralReaderKey,
+				sessionTranscript: options.sessionTranscript,
+				verificationCallback: onCheck
+			}, ctx);
+			await document.issuerSigned.verify({ verificationCallback: onCheck }, ctx);
+		}
+		if (options.deviceRequest?.docRequests && documents) try {
+			verifyDocRequestsWithIssuerSigned(options.deviceRequest.docRequests, documents.map((d) => d.issuerSigned));
+			onCheck({
+				status: "PASSED",
+				check: "Device Response did match the Device Request",
+				category: "DOCUMENT_FORMAT"
+			});
+		} catch (e) {
+			onCheck({
+				status: "FAILED",
+				check: `Device Response did not match the Device Request: ${e.message}`,
+				category: "DOCUMENT_FORMAT"
+			});
+		}
+	}
+	get encodedForOid4Vp() {
+		return base64url.encode(this.encode());
+	}
+	static fromEncodedForOid4Vp(encoded) {
+		return DeviceResponse.decode(base64url.decode(encoded));
+	}
+	static async create(options, ctx) {
+		const useMac = !!options.mac;
+		const useSignature = !!options.signature;
+		if (useMac === useSignature) throw new EitherSignatureOrMacMustBeProvidedError();
+		const signingKey = useSignature ? options.signature?.signingKey : options.mac?.signingKey;
+		if (!signingKey) throw new Error("Signing key is missing");
+		const map = new TypedMap([
+			["version", "1.0"],
+			["status", 0],
+			["documents", await Promise.all(options.deviceRequest.docRequests.map(async (docRequest) => {
+				const issuerSigned = findIssuerSigned(options.issuerSigned, docRequest.itemsRequest.docType);
+				const disclosedIssuerNamespace = limitDisclosureToDeviceRequestNameSpaces(issuerSigned, docRequest);
+				const docType = docRequest.itemsRequest.docType;
+				const deviceNamespaces = options.deviceNamespaces ?? DeviceNamespaces.create({ deviceNamespaces: /* @__PURE__ */ new Map() });
+				const deviceAuthenticationBytes = DeviceAuthentication.create({
+					sessionTranscript: options.sessionTranscript,
+					docType,
+					deviceNamespaces
+				}).encode({ asDataItem: true });
+				const unprotectedHeaders = signingKey.keyId ? UnprotectedHeaders.create({ unprotectedHeaders: new Map([[Header.KeyId, signingKey.keyId]]) }) : UnprotectedHeaders.create({});
+				const protectedHeaders = ProtectedHeaders.create({ protectedHeaders: new Map([[Header.Algorithm, signingKey.algorithm]]) });
+				const deviceAuthOptions = {};
+				if (useSignature) deviceAuthOptions.deviceSignature = await DeviceSignature.create({
+					unprotectedHeaders,
+					protectedHeaders,
+					detachedPayload: deviceAuthenticationBytes,
+					signingKey
+				}, ctx);
+				else {
+					const ephemeralKey = options.mac?.ephemeralKey;
+					if (!ephemeralKey) throw new Error("Ephemeral key is missing");
+					deviceAuthOptions.deviceMac = await DeviceMac.create({
+						protectedHeaders,
+						unprotectedHeaders,
+						detachedPayload: deviceAuthenticationBytes,
+						privateKey: signingKey,
+						ephemeralKey,
+						sessionTranscript: options.sessionTranscript
+					}, ctx);
+				}
+				return Document.create({
+					docType,
+					issuerSigned: IssuerSigned.create({
+						issuerNamespaces: disclosedIssuerNamespace,
+						issuerAuth: issuerSigned.issuerAuth
+					}),
+					deviceSigned: DeviceSigned.create({
+						deviceNamespaces,
+						deviceAuth: DeviceAuth.create(deviceAuthOptions)
+					})
+				});
+			}))]
+		]);
+		return DeviceResponse.fromDecodedStructure(map);
+	}
+	static async createWithDeviceRequest(options, ctx) {
+		return await DeviceResponse.create(options, ctx);
+	}
+	static createSimple(options) {
+		const map = new TypedMap([["version", options.version ?? "1.0"], ["status", options.status ?? 0]]);
+		if (options.documents !== void 0) map.set("documents", options.documents);
+		if (options.documentErrors !== void 0) map.set("documentErrors", options.documentErrors);
+		return this.fromDecodedStructure(map);
+	}
+};
+
+//#endregion
+//#region src/mdoc/models/error-items.ts
+const errorItemsSchema = z$1.map(z$1.string(), z$1.number());
+var ErrorItems = class extends CborStructure {
+	static get encodingSchema() {
+		return errorItemsSchema;
+	}
+	static create(options) {
+		return this.fromDecodedStructure(options.errorItems);
+	}
+};
+
+//#endregion
+//#region src/mdoc/models/errors.ts
+const errorsEncodedSchema = z$1.map(z$1.string(), errorItemsSchema);
+const errorsDecodedSchema = z$1.map(z$1.string(), z$1.instanceof(ErrorItems));
+var Errors = class extends CborStructure {
+	static get encodingSchema() {
+		return z$1.codec(errorsEncodedSchema, errorsDecodedSchema, {
+			encode: (decoded) => {
+				const errorsDecoded = /* @__PURE__ */ new Map();
+				decoded.forEach((value, key) => {
+					errorsDecoded.set(key, value.encodedStructure);
+				});
+				return errorsDecoded;
+			},
+			decode: (encoded) => {
+				const errorsDecoded = /* @__PURE__ */ new Map();
+				encoded.forEach((value, key) => {
+					errorsDecoded.set(key, ErrorItems.fromEncodedStructure(value));
+				});
+				return errorsDecoded;
+			}
+		});
+	}
+};
+
+//#endregion
+//#region src/mdoc/builders/device-signed-builder.ts
+var DeviceSignedBuilder = class {
+	constructor(docType, ctx) {
+		this.docType = docType;
+		this.namespaces = DeviceNamespaces.create({ deviceNamespaces: /* @__PURE__ */ new Map() });
+		this.ctx = ctx;
+	}
+	addDeviceNamespace(namespace, value) {
+		const deviceSignedItems = this.namespaces.deviceNamespaces.get(namespace) ?? DeviceSignedItems.create({ deviceSignedItems: /* @__PURE__ */ new Map() });
+		for (const [k, v] of Object.entries(value)) deviceSignedItems.deviceSignedItems.set(k, v);
+		this.namespaces.deviceNamespaces.set(namespace, deviceSignedItems);
+		return this;
+	}
+	async sign(options) {
+		const protectedHeaders = ProtectedHeaders.create({ protectedHeaders: new Map([[Header.Algorithm, options.algorithm]]) });
+		const unprotectedHeaders = UnprotectedHeaders.create({ unprotectedHeaders: new Map([[Header.X5Chain, base64.decode(options.derCertificate)]]) });
+		if (options.signingKey.keyId) unprotectedHeaders.headers?.set(Header.KeyId, options.signingKey.keyId);
+		const deviceAuthentication = DeviceAuthentication.create({
+			sessionTranscript: options.sessionTranscript,
+			deviceNamespaces: this.namespaces,
+			docType: this.docType
+		});
+		const deviceSignature = await DeviceSignature.create({
+			unprotectedHeaders,
+			protectedHeaders,
+			detachedPayload: deviceAuthentication.encode({ asDataItem: true }),
+			signingKey: options.signingKey
+		}, this.ctx);
+		return DeviceSigned.create({
+			deviceNamespaces: this.namespaces,
+			deviceAuth: DeviceAuth.create({ deviceSignature })
+		});
+	}
+	async tag(options) {
+		const protectedHeaders = ProtectedHeaders.create({ protectedHeaders: new Map([[Header.Algorithm, options.algorithm]]) });
+		const unprotectedHeaders = UnprotectedHeaders.create({ unprotectedHeaders: new Map([[Header.X5Chain, base64.decode(options.derCertificate)]]) });
+		if (options.privateKey.keyId) unprotectedHeaders.headers?.set(Header.KeyId, options.privateKey.keyId);
+		const deviceAuthentication = DeviceAuthentication.create({
+			sessionTranscript: options.sessionTranscript,
+			deviceNamespaces: this.namespaces,
+			docType: this.docType
+		});
+		const deviceMac = await DeviceMac.create({
+			unprotectedHeaders,
+			protectedHeaders,
+			detachedPayload: deviceAuthentication.encode({ asDataItem: true }),
+			privateKey: options.privateKey,
+			ephemeralKey: options.publicKey,
+			sessionTranscript: options.sessionTranscript
+		}, this.ctx);
+		return DeviceSigned.create({
+			deviceNamespaces: this.namespaces,
+			deviceAuth: DeviceAuth.create({ deviceMac })
+		});
+	}
+};
+
+//#endregion
+//#region src/utils/randomUnsignedInteger.ts
+const randomUnsignedInteger = (ctx) => {
+	const bytes = ctx.crypto.random(4);
+	return (bytes[0] << 24 | bytes[1] << 16 | bytes[2] << 8 | bytes[3]) >>> 0;
+};
+
+//#endregion
+//#region src/mdoc/builders/issuer-signed-builder.ts
+var IssuerSignedBuilder = class {
+	constructor(docType, ctx) {
+		this.docType = docType;
+		this.ctx = ctx;
+		this.namespaces = IssuerNamespaces.create({ issuerNamespaces: /* @__PURE__ */ new Map() });
+	}
+	addIssuerNamespace(namespace, values) {
+		const issuerNamespace = this.namespaces.getIssuerNamespace(namespace) ?? [];
+		const issuerSignedItems = (values instanceof Map ? Array.from(values.entries()) : Object.entries(values)).map(([key, value]) => IssuerSignedItem.fromOptions({
+			digestId: randomUnsignedInteger(this.ctx),
+			random: this.ctx.crypto.random(32),
+			elementIdentifier: key,
+			elementValue: value
+		}));
+		issuerNamespace.push(...issuerSignedItems);
+		this.namespaces.setIssuerNamespace(namespace, issuerNamespace);
+		return this;
+	}
+	async convertIssuerNamespacesIntoValueDigests(digestAlgorithm) {
+		const valueDigests = /* @__PURE__ */ new Map();
+		for (const [namespace, issuerSignedItems] of this.namespaces.issuerNamespaces) {
+			const digests = /* @__PURE__ */ new Map();
+			for (const issuerSignedItem of issuerSignedItems) {
+				const digest = await this.ctx.crypto.digest({
+					digestAlgorithm,
+					bytes: issuerSignedItem.encode({ asDataItem: true })
+				});
+				digests.set(issuerSignedItem.digestId, digest);
+			}
+			valueDigests.set(namespace, digests);
+		}
+		return ValueDigests.create({ digests: valueDigests });
+	}
+	async sign(options) {
+		const validityInfo = options.validityInfo instanceof ValidityInfo ? options.validityInfo : ValidityInfo.create(options.validityInfo);
+		const deviceKeyInfo = options.deviceKeyInfo instanceof DeviceKeyInfo ? options.deviceKeyInfo : DeviceKeyInfo.create(options.deviceKeyInfo);
+		const mso = MobileSecurityObject.create({
+			docType: this.docType,
+			validityInfo,
+			digestAlgorithm: options.digestAlgorithm,
+			deviceKeyInfo,
+			valueDigests: await this.convertIssuerNamespacesIntoValueDigests(options.digestAlgorithm)
+		});
+		const protectedHeaders = ProtectedHeaders.create({ protectedHeaders: new Map([[Header.Algorithm, options.algorithm]]) });
+		const unprotectedHeaders = UnprotectedHeaders.create({ unprotectedHeaders: new Map([[Header.X5Chain, options.certificate]]) });
+		if (options.signingKey.keyId) unprotectedHeaders.headers?.set(Header.KeyId, options.signingKey.keyId);
+		const issuerAuth = await IssuerAuth.create({
+			payload: mso,
+			unprotectedHeaders,
+			protectedHeaders,
+			signingKey: options.signingKey
+		}, this.ctx);
+		return IssuerSigned.create({
+			issuerNamespaces: this.namespaces,
+			issuerAuth
+		});
+	}
+};
+
+//#endregion
+//#region src/holder.ts
+var Holder = class {
+	/**
+	*
+	* string should be base64url encoded as defined in openid4vci Draft 15
+	*
+	*/
+	static async verifyIssuerSigned(options, ctx) {
+		await (typeof options.issuerSigned === "string" ? IssuerSigned.decode(base64url.decode(options.issuerSigned)) : options.issuerSigned instanceof Uint8Array ? IssuerSigned.decode(options.issuerSigned) : options.issuerSigned).issuerAuth.verify(options, ctx);
+	}
+	static async verifyDeviceRequest(options, ctx) {
+		const deviceRequest = options.deviceRequest instanceof DeviceRequest ? options.deviceRequest : DeviceRequest.decode(options.deviceRequest);
+		const sessionTranscript = options.sessionTranscript instanceof SessionTranscript ? options.sessionTranscript : SessionTranscript.decode(options.sessionTranscript);
+		for (const docRequest of deviceRequest.docRequests) await docRequest.readerAuth?.verify({
+			readerAuthentication: {
+				itemsRequest: docRequest.itemsRequest,
+				sessionTranscript
+			},
+			verificationCallback: options.verificationCallback
+		}, ctx);
+	}
+	static async createDeviceResponseForDeviceRequest(options, context) {
+		return await DeviceResponse.createWithDeviceRequest(options, context);
+	}
+};
+
+//#endregion
+//#region src/issuer.ts
+var Issuer = class {
+	constructor(docType, ctx) {
+		this.isb = new IssuerSignedBuilder(docType, ctx);
+	}
+	addIssuerNamespace(namespace, value) {
+		this.isb = this.isb.addIssuerNamespace(namespace, value);
+		return this;
+	}
+	async sign(options) {
+		const signingKey = options.signingKey instanceof CoseKey ? options.signingKey : CoseKey.fromJwk(options.signingKey);
+		return await this.isb.sign({
+			...options,
+			signingKey
+		});
+	}
+};
+
+//#endregion
+//#region src/verifier.ts
+var Verifier = class {
+	static async verifyDeviceResponse(options, ctx) {
+		await (options.deviceResponse instanceof DeviceResponse ? options.deviceResponse : DeviceResponse.decode(options.deviceResponse)).verify(options, ctx);
+	}
+};
+
+//#endregion
+export { BleOptions, CoseCertificateNotFoundError, CoseDNotDefinedError, CoseEphemeralMacKeyIsRequiredError, CoseInvalidAlgorithmError, CoseInvalidKtyForRawError, CoseInvalidSignatureError, CoseInvalidTypeForKeyError, CoseInvalidValueForKtyError, CoseKNotDefinedError, CoseKey, CoseKeyParameter, CoseKeyTypeNotSupportedForPrivateKeyExtractionError, CosePayloadInvalidStructureError, CosePayloadMustBeDefinedError, CosePayloadMustBeNullError, CoseUnsupportedMacError, CoseXNotDefinedError, CoseYNotDefinedError, Curve, DataItem, DateOnly, DeviceAuth, DeviceAuthentication, DeviceEngagement, DeviceKey, DeviceKeyInfo, DeviceMac, DeviceNamespaces, DeviceRequest, DeviceResponse, DeviceRetrievalMethod, DeviceRetrievalMethodType, DeviceSignature, DeviceSigned, DeviceSignedBuilder, DeviceSignedItems, DocRequest, Document, DocumentError, DuplicateDocumentInDeviceResponseError, DuplicateNamespaceInIssuerNamespacesError, EDeviceKey, EReaderKey, EitherSignatureOrMacMustBeProvidedError, EncryptionAlgorithm, ErrorItems, Errors, Header, Holder, Issuer, IssuerAuth, IssuerNamespaces, IssuerSigned, IssuerSignedBuilder, IssuerSignedItem, ItemsRequest, KeyAuthorizations, KeyInfo, KeyOps, KeyType, Mac0, MacAlgorithm, MdlError, MdlParseError, MobileSecurityObject, NfcHandover, NfcOptions, Oidc, PresentationDefinitionOrDocRequestsAreRequiredError, ProtectedHeaders, ProtocolInfo, QrHandover, ReaderAuth, Security, ServerRetrievalMethod, SessionTranscript, SessionTranscriptOrSessionTranscriptBytesAreRequiredError, Sign1, SignatureAlgorithm, TypedMap, UnprotectedHeaders, ValidityInfo, ValueDigests, Verifier, WebApi, WifiOptions, base64, base64url, bytesToString, cborDecode, cborEncode, compareBytes, concatBytes, coseKeyToJwk, coseOptionsJwkMap, defaultVerificationCallback, deviceSignedItemsSchema, errorItemsSchema, hex, issuerNamespacesDecodedSchema, issuerNamespacesEncodedSchema, issuerSignedItemSchema, jwkCoseOptionsMap, jwkToCoseKey, onCategoryCheck, protectedHeadersDecodedStructure, protectedHeadersEncodedStructure, sessionTranscriptEncodedSchema, stringToBytes, typedMap, unprotectedHeadersStructure };
+//# sourceMappingURL=index.mjs.map