@pagopa/io-react-native-wallet 0.2.1 → 0.2.3

package/lib/module/pid/sd-jwt/index.js

@@ -1,5 +1,4 @@
-import { decode as decodeJwt } from "../../sd-jwt";
-import { verify as verifyJwt } from "../../sd-jwt";
+import { decode as decodeJwt, verify as verifyJwt } from "../../sd-jwt";
 import { pidFromToken } from "./converters";
 import { SdJwt4VC } from "../../sd-jwt/types";
 
@@ -21,8 +20,9 @@ import { SdJwt4VC } from "../../sd-jwt/types";
 export function decode(token) {
   let {
     sdJwt,
-    disclosures
+    disclosures: disclosuresWithOriginal
   } = decodeJwt(token, SdJwt4VC);
+  const disclosures = disclosuresWithOriginal.map(d => d.decoded);
   const pid = pidFromToken(sdJwt, disclosures);
   return {
     pid,

package/lib/module/pid/sd-jwt/index.js.map

@@ -1 +1 @@
-{"version":3,"names":["decode","decodeJwt","verify","verifyJwt","pidFromToken","SdJwt4VC","token","sdJwt","disclosures","pid","decoded","publicKey","payload","cnf","jwk","PID"],"sourceRoot":"../../../../src","sources":["pid/sd-jwt/index.ts"],"mappings":"AAAA,SAASA,MAAM,IAAIC,SAAS,QAAQ,cAAc;AAClD,SAASC,MAAM,IAAIC,SAAS,QAAQ,cAAc;AAElD,SAASC,YAAY,QAAQ,cAAc;AAC3C,SAAqBC,QAAQ,QAAQ,oBAAoB;;AAEzD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASL,MAAMA,CAACM,KAAa,EAAgB;EAClD,IAAI;IAAEC,KAAK;IAAEC;EAAY,CAAC,GAAGP,SAAS,CAACK,KAAK,EAAED,QAAQ,CAAC;EACvD,MAAMI,GAAG,GAAGL,YAAY,CAACG,KAAK,EAAEC,WAAW,CAAC;EAE5C,OAAO;IAAEC,GAAG;IAAEF,KAAK;IAAEC;EAAY,CAAC;AACpC;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeN,MAAMA,CAACI,KAAa,EAAyB;EACjE,MAAMI,OAAO,GAAGV,MAAM,CAACM,KAAK,CAAC;EAC7B,MAAMK,SAAS,GAAGD,OAAO,CAACH,KAAK,CAACK,OAAO,CAACC,GAAG,CAACC,GAAG;EAC/C,MAAMX,SAAS,CAACG,KAAK,EAAEK,SAAS,EAAEN,QAAQ,CAAC;EAE3C,OAAOK,OAAO;AAChB;;AAWA;AACA;AACA;;AAGA,SAASK,GAAG,QAAQ,SAAS"}
+{"version":3,"names":["decode","decodeJwt","verify","verifyJwt","pidFromToken","SdJwt4VC","token","sdJwt","disclosures","disclosuresWithOriginal","map","d","decoded","pid","publicKey","payload","cnf","jwk","PID"],"sourceRoot":"../../../../src","sources":["pid/sd-jwt/index.ts"],"mappings":"AAAA,SAASA,MAAM,IAAIC,SAAS,EAAEC,MAAM,IAAIC,SAAS,QAAQ,cAAc;AAEvE,SAASC,YAAY,QAAQ,cAAc;AAC3C,SAAqBC,QAAQ,QAAQ,oBAAoB;;AAEzD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASL,MAAMA,CAACM,KAAa,EAAgB;EAClD,IAAI;IAAEC,KAAK;IAAEC,WAAW,EAAEC;EAAwB,CAAC,GAAGR,SAAS,CAC7DK,KAAK,EACLD,QACF,CAAC;EACD,MAAMG,WAAW,GAAGC,uBAAuB,CAACC,GAAG,CAAEC,CAAC,IAAKA,CAAC,CAACC,OAAO,CAAC;EACjE,MAAMC,GAAG,GAAGT,YAAY,CAACG,KAAK,EAAEC,WAAW,CAAC;EAE5C,OAAO;IAAEK,GAAG;IAAEN,KAAK;IAAEC;EAAY,CAAC;AACpC;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeN,MAAMA,CAACI,KAAa,EAAyB;EACjE,MAAMM,OAAO,GAAGZ,MAAM,CAACM,KAAK,CAAC;EAC7B,MAAMQ,SAAS,GAAGF,OAAO,CAACL,KAAK,CAACQ,OAAO,CAACC,GAAG,CAACC,GAAG;EAC/C,MAAMd,SAAS,CAACG,KAAK,EAAEQ,SAAS,EAAET,QAAQ,CAAC;EAE3C,OAAOO,OAAO;AAChB;;AAWA;AACA;AACA;;AAGA,SAASM,GAAG,QAAQ,SAAS"}

package/lib/module/rp/__test__/index.test.js

@@ -1,16 +1,14 @@
 import { RelyingPartySolution } from "..";
 import { AuthRequestDecodeError } from "../../utils/errors";
-const walletInstanceAttestation = "eyJhbGciOiJFUzI1NiIsImtpZCI6IjV0NVlZcEJoTi1FZ0lFRUk1aVV6cjZyME1SMDJMblZRME9tZWttTktjalkiLCJ0cnVzdF9jaGFpbiI6WyJleUpoYkdjaU9pSkZVei4uLjZTMEEiLCJleUpoYkdjaU9pSkZVei4uLmpKTEEiLCJleUpoYkdjaU9pSkZVei4uLkg5Z3ciXSwidHlwIjoidmErand0IiwieDVjIjpbIk1JSUJqRENDIC4uLiBYRmVoZ0tRQT09Il19.eyJpc3MiOiJodHRwczovL3dhbGxldC1wcm92aWRlci5leGFtcGxlLm9yZyIsInN1YiI6InZiZVhKa3NNNDV4cGh0QU5uQ2lHNm1DeXVVNGpmR056b3BHdUt2b2dnOWMiLCJ0eXBlIjoiV2FsbGV0SW5zdGFuY2VBdHRlc3RhdGlvbiIsInBvbGljeV91cmkiOiJodHRwczovL3dhbGxldC1wcm92aWRlci5leGFtcGxlLm9yZy9wcml2YWN5X3BvbGljeSIsInRvc191cmkiOiJodHRwczovL3dhbGxldC1wcm92aWRlci5leGFtcGxlLm9yZy9pbmZvX3BvbGljeSIsImxvZ29fdXJpIjoiaHR0cHM6Ly93YWxsZXQtcHJvdmlkZXIuZXhhbXBsZS5vcmcvbG9nby5zdmciLCJhc2MiOiJodHRwczovL3dhbGxldC1wcm92aWRlci5leGFtcGxlLm9yZy9Mb0EvYmFzaWMiLCJjbmYiOnsiandrIjp7ImNydiI6IlAtMjU2Iiwia3R5IjoiRUMiLCJ4IjoiNEhOcHRJLXhyMnBqeVJKS0dNbno0V21kblFEX3VKU3E0Ujk1Tmo5OGI0NCIsInkiOiJMSVpuU0IzOXZGSmhZZ1MzazdqWEU0cjMtQ29HRlF3WnRQQklScXBObHJnIiwia2lkIjoidmJlWEprc000NXhwaHRBTm5DaUc2bUN5dVU0amZHTnpvcEd1S3ZvZ2c5YyJ9fSwiYXV0aG9yaXphdGlvbl9lbmRwb2ludCI6ImV1ZGl3OiIsInJlc3BvbnNlX3R5cGVzX3N1cHBvcnRlZCI6WyJ2cF90b2tlbiJdLCJ2cF9mb3JtYXRzX3N1cHBvcnRlZCI6eyJqd3RfdnBfanNvbiI6eyJhbGdfdmFsdWVzX3N1cHBvcnRlZCI6WyJFUzI1NiJdfSwiand0X3ZjX2pzb24iOnsiYWxnX3ZhbHVlc19zdXBwb3J0ZWQiOlsiRVMyNTYiXX19LCJyZXF1ZXN0X29iamVjdF9zaWduaW5nX2FsZ192YWx1ZXNfc3VwcG9ydGVkIjpbIkVTMjU2Il0sInByZXNlbnRhdGlvbl9kZWZpbml0aW9uX3VyaV9zdXBwb3J0ZWQiOmZhbHNlLCJpYXQiOjE2ODcyODExOTUsImV4cCI6MTY4NzI4ODM5NX0.OTuPik6p3o9j6VOx-uCyxRvHwoh1pDiiZcBQFNQt2uE3dK-8izGNflJVETi_uhGSZOf25Enkq-UvEin9NrbJNw";
-const rp = new RelyingPartySolution("http://rp.example", walletInstanceAttestation);
 describe("decodeAuthRequestQR", () => {
   it("should return authentication request URL", async () => {
     const qrcode = "ZXVkaXc6Ly9hdXRob3JpemU/Y2xpZW50X2lkPWh0dHBzOi8vdmVyaWZpZXIuZXhhbXBsZS5vcmcmcmVxdWVzdF91cmk9aHR0cHM6Ly92ZXJpZmllci5leGFtcGxlLm9yZy9yZXF1ZXN0X3VyaQ==";
-    const result = rp.decodeAuthRequestQR(qrcode);
-    expect(result).toEqual("https://verifier.example.org/request_uri");
+    const result = RelyingPartySolution.decodeAuthRequestQR(qrcode);
+    expect(result.requestURI).toEqual("https://verifier.example.org/request_uri");
   });
   it("should throw exception with invalid QR", async () => {
     const qrcode = "aHR0cDovL2dvb2dsZS5pdA==";
-    expect(() => rp.decodeAuthRequestQR(qrcode)).toThrowError(AuthRequestDecodeError);
+    expect(() => RelyingPartySolution.decodeAuthRequestQR(qrcode)).toThrowError(AuthRequestDecodeError);
   });
 });
 //# sourceMappingURL=index.test.js.map

package/lib/module/rp/__test__/index.test.js.map

@@ -1 +1 @@
-{"version":3,"names":["RelyingPartySolution","AuthRequestDecodeError","walletInstanceAttestation","rp","describe","it","qrcode","result","decodeAuthRequestQR","expect","toEqual","toThrowError"],"sourceRoot":"../../../../src","sources":["rp/__test__/index.test.ts"],"mappings":"AAAA,SAASA,oBAAoB,QAAQ,IAAI;AACzC,SAASC,sBAAsB,QAAQ,oBAAoB;AAE3D,MAAMC,yBAAyB,GAC7B,qhDAAqhD;AACvhD,MAAMC,EAAE,GAAG,IAAIH,oBAAoB,CACjC,mBAAmB,EACnBE,yBACF,CAAC;AACDE,QAAQ,CAAC,qBAAqB,EAAE,MAAM;EACpCC,EAAE,CAAC,0CAA0C,EAAE,YAAY;IACzD,MAAMC,MAAM,GACV,sJAAsJ;IACxJ,MAAMC,MAAM,GAAGJ,EAAE,CAACK,mBAAmB,CAACF,MAAM,CAAC;IAC7CG,MAAM,CAACF,MAAM,CAAC,CAACG,OAAO,CAAC,0CAA0C,CAAC;EACpE,CAAC,CAAC;EACFL,EAAE,CAAC,wCAAwC,EAAE,YAAY;IACvD,MAAMC,MAAM,GAAG,0BAA0B;IACzCG,MAAM,CAAC,MAAMN,EAAE,CAACK,mBAAmB,CAACF,MAAM,CAAC,CAAC,CAACK,YAAY,CACvDV,sBACF,CAAC;EACH,CAAC,CAAC;AACJ,CAAC,CAAC"}
+{"version":3,"names":["RelyingPartySolution","AuthRequestDecodeError","describe","it","qrcode","result","decodeAuthRequestQR","expect","requestURI","toEqual","toThrowError"],"sourceRoot":"../../../../src","sources":["rp/__test__/index.test.ts"],"mappings":"AAAA,SAASA,oBAAoB,QAAQ,IAAI;AACzC,SAASC,sBAAsB,QAAQ,oBAAoB;AAE3DC,QAAQ,CAAC,qBAAqB,EAAE,MAAM;EACpCC,EAAE,CAAC,0CAA0C,EAAE,YAAY;IACzD,MAAMC,MAAM,GACV,sJAAsJ;IACxJ,MAAMC,MAAM,GAAGL,oBAAoB,CAACM,mBAAmB,CAACF,MAAM,CAAC;IAC/DG,MAAM,CAACF,MAAM,CAACG,UAAU,CAAC,CAACC,OAAO,CAC/B,0CACF,CAAC;EACH,CAAC,CAAC;EACFN,EAAE,CAAC,wCAAwC,EAAE,YAAY;IACvD,MAAMC,MAAM,GAAG,0BAA0B;IACzCG,MAAM,CAAC,MAAMP,oBAAoB,CAACM,mBAAmB,CAACF,MAAM,CAAC,CAAC,CAACM,YAAY,CACzET,sBACF,CAAC;EACH,CAAC,CAAC;AACJ,CAAC,CAAC"}

package/lib/module/rp/index.js

@@ -1,7 +1,8 @@
-import { AuthRequestDecodeError, IoWalletError } from "../utils/errors";
-import { decode as decodeJwt, decodeBase64, sha256ToBase64, SignJWT } from "@pagopa/io-react-native-jwt";
-import { RequestObject, RpEntityConfiguration } from "./types";
+import { AuthRequestDecodeError, IoWalletError, NoSuitableKeysFoundInEntityConfiguration } from "../utils/errors";
+import { decode as decodeJwt, decodeBase64, sha256ToBase64, SignJWT, EncryptJwe, verify } from "@pagopa/io-react-native-jwt";
+import { QRCodePayload, RequestObject, RpEntityConfiguration } from "./types";
 import uuid from "react-native-uuid";
+import { disclose } from "../sd-jwt";
 export class RelyingPartySolution {
   constructor(relyingPartyBaseUrl, walletInstanceAttestation) {
     let appFetch = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : fetch;
@@ -18,18 +19,23 @@ export class RelyingPartySolution {
    * @returns The authentication request url
    *
    */
-  decodeAuthRequestQR(qrcode) {
-    try {
-      const decoded = decodeBase64(qrcode);
-      const decodedUrl = new URL(decoded);
-      const requestUri = decodedUrl.searchParams.get("request_uri");
-      if (requestUri) {
-        return requestUri;
-      } else {
-        throw new AuthRequestDecodeError("Unable to obtain request_uri from QR code", `${decodedUrl}`);
-      }
-    } catch {
-      throw new AuthRequestDecodeError("Unable to decode QR code authentication request url", qrcode);
+  static decodeAuthRequestQR(qrcode) {
+    const decoded = decodeBase64(qrcode);
+    const decodedUrl = new URL(decoded);
+    const protocol = decodedUrl.protocol;
+    const resource = decodedUrl.hostname;
+    const requestURI = decodedUrl.searchParams.get("request_uri");
+    const clientId = decodedUrl.searchParams.get("client_id");
+    const result = QRCodePayload.safeParse({
+      protocol,
+      resource,
+      requestURI,
+      clientId
+    });
+    if (result.success) {
+      return result.data;
+    } else {
+      throw new AuthRequestDecodeError(result.error.message, `${decodedUrl}`);
     }
   }
   /**
@@ -57,14 +63,16 @@ export class RelyingPartySolution {
 
   /**
    * Obtain the Request Object for RP authentication
+   * @see https://italia.github.io/eudi-wallet-it-docs/versione-corrente/en/relying-party-solution.html
    *
-   * @function
+   * @async @function
    * @param signedWalletInstanceDPoP JWT of the Wallet Instance Attestation DPoP
    *
    * @returns The Request Object JWT
+   * @throws {NoSuitableKeysFoundInEntityConfiguration} When the Request Object is signed with a key not listed in RP's entity configuration
    *
    */
-  async getRequestObject(signedWalletInstanceDPoP) {
+  async getRequestObject(signedWalletInstanceDPoP, entity) {
     const decodedJwtDPop = await decodeJwt(signedWalletInstanceDPoP);
     const requestUri = decodedJwtDPop.payload.htu;
     const response = await this.appFetch(requestUri, {
@@ -76,7 +84,24 @@ export class RelyingPartySolution {
     });
     if (response.status === 200) {
       const responseText = await response.text();
-      const responseJwt = await decodeJwt(responseText);
+      const responseJwt = decodeJwt(responseText);
+
+      // verify token signature according to RP's entity configuration
+      // to ensure the request object is authentic
+      {
+        const pubKey = entity.payload.jwks.keys.find(_ref => {
+          let {
+            kid
+          } = _ref;
+          return kid === responseJwt.protectedHeader.kid;
+        });
+        if (!pubKey) {
+          throw new NoSuitableKeysFoundInEntityConfiguration("Request Object signature verification");
+        }
+        await verify(responseText, pubKey);
+      }
+
+      // parse request object it has the expected shape by specification
       const requestObj = RequestObject.parse({
         header: responseJwt.protectedHeader,
         payload: responseJwt.payload
@@ -86,6 +111,131 @@ export class RelyingPartySolution {
     throw new IoWalletError(`Unable to obtain Request Object. Response code: ${response.status}`);
   }
 
+  /**
+   * Prepare the Verified Presentation token for a received request object in the context of an authorization request flow.
+   * The presentation is prepared by disclosing data from provided credentials, according to requested claims
+   * Each Verified Credential come along with the claims the user accepts to disclose from it.
+   *
+   * The returned token is unsigned (sign should be apply by the caller).
+   *
+   * @todo accept more than a Verified Credential
+   *
+   * @param requestObj The incoming request object, which the requirements for the requested authorization
+   * @param presentation The Verified Credential containing user data along with the list of claims to be disclosed.
+   * @returns The unsigned Verified Presentation token
+   * @throws {ClaimsNotFoundBetweenDislosures} If the Verified Credential does not contain one or more requested claims.
+   *
+   */
+  async prepareVpToken(requestObj, _ref2) {
+    let [vc, claims] = _ref2;
+    // this throws if vc cannot satisfy all the requested claims
+    const {
+      token: vp,
+      paths
+    } = await disclose(vc, claims);
+
+    // TODO: [SIW-359] check all requeste claims of the requestedObj are satisfied
+
+    const vp_token = new SignJWT({
+      vp
+    }).setAudience(requestObj.payload.response_uri).setExpirationTime("1h").setProtectedHeader({
+      typ: "JWT",
+      alg: "ES256"
+    }).toSign();
+    const [definition_id, vc_scope] = requestObj.payload.scope;
+    const presentation_submission = {
+      definition_id,
+      id: `${uuid.v4()}`,
+      descriptor_map: paths.map(p => ({
+        id: vc_scope,
+        path: `$.vp_token.${p.path}`,
+        format: "vc+sd-jwt"
+      }))
+    };
+    return {
+      vp_token,
+      presentation_submission
+    };
+  }
+
+  /**
+   * Compose and send an Authorization Response in the context of an authorization request flow.
+   *
+   * @todo MUST add presentation_submission
+   *
+   * @param requestObj The incoming request object, which the requirements for the requested authorization
+   * @param vp_token The signed Verified Presentation token with data to send.
+   * @param presentation_submission
+   * @param entity The RP entity configuration
+   * @returns The response from the RP
+   * @throws {IoWalletError} if the submission fails.
+   * @throws {NoSuitableKeysFoundInEntityConfiguration} If entity do not contain any public key
+   *
+   */
+  async sendAuthorizationResponse(requestObj, vp_token, presentation_submission, entity) {
+    // the request is an unsigned jws without iss, aud, exp
+    // https://openid.net/specs/openid-4-verifiable-presentations-1_0.html#name-signed-and-encrypted-respon
+    const jwk = this.choosePublicKeyToEncrypt(entity);
+    const enc = this.getEncryptionAlgByJwk(jwk);
+    const authzResponsePayload = JSON.stringify({
+      state: requestObj.payload.state,
+      presentation_submission,
+      vp_token
+    });
+    const encrypted = await new EncryptJwe(authzResponsePayload, {
+      alg: jwk.alg,
+      enc
+    }).encrypt(jwk);
+    const formBody = new URLSearchParams({
+      response: encrypted
+    });
+    const response = await this.appFetch(requestObj.payload.response_uri, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded"
+      },
+      body: formBody.toString()
+    });
+    if (response.status === 200) {
+      return response.text();
+    }
+    throw new IoWalletError(`Unable to send Authorization Response. Response code: ${response.status}`);
+  }
+
+  /**
+   * Select a public key from those provided by the RP.
+   * Keys with algorithm "RSA-OAEP-256" or "RSA-OAEP" are expected, the firsts to be preferred.
+   *
+   * @param entity The RP entity configuration
+   * @returns A suitable public key with its compatible encryption algorithm
+   * @throws {NoSuitableKeysFoundInEntityConfiguration} If entity do not contain any public key suitable for encrypting
+   */
+  choosePublicKeyToEncrypt(entity) {
+    // Look for keys using "RSA-OAEP-256", and pick a random one
+    const [usingRsa256] = entity.payload.jwks.keys.filter(k => typeof k.alg === "string" && k.alg === "RSA-OAEP-256");
+    if (usingRsa256) {
+      return usingRsa256;
+    }
+
+    // Look for keys using "RSA-OAEP", and pick a random one
+    const [usingRsa] = entity.payload.jwks.keys.filter(k => typeof k.alg === "string" && k.alg === "RSA-OAEP");
+    if (usingRsa) {
+      return usingRsa;
+    }
+
+    // No suitable key has been found
+    throw new NoSuitableKeysFoundInEntityConfiguration("Encrypt with RP public key");
+  }
+  getEncryptionAlgByJwk(_ref3) {
+    let {
+      alg
+    } = _ref3;
+    if (alg === "RSA-OAEP-256") return "A256CBC-HS512";
+    if (alg === "RSA-OAEP") return "A128CBC-HS256";
+    const _ = alg;
+    throw new Error(`Invalid jwk algorithm: ${_}`);
+  }
+
   /**
    * Obtain the relying party entity configuration.
    */

package/lib/module/rp/index.js.map

@@ -1 +1 @@
-{"version":3,"names":["AuthRequestDecodeError","IoWalletError","decode","decodeJwt","decodeBase64","sha256ToBase64","SignJWT","RequestObject","RpEntityConfiguration","uuid","RelyingPartySolution","constructor","relyingPartyBaseUrl","walletInstanceAttestation","appFetch","arguments","length","undefined","fetch","decodeAuthRequestQR","qrcode","decoded","decodedUrl","URL","requestUri","searchParams","get","getUnsignedWalletInstanceDPoP","walletInstanceAttestationJwk","authRequestUrl","jti","v4","htm","htu","ath","setProtectedHeader","alg","jwk","typ","setIssuedAt","setExpirationTime","toSign","getRequestObject","signedWalletInstanceDPoP","decodedJwtDPop","payload","response","method","headers","Authorization","DPoP","status","responseText","text","responseJwt","requestObj","parse","header","protectedHeader","getEntityConfiguration","wellKnownUrl","href"],"sourceRoot":"../../../src","sources":["rp/index.ts"],"mappings":"AAAA,SAASA,sBAAsB,EAAEC,aAAa,QAAQ,iBAAiB;AACvE,SACEC,MAAM,IAAIC,SAAS,EACnBC,YAAY,EACZC,cAAc,EACdC,OAAO,QACF,6BAA6B;AACpC,SAASC,aAAa,EAAEC,qBAAqB,QAAQ,SAAS;AAE9D,OAAOC,IAAI,MAAM,mBAAmB;AAGpC,OAAO,MAAMC,oBAAoB,CAAC;EAKhCC,WAAWA,CACTC,mBAA2B,EAC3BC,yBAAiC,EAEjC;IAAA,IADAC,QAA8B,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAGG,KAAK;IAEtC,IAAI,CAACN,mBAAmB,GAAGA,mBAAmB;IAC9C,IAAI,CAACC,yBAAyB,GAAGA,yBAAyB;IAC1D,IAAI,CAACC,QAAQ,GAAGA,QAAQ;EAC1B;;EAEA;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACEK,mBAAmBA,CAACC,MAAc,EAAU;IAC1C,IAAI;MACF,MAAMC,OAAO,GAAGjB,YAAY,CAACgB,MAAM,CAAC;MACpC,MAAME,UAAU,GAAG,IAAIC,GAAG,CAACF,OAAO,CAAC;MACnC,MAAMG,UAAU,GAAGF,UAAU,CAACG,YAAY,CAACC,GAAG,CAAC,aAAa,CAAC;MAC7D,IAAIF,UAAU,EAAE;QACd,OAAOA,UAAU;MACnB,CAAC,MAAM;QACL,MAAM,IAAIxB,sBAAsB,CAC9B,2CAA2C,EAC1C,GAAEsB,UAAW,EAChB,CAAC;MACH;IACF,CAAC,CAAC,MAAM;MACN,MAAM,IAAItB,sBAAsB,CAC9B,qDAAqD,EACrDoB,MACF,CAAC;IACH;EACF;EACA;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACE,MAAMO,6BAA6BA,CACjCC,4BAAiC,EACjCC,cAAsB,EACL;IACjB,OAAO,MAAM,IAAIvB,OAAO,CAAC;MACvBwB,GAAG,EAAG,GAAErB,IAAI,CAACsB,EAAE,CAAC,CAAE,EAAC;MACnBC,GAAG,EAAE,KAAK;MACVC,GAAG,EAAEJ,cAAc;MACnBK,GAAG,EAAE,MAAM7B,cAAc,CAAC,IAAI,CAACQ,yBAAyB;IAC1D,CAAC,CAAC,CACCsB,kBAAkB,CAAC;MAClBC,GAAG,EAAE,OAAO;MACZC,GAAG,EAAET,4BAA4B;MACjCU,GAAG,EAAE;IACP,CAAC,CAAC,CACDC,WAAW,CAAC,CAAC,CACbC,iBAAiB,CAAC,IAAI,CAAC,CACvBC,MAAM,CAAC,CAAC;EACb;;EAEA;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACE,MAAMC,gBAAgBA,CACpBC,wBAAgC,EACR;IACxB,MAAMC,cAAc,GAAG,MAAMzC,SAAS,CAACwC,wBAAwB,CAAC;IAChE,MAAMnB,UAAU,GAAGoB,cAAc,CAACC,OAAO,CAACZ,GAAa;IAEvD,MAAMa,QAAQ,GAAG,MAAM,IAAI,CAAChC,QAAQ,CAACU,UAAU,EAAE;MAC/CuB,MAAM,EAAE,KAAK;MACbC,OAAO,EAAE;QACPC,aAAa,EAAG,QAAO,IAAI,CAACpC,yBAA0B,EAAC;QACvDqC,IAAI,EAAEP;MACR;IACF,CAAC,CAAC;IAEF,IAAIG,QAAQ,CAACK,MAAM,KAAK,GAAG,EAAE;MAC3B,MAAMC,YAAY,GAAG,MAAMN,QAAQ,CAACO,IAAI,CAAC,CAAC;MAC1C,MAAMC,WAAW,GAAG,MAAMnD,SAAS,CAACiD,YAAY,CAAC;MACjD,MAAMG,UAAU,GAAGhD,aAAa,CAACiD,KAAK,CAAC;QACrCC,MAAM,EAAEH,WAAW,CAACI,eAAe;QACnCb,OAAO,EAAES,WAAW,CAACT;MACvB,CAAC,CAAC;MACF,OAAOU,UAAU;IACnB;IAEA,MAAM,IAAItD,aAAa,CACpB,mDAAkD6C,QAAQ,CAACK,MAAO,EACrE,CAAC;EACH;;EAEA;AACF;AACA;EACE,MAAMQ,sBAAsBA,CAAA,EAAmC;IAC7D,MAAMC,YAAY,GAAG,IAAIrC,GAAG,CAC1B,gCAAgC,EAChC,IAAI,CAACX,mBACP,CAAC,CAACiD,IAAI;IAEN,MAAMf,QAAQ,GAAG,MAAM,IAAI,CAAChC,QAAQ,CAAC8C,YAAY,EAAE;MACjDb,MAAM,EAAE;IACV,CAAC,CAAC;IAEF,IAAID,QAAQ,CAACK,MAAM,KAAK,GAAG,EAAE;MAC3B,MAAMC,YAAY,GAAG,MAAMN,QAAQ,CAACO,IAAI,CAAC,CAAC;MAC1C,MAAMC,WAAW,GAAG,MAAMnD,SAAS,CAACiD,YAAY,CAAC;MACjD,OAAO5C,qBAAqB,CAACgD,KAAK,CAAC;QACjCC,MAAM,EAAEH,WAAW,CAACI,eAAe;QACnCb,OAAO,EAAES,WAAW,CAACT;MACvB,CAAC,CAAC;IACJ;IAEA,MAAM,IAAI5C,aAAa,CACpB,4DAA2D6C,QAAQ,CAACK,MAAO,EAC9E,CAAC;EACH;AACF"}
+{"version":3,"names":["AuthRequestDecodeError","IoWalletError","NoSuitableKeysFoundInEntityConfiguration","decode","decodeJwt","decodeBase64","sha256ToBase64","SignJWT","EncryptJwe","verify","QRCodePayload","RequestObject","RpEntityConfiguration","uuid","disclose","RelyingPartySolution","constructor","relyingPartyBaseUrl","walletInstanceAttestation","appFetch","arguments","length","undefined","fetch","decodeAuthRequestQR","qrcode","decoded","decodedUrl","URL","protocol","resource","hostname","requestURI","searchParams","get","clientId","result","safeParse","success","data","error","message","getUnsignedWalletInstanceDPoP","walletInstanceAttestationJwk","authRequestUrl","jti","v4","htm","htu","ath","setProtectedHeader","alg","jwk","typ","setIssuedAt","setExpirationTime","toSign","getRequestObject","signedWalletInstanceDPoP","entity","decodedJwtDPop","requestUri","payload","response","method","headers","Authorization","DPoP","status","responseText","text","responseJwt","pubKey","jwks","keys","find","_ref","kid","protectedHeader","requestObj","parse","header","prepareVpToken","_ref2","vc","claims","token","vp","paths","vp_token","setAudience","response_uri","definition_id","vc_scope","scope","presentation_submission","id","descriptor_map","map","p","path","format","sendAuthorizationResponse","choosePublicKeyToEncrypt","enc","getEncryptionAlgByJwk","authzResponsePayload","JSON","stringify","state","encrypted","encrypt","formBody","URLSearchParams","body","toString","usingRsa256","filter","k","usingRsa","_ref3","_","Error","getEntityConfiguration","wellKnownUrl","href"],"sourceRoot":"../../../src","sources":["rp/index.ts"],"mappings":"AAAA,SACEA,sBAAsB,EACtBC,aAAa,EACbC,wCAAwC,QACnC,iBAAiB;AACxB,SACEC,MAAM,IAAIC,SAAS,EACnBC,YAAY,EACZC,cAAc,EACdC,OAAO,EACPC,UAAU,EACVC,MAAM,QACD,6BAA6B;AACpC,SACEC,aAAa,EACbC,aAAa,EACbC,qBAAqB,QAEhB,SAAS;AAEhB,OAAOC,IAAI,MAAM,mBAAmB;AAEpC,SAASC,QAAQ,QAAQ,WAAW;AAEpC,OAAO,MAAMC,oBAAoB,CAAC;EAKhCC,WAAWA,CACTC,mBAA2B,EAC3BC,yBAAiC,EAEjC;IAAA,IADAC,QAA8B,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAGG,KAAK;IAEtC,IAAI,CAACN,mBAAmB,GAAGA,mBAAmB;IAC9C,IAAI,CAACC,yBAAyB,GAAGA,yBAAyB;IAC1D,IAAI,CAACC,QAAQ,GAAGA,QAAQ;EAC1B;;EAEA;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACE,OAAOK,mBAAmBA,CAACC,MAAc,EAAiB;IACxD,MAAMC,OAAO,GAAGrB,YAAY,CAACoB,MAAM,CAAC;IACpC,MAAME,UAAU,GAAG,IAAIC,GAAG,CAACF,OAAO,CAAC;IACnC,MAAMG,QAAQ,GAAGF,UAAU,CAACE,QAAQ;IACpC,MAAMC,QAAQ,GAAGH,UAAU,CAACI,QAAQ;IACpC,MAAMC,UAAU,GAAGL,UAAU,CAACM,YAAY,CAACC,GAAG,CAAC,aAAa,CAAC;IAC7D,MAAMC,QAAQ,GAAGR,UAAU,CAACM,YAAY,CAACC,GAAG,CAAC,WAAW,CAAC;IAEzD,MAAME,MAAM,GAAG1B,aAAa,CAAC2B,SAAS,CAAC;MACrCR,QAAQ;MACRC,QAAQ;MACRE,UAAU;MACVG;IACF,CAAC,CAAC;IAEF,IAAIC,MAAM,CAACE,OAAO,EAAE;MAClB,OAAOF,MAAM,CAACG,IAAI;IACpB,CAAC,MAAM;MACL,MAAM,IAAIvC,sBAAsB,CAACoC,MAAM,CAACI,KAAK,CAACC,OAAO,EAAG,GAAEd,UAAW,EAAC,CAAC;IACzE;EACF;EACA;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACE,MAAMe,6BAA6BA,CACjCC,4BAAiC,EACjCC,cAAsB,EACL;IACjB,OAAO,MAAM,IAAIrC,OAAO,CAAC;MACvBsC,GAAG,EAAG,GAAEhC,IAAI,CAACiC,EAAE,CAAC,CAAE,EAAC;MACnBC,GAAG,EAAE,KAAK;MACVC,GAAG,EAAEJ,cAAc;MACnBK,GAAG,EAAE,MAAM3C,cAAc,CAAC,IAAI,CAACY,yBAAyB;IAC1D,CAAC,CAAC,CACCgC,kBAAkB,CAAC;MAClBC,GAAG,EAAE,OAAO;MACZC,GAAG,EAAET,4BAA4B;MACjCU,GAAG,EAAE;IACP,CAAC,CAAC,CACDC,WAAW,CAAC,CAAC,CACbC,iBAAiB,CAAC,IAAI,CAAC,CACvBC,MAAM,CAAC,CAAC;EACb;;EAEA;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACE,MAAMC,gBAAgBA,CACpBC,wBAAgC,EAChCC,MAA6B,EACL;IACxB,MAAMC,cAAc,GAAG,MAAMxD,SAAS,CAACsD,wBAAwB,CAAC;IAChE,MAAMG,UAAU,GAAGD,cAAc,CAACE,OAAO,CAACd,GAAa;IACvD,MAAMe,QAAQ,GAAG,MAAM,IAAI,CAAC5C,QAAQ,CAAC0C,UAAU,EAAE;MAC/CG,MAAM,EAAE,KAAK;MACbC,OAAO,EAAE;QACPC,aAAa,EAAG,QAAO,IAAI,CAAChD,yBAA0B,EAAC;QACvDiD,IAAI,EAAET;MACR;IACF,CAAC,CAAC;IAEF,IAAIK,QAAQ,CAACK,MAAM,KAAK,GAAG,EAAE;MAC3B,MAAMC,YAAY,GAAG,MAAMN,QAAQ,CAACO,IAAI,CAAC,CAAC;MAC1C,MAAMC,WAAW,GAAGnE,SAAS,CAACiE,YAAY,CAAC;;MAE3C;MACA;MACA;QACE,MAAMG,MAAM,GAAGb,MAAM,CAACG,OAAO,CAACW,IAAI,CAACC,IAAI,CAACC,IAAI,CAC1CC,IAAA;UAAA,IAAC;YAAEC;UAAI,CAAC,GAAAD,IAAA;UAAA,OAAKC,GAAG,KAAKN,WAAW,CAACO,eAAe,CAACD,GAAG;QAAA,CACtD,CAAC;QACD,IAAI,CAACL,MAAM,EAAE;UACX,MAAM,IAAItE,wCAAwC,CAChD,uCACF,CAAC;QACH;QACA,MAAMO,MAAM,CAAC4D,YAAY,EAAEG,MAAM,CAAC;MACpC;;MAEA;MACA,MAAMO,UAAU,GAAGpE,aAAa,CAACqE,KAAK,CAAC;QACrCC,MAAM,EAAEV,WAAW,CAACO,eAAe;QACnChB,OAAO,EAAES,WAAW,CAACT;MACvB,CAAC,CAAC;MAEF,OAAOiB,UAAU;IACnB;IAEA,MAAM,IAAI9E,aAAa,CACpB,mDAAkD8D,QAAQ,CAACK,MAAO,EACrE,CAAC;EACH;;EAEA;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACE,MAAMc,cAAcA,CAClBH,UAAyB,EAAAI,KAAA,EAKxB;IAAA,IAJD,CAACC,EAAE,EAAEC,MAAM,CAAe,GAAAF,KAAA;IAK1B;IACA,MAAM;MAAEG,KAAK,EAAEC,EAAE;MAAEC;IAAM,CAAC,GAAG,MAAM1E,QAAQ,CAACsE,EAAE,EAAEC,MAAM,CAAC;;IAEvD;;IAEA,MAAMI,QAAQ,GAAG,IAAIlF,OAAO,CAAC;MAAEgF;IAAG,CAAC,CAAC,CACjCG,WAAW,CAACX,UAAU,CAACjB,OAAO,CAAC6B,YAAY,CAAC,CAC5CpC,iBAAiB,CAAC,IAAI,CAAC,CACvBL,kBAAkB,CAAC;MAClBG,GAAG,EAAE,KAAK;MACVF,GAAG,EAAE;IACP,CAAC,CAAC,CACDK,MAAM,CAAC,CAAC;IAEX,MAAM,CAACoC,aAAa,EAAEC,QAAQ,CAAC,GAAGd,UAAU,CAACjB,OAAO,CAACgC,KAAK;IAC1D,MAAMC,uBAAuB,GAAG;MAC9BH,aAAa;MACbI,EAAE,EAAG,GAAEnF,IAAI,CAACiC,EAAE,CAAC,CAAE,EAAC;MAClBmD,cAAc,EAAET,KAAK,CAACU,GAAG,CAAEC,CAAC,KAAM;QAChCH,EAAE,EAAEH,QAAQ;QACZO,IAAI,EAAG,cAAaD,CAAC,CAACC,IAAK,EAAC;QAC5BC,MAAM,EAAE;MACV,CAAC,CAAC;IACJ,CAAC;IAED,OAAO;MAAEZ,QAAQ;MAAEM;IAAwB,CAAC;EAC9C;;EAEA;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACE,MAAMO,yBAAyBA,CAC7BvB,UAAyB,EACzBU,QAAgB,EAChBM,uBAAgD,EAChDpC,MAA6B,EACZ;IACjB;IACA;IACA,MAAMP,GAAG,GAAG,IAAI,CAACmD,wBAAwB,CAAC5C,MAAM,CAAC;IACjD,MAAM6C,GAAG,GAAG,IAAI,CAACC,qBAAqB,CAACrD,GAAG,CAAC;IAE3C,MAAMsD,oBAAoB,GAAGC,IAAI,CAACC,SAAS,CAAC;MAC1CC,KAAK,EAAE9B,UAAU,CAACjB,OAAO,CAAC+C,KAAK;MAC/Bd,uBAAuB;MACvBN;IACF,CAAC,CAAC;IACF,MAAMqB,SAAS,GAAG,MAAM,IAAItG,UAAU,CAACkG,oBAAoB,EAAE;MAC3DvD,GAAG,EAAEC,GAAG,CAACD,GAAG;MACZqD;IACF,CAAC,CAAC,CAACO,OAAO,CAAC3D,GAAG,CAAC;IAEf,MAAM4D,QAAQ,GAAG,IAAIC,eAAe,CAAC;MAAElD,QAAQ,EAAE+C;IAAU,CAAC,CAAC;IAC7D,MAAM/C,QAAQ,GAAG,MAAM,IAAI,CAAC5C,QAAQ,CAAC4D,UAAU,CAACjB,OAAO,CAAC6B,YAAY,EAAE;MACpE3B,MAAM,EAAE,MAAM;MACdC,OAAO,EAAE;QACP,cAAc,EAAE;MAClB,CAAC;MACDiD,IAAI,EAAEF,QAAQ,CAACG,QAAQ,CAAC;IAC1B,CAAC,CAAC;IAEF,IAAIpD,QAAQ,CAACK,MAAM,KAAK,GAAG,EAAE;MAC3B,OAAOL,QAAQ,CAACO,IAAI,CAAC,CAAC;IACxB;IAEA,MAAM,IAAIrE,aAAa,CACpB,yDAAwD8D,QAAQ,CAACK,MAAO,EAC3E,CAAC;EACH;;EAEA;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACUmC,wBAAwBA,CAC9B5C,MAA6B,EACkC;IAC/D;IACA,MAAM,CAACyD,WAAW,CAAC,GAAGzD,MAAM,CAACG,OAAO,CAACW,IAAI,CAACC,IAAI,CAAC2C,MAAM,CAC/CC,CAAuB,IACzB,OAAOA,CAAC,CAACnE,GAAG,KAAK,QAAQ,IAAImE,CAAC,CAACnE,GAAG,KAAK,cAC3C,CAAC;IAED,IAAIiE,WAAW,EAAE;MACf,OAAOA,WAAW;IACpB;;IAEA;IACA,MAAM,CAACG,QAAQ,CAAC,GAAG5D,MAAM,CAACG,OAAO,CAACW,IAAI,CAACC,IAAI,CAAC2C,MAAM,CAC5CC,CAAuB,IACzB,OAAOA,CAAC,CAACnE,GAAG,KAAK,QAAQ,IAAImE,CAAC,CAACnE,GAAG,KAAK,UAC3C,CAAC;IAED,IAAIoE,QAAQ,EAAE;MACZ,OAAOA,QAAQ;IACjB;;IAEA;IACA,MAAM,IAAIrH,wCAAwC,CAChD,4BACF,CAAC;EACH;EAEQuG,qBAAqBA,CAAAe,KAAA,EAIT;IAAA,IAJU;MAC5BrE;IAC6D,CAAC,GAAAqE,KAAA;IAG9D,IAAIrE,GAAG,KAAK,cAAc,EAAE,OAAO,eAAe;IAClD,IAAIA,GAAG,KAAK,UAAU,EAAE,OAAO,eAAe;IAE9C,MAAMsE,CAAQ,GAAGtE,GAAG;IACpB,MAAM,IAAIuE,KAAK,CAAE,0BAAyBD,CAAE,EAAC,CAAC;EAChD;;EAEA;AACF;AACA;EACE,MAAME,sBAAsBA,CAAA,EAAmC;IAC7D,MAAMC,YAAY,GAAG,IAAIhG,GAAG,CAC1B,gCAAgC,EAChC,IAAI,CAACX,mBACP,CAAC,CAAC4G,IAAI;IAEN,MAAM9D,QAAQ,GAAG,MAAM,IAAI,CAAC5C,QAAQ,CAACyG,YAAY,EAAE;MACjD5D,MAAM,EAAE;IACV,CAAC,CAAC;IAEF,IAAID,QAAQ,CAACK,MAAM,KAAK,GAAG,EAAE;MAC3B,MAAMC,YAAY,GAAG,MAAMN,QAAQ,CAACO,IAAI,CAAC,CAAC;MAC1C,MAAMC,WAAW,GAAG,MAAMnE,SAAS,CAACiE,YAAY,CAAC;MACjD,OAAOzD,qBAAqB,CAACoE,KAAK,CAAC;QACjCC,MAAM,EAAEV,WAAW,CAACO,eAAe;QACnChB,OAAO,EAAES,WAAW,CAACT;MACvB,CAAC,CAAC;IACJ;IAEA,MAAM,IAAI7D,aAAa,CACpB,4DAA2D8D,QAAQ,CAACK,MAAO,EAC9E,CAAC;EACH;AACF"}

package/lib/module/rp/types.js

@@ -60,4 +60,15 @@ export const RpEntityConfiguration = z.object({
     authority_hints: z.array(z.string())
   })
 });
+export const QRCodePayload = z.object({
+  protocol: z.literal("eudiw:"),
+  resource: z.string(),
+  // TODO: refine to known paths using literals
+  clientId: z.string(),
+  requestURI: z.string()
+});
+
+/**
+ * A pair that associate a tokenized Verified Credential with the claims presented or requested to present.
+ */
 //# sourceMappingURL=types.js.map

package/lib/module/rp/types.js.map

@@ -1 +1 @@
-{"version":3,"names":["JWK","UnixTime","z","RequestObject","object","header","typ","literal","alg","string","kid","trust_chain","array","payload","iss","iat","exp","state","nonce","response_uri","response_type","response_mode","client_id","client_id_scheme","scope","RpEntityConfiguration","sub","jwks","keys","metadata","wallet_relying_party","application_type","client_name","contacts","federation_entity","organization_name","homepage_uri","policy_uri","logo_uri","authority_hints"],"sourceRoot":"../../../src","sources":["rp/types.ts"],"mappings":"AAAA,SAASA,GAAG,QAAQ,cAAc;AAClC,SAASC,QAAQ,QAAQ,iBAAiB;AAC1C,OAAO,KAAKC,CAAC,MAAM,KAAK;AAGxB,OAAO,MAAMC,aAAa,GAAGD,CAAC,CAACE,MAAM,CAAC;EACpCC,MAAM,EAAEH,CAAC,CAACE,MAAM,CAAC;IACfE,GAAG,EAAEJ,CAAC,CAACK,OAAO,CAAC,KAAK,CAAC;IACrBC,GAAG,EAAEN,CAAC,CAACO,MAAM,CAAC,CAAC;IACfC,GAAG,EAAER,CAAC,CAACO,MAAM,CAAC,CAAC;IACfE,WAAW,EAAET,CAAC,CAACU,KAAK,CAACV,CAAC,CAACO,MAAM,CAAC,CAAC;EACjC,CAAC,CAAC;EACFI,OAAO,EAAEX,CAAC,CAACE,MAAM,CAAC;IAChBU,GAAG,EAAEZ,CAAC,CAACO,MAAM,CAAC,CAAC;IACfM,GAAG,EAAEd,QAAQ;IACbe,GAAG,EAAEf,QAAQ;IACbgB,KAAK,EAAEf,CAAC,CAACO,MAAM,CAAC,CAAC;IACjBS,KAAK,EAAEhB,CAAC,CAACO,MAAM,CAAC,CAAC;IACjBU,YAAY,EAAEjB,CAAC,CAACO,MAAM,CAAC,CAAC;IACxBW,aAAa,EAAElB,CAAC,CAACK,OAAO,CAAC,UAAU,CAAC;IACpCc,aAAa,EAAEnB,CAAC,CAACK,OAAO,CAAC,iBAAiB,CAAC;IAC3Ce,SAAS,EAAEpB,CAAC,CAACO,MAAM,CAAC,CAAC;IACrBc,gBAAgB,EAAErB,CAAC,CAACK,OAAO,CAAC,WAAW,CAAC;IACxCiB,KAAK,EAAEtB,CAAC,CAACO,MAAM,CAAC;EAClB,CAAC;AACH,CAAC,CAAC;;AAEF;;AAEA,OAAO,MAAMgB,qBAAqB,GAAGvB,CAAC,CAACE,MAAM,CAAC;EAC5CC,MAAM,EAAEH,CAAC,CAACE,MAAM,CAAC;IACfE,GAAG,EAAEJ,CAAC,CAACK,OAAO,CAAC,sBAAsB,CAAC;IACtCC,GAAG,EAAEN,CAAC,CAACO,MAAM,CAAC,CAAC;IACfC,GAAG,EAAER,CAAC,CAACO,MAAM,CAAC;EAChB,CAAC,CAAC;EACFI,OAAO,EAAEX,CAAC,CAACE,MAAM,CAAC;IAChBY,GAAG,EAAEf,QAAQ;IACbc,GAAG,EAAEd,QAAQ;IACba,GAAG,EAAEZ,CAAC,CAACO,MAAM,CAAC,CAAC;IACfiB,GAAG,EAAExB,CAAC,CAACO,MAAM,CAAC,CAAC;IACfkB,IAAI,EAAEzB,CAAC,CAACE,MAAM,CAAC;MACbwB,IAAI,EAAE1B,CAAC,CAACU,KAAK,CAACZ,GAAG;IACnB,CAAC,CAAC;IACF6B,QAAQ,EAAE3B,CAAC,CAACE,MAAM,CAAC;MACjB0B,oBAAoB,EAAE5B,CAAC,CAACE,MAAM,CAAC;QAC7B2B,gBAAgB,EAAE7B,CAAC,CAACO,MAAM,CAAC,CAAC;QAC5Ba,SAAS,EAAEpB,CAAC,CAACO,MAAM,CAAC,CAAC;QACrBuB,WAAW,EAAE9B,CAAC,CAACO,MAAM,CAAC,CAAC;QACvBkB,IAAI,EAAEzB,CAAC,CAACE,MAAM,CAAC;UACbwB,IAAI,EAAE1B,CAAC,CAACU,KAAK,CAACZ,GAAG;QACnB,CAAC,CAAC;QACFiC,QAAQ,EAAE/B,CAAC,CAACU,KAAK,CAACV,CAAC,CAACO,MAAM,CAAC,CAAC;MAC9B,CAAC,CAAC;MACFyB,iBAAiB,EAAEhC,CAAC,CAACE,MAAM,CAAC;QAC1B+B,iBAAiB,EAAEjC,CAAC,CAACO,MAAM,CAAC,CAAC;QAC7B2B,YAAY,EAAElC,CAAC,CAACO,MAAM,CAAC,CAAC;QACxB4B,UAAU,EAAEnC,CAAC,CAACO,MAAM,CAAC,CAAC;QACtB6B,QAAQ,EAAEpC,CAAC,CAACO,MAAM,CAAC,CAAC;QACpBwB,QAAQ,EAAE/B,CAAC,CAACU,KAAK,CAACV,CAAC,CAACO,MAAM,CAAC,CAAC;MAC9B,CAAC;IACH,CAAC,CAAC;IACF8B,eAAe,EAAErC,CAAC,CAACU,KAAK,CAACV,CAAC,CAACO,MAAM,CAAC,CAAC;EACrC,CAAC;AACH,CAAC,CAAC"}
+{"version":3,"names":["JWK","UnixTime","z","RequestObject","object","header","typ","literal","alg","string","kid","trust_chain","array","payload","iss","iat","exp","state","nonce","response_uri","response_type","response_mode","client_id","client_id_scheme","scope","RpEntityConfiguration","sub","jwks","keys","metadata","wallet_relying_party","application_type","client_name","contacts","federation_entity","organization_name","homepage_uri","policy_uri","logo_uri","authority_hints","QRCodePayload","protocol","resource","clientId","requestURI"],"sourceRoot":"../../../src","sources":["rp/types.ts"],"mappings":"AAAA,SAASA,GAAG,QAAQ,cAAc;AAClC,SAASC,QAAQ,QAAQ,iBAAiB;AAC1C,OAAO,KAAKC,CAAC,MAAM,KAAK;AAGxB,OAAO,MAAMC,aAAa,GAAGD,CAAC,CAACE,MAAM,CAAC;EACpCC,MAAM,EAAEH,CAAC,CAACE,MAAM,CAAC;IACfE,GAAG,EAAEJ,CAAC,CAACK,OAAO,CAAC,KAAK,CAAC;IACrBC,GAAG,EAAEN,CAAC,CAACO,MAAM,CAAC,CAAC;IACfC,GAAG,EAAER,CAAC,CAACO,MAAM,CAAC,CAAC;IACfE,WAAW,EAAET,CAAC,CAACU,KAAK,CAACV,CAAC,CAACO,MAAM,CAAC,CAAC;EACjC,CAAC,CAAC;EACFI,OAAO,EAAEX,CAAC,CAACE,MAAM,CAAC;IAChBU,GAAG,EAAEZ,CAAC,CAACO,MAAM,CAAC,CAAC;IACfM,GAAG,EAAEd,QAAQ;IACbe,GAAG,EAAEf,QAAQ;IACbgB,KAAK,EAAEf,CAAC,CAACO,MAAM,CAAC,CAAC;IACjBS,KAAK,EAAEhB,CAAC,CAACO,MAAM,CAAC,CAAC;IACjBU,YAAY,EAAEjB,CAAC,CAACO,MAAM,CAAC,CAAC;IACxBW,aAAa,EAAElB,CAAC,CAACK,OAAO,CAAC,UAAU,CAAC;IACpCc,aAAa,EAAEnB,CAAC,CAACK,OAAO,CAAC,iBAAiB,CAAC;IAC3Ce,SAAS,EAAEpB,CAAC,CAACO,MAAM,CAAC,CAAC;IACrBc,gBAAgB,EAAErB,CAAC,CAACK,OAAO,CAAC,WAAW,CAAC;IACxCiB,KAAK,EAAEtB,CAAC,CAACO,MAAM,CAAC;EAClB,CAAC;AACH,CAAC,CAAC;;AAEF;;AAEA,OAAO,MAAMgB,qBAAqB,GAAGvB,CAAC,CAACE,MAAM,CAAC;EAC5CC,MAAM,EAAEH,CAAC,CAACE,MAAM,CAAC;IACfE,GAAG,EAAEJ,CAAC,CAACK,OAAO,CAAC,sBAAsB,CAAC;IACtCC,GAAG,EAAEN,CAAC,CAACO,MAAM,CAAC,CAAC;IACfC,GAAG,EAAER,CAAC,CAACO,MAAM,CAAC;EAChB,CAAC,CAAC;EACFI,OAAO,EAAEX,CAAC,CAACE,MAAM,CAAC;IAChBY,GAAG,EAAEf,QAAQ;IACbc,GAAG,EAAEd,QAAQ;IACba,GAAG,EAAEZ,CAAC,CAACO,MAAM,CAAC,CAAC;IACfiB,GAAG,EAAExB,CAAC,CAACO,MAAM,CAAC,CAAC;IACfkB,IAAI,EAAEzB,CAAC,CAACE,MAAM,CAAC;MACbwB,IAAI,EAAE1B,CAAC,CAACU,KAAK,CAACZ,GAAG;IACnB,CAAC,CAAC;IACF6B,QAAQ,EAAE3B,CAAC,CAACE,MAAM,CAAC;MACjB0B,oBAAoB,EAAE5B,CAAC,CAACE,MAAM,CAAC;QAC7B2B,gBAAgB,EAAE7B,CAAC,CAACO,MAAM,CAAC,CAAC;QAC5Ba,SAAS,EAAEpB,CAAC,CAACO,MAAM,CAAC,CAAC;QACrBuB,WAAW,EAAE9B,CAAC,CAACO,MAAM,CAAC,CAAC;QACvBkB,IAAI,EAAEzB,CAAC,CAACE,MAAM,CAAC;UACbwB,IAAI,EAAE1B,CAAC,CAACU,KAAK,CAACZ,GAAG;QACnB,CAAC,CAAC;QACFiC,QAAQ,EAAE/B,CAAC,CAACU,KAAK,CAACV,CAAC,CAACO,MAAM,CAAC,CAAC;MAC9B,CAAC,CAAC;MACFyB,iBAAiB,EAAEhC,CAAC,CAACE,MAAM,CAAC;QAC1B+B,iBAAiB,EAAEjC,CAAC,CAACO,MAAM,CAAC,CAAC;QAC7B2B,YAAY,EAAElC,CAAC,CAACO,MAAM,CAAC,CAAC;QACxB4B,UAAU,EAAEnC,CAAC,CAACO,MAAM,CAAC,CAAC;QACtB6B,QAAQ,EAAEpC,CAAC,CAACO,MAAM,CAAC,CAAC;QACpBwB,QAAQ,EAAE/B,CAAC,CAACU,KAAK,CAACV,CAAC,CAACO,MAAM,CAAC,CAAC;MAC9B,CAAC;IACH,CAAC,CAAC;IACF8B,eAAe,EAAErC,CAAC,CAACU,KAAK,CAACV,CAAC,CAACO,MAAM,CAAC,CAAC;EACrC,CAAC;AACH,CAAC,CAAC;AAGF,OAAO,MAAM+B,aAAa,GAAGtC,CAAC,CAACE,MAAM,CAAC;EACpCqC,QAAQ,EAAEvC,CAAC,CAACK,OAAO,CAAC,QAAQ,CAAC;EAC7BmC,QAAQ,EAAExC,CAAC,CAACO,MAAM,CAAC,CAAC;EAAE;EACtBkC,QAAQ,EAAEzC,CAAC,CAACO,MAAM,CAAC,CAAC;EACpBmC,UAAU,EAAE1C,CAAC,CAACO,MAAM,CAAC;AACvB,CAAC,CAAC;;AAEF;AACA;AACA"}

package/lib/module/sd-jwt/__test__/index.test.js

@@ -0,0 +1,118 @@
+import { decode, disclose } from "../index";
+import { encodeBase64, decodeBase64 } from "@pagopa/io-react-native-jwt";
+import { SdJwt4VC } from "../types";
+
+// Examples from https://www.ietf.org/id/draft-terbu-sd-jwt-vc-02.html#name-example-4
+// but adapted to adhere to format declared in https://italia.github.io/eudi-wallet-it-docs/versione-corrente/en/pid-eaa-data-model.html#id2
+// In short, the token is a Frankenstein composed as follows:
+//  - the header is taken from the italian specification, with kid and alg valued according to the signing keys
+//  - disclosures are taken from the SD-JWT-4-VC standard
+//  - payload is taken from the italian specification, but _sd are compiled with:
+//    - "address" is used as verification._sd
+//    - all others disclosures are in claims._sd
+const token = "eyJ0eXAiOiJ2YytzZC1qd3QiLCJhbGciOiJFUzI1NiIsImtpZCI6ImIxODZlYTBjMTkyNTc5MzA5N2JmMDFiOGEyODlhNDVmIiwidHJ1c3RfY2hhaW4iOlsiTkVoUmRFUnBZbmxIWTNNNVdsZFdUV1oyYVVobSAuLi4iLCJleUpoYkdjaU9pSlNVekkxTmlJc0ltdHBaQ0k2IC4uLiIsIklrSllkbVp5Ykc1b1FVMTFTRkl3TjJGcVZXMUIgLi4uIl19.eyJpc3MiOiJodHRwczovL2V4YW1wbGUuY29tL2lzc3VlciIsInN1YiI6Ik56YkxzWGg4dURDY2Q3bm9XWEZaQWZIa3hac1JHQzlYcy4uLiIsImp0aSI6InVybjp1dWlkOjZjNWMwYTQ5LWI1ODktNDMxZC1iYWU3LTIxOTEyMmE5ZWMyYyIsImlhdCI6MTU0MTQ5MzcyNCwiZXhwIjoxNTQxNDkzNzI0LCJzdGF0dXMiOiJodHRwczovL2V4YW1wbGUuY29tL3N0YXR1cyIsImNuZiI6eyJqd2siOnsia3R5IjoiUlNBIiwidXNlIjoic2lnIiwibiI6IjFUYS1zRSIsImUiOiJBUUFCIiwia2lkIjoiWWhORlMzWW5DOXRqaUNhaXZoV0xWVUozQXh3R0d6Xzk4dVJGYXFNRUVzIn19LCJ0eXBlIjoiUGVyc29uSWRlbnRpZmljYXRpb25EYXRhIiwidmVyaWZpZWRfY2xhaW1zIjp7InZlcmlmaWNhdGlvbiI6eyJfc2QiOlsiSnpZakg0c3ZsaUgwUjNQeUVNZmVadTZKdDY5dTVxZWhabzdGN0VQWWxTRSJdLCJ0cnVzdF9mcmFtZXdvcmsiOiJlaWRhcyIsImFzc3VyYW5jZV9sZXZlbCI6ImhpZ2gifSwiY2xhaW1zIjp7Il9zZCI6WyIwOXZLckpNT2x5VFdNMHNqcHVfcGRPQlZCUTJNMXkzS2hwSDUxNW5Ya3BZIiwiMnJzakdiYUMwa3k4bVQwcEpyUGlvV1RxMF9kYXcxc1g3NnBvVWxnQ3diSSIsIkVrTzhkaFcwZEhFSmJ2VUhsRV9WQ2V1Qzl1UkVMT2llTFpoaDdYYlVUdEEiLCJJbER6SUtlaVpkRHdwcXBLNlpmYnlwaEZ2ejVGZ25XYS1zTjZ3cVFYQ2l3IiwiUG9yRmJwS3VWdTZ4eW1KYWd2a0ZzRlhBYlJvYzJKR2xBVUEyQkE0bzdjSSIsIlRHZjRvTGJnd2Q1SlFhSHlLVlFaVTlVZEdFMHc1cnREc3JaemZVYW9tTG8iLCJqZHJURThZY2JZNEVpZnVnaWhpQWVfQlBla3hKUVpJQ2VpVVF3WTlRcXhJIiwianN1OXlWdWx3UVFsaEZsTV8zSmx6TWFTRnpnbGhRRzBEcGZheVF3TFVLNCJdfX0sIl9zZF9hbGciOiJzaGEtMjU2In0.8wwSHCd47wCgzRYXvvPTTRXGS-hk9V8jRzy7WSjRBTZxSHxJkGOSWwBVAA-kpJ-IvQS7699aLWxIMqAvr34sOA~WyIyR0xDNDJzS1F2ZUNmR2ZyeU5STjl3IiwgImdpdmVuX25hbWUiLCAiSm9obiJd~WyJlbHVWNU9nM2dTTklJOEVZbnN4QV9BIiwgImZhbWlseV9uYW1lIiwgIkRvZSJd~WyI2SWo3dE0tYTVpVlBHYm9TNXRtdlZBIiwgImVtYWlsIiwgImpvaG5kb2VAZXhhbXBsZS5jb20iXQ~WyJlSThaV205UW5LUHBOUGVOZW5IZGhRIiwgInBob25lX251bWJlciIsICIrMS0yMDItNTU1LTAxMDEiXQ~WyJBSngtMDk1VlBycFR0TjRRTU9xUk9BIiwgImJpcnRoZGF0ZSIsICIxOTQwLTAxLTAxIl0~WyJQYzMzSk0yTGNoY1VfbEhnZ3ZfdWZRIiwgImlzX292ZXJfMTgiLCB0cnVlXQ~WyJHMDJOU3JRZmpGWFE3SW8wOXN5YWpBIiwgImlzX292ZXJfMjEiLCB0cnVlXQ~WyJsa2x4RjVqTVlsR1RQVW92TU5JdkNBIiwgImlzX292ZXJfNjUiLCB0cnVlXQ~WyJRZ19PNjR6cUF4ZTQxMmExMDhpcm9BIiwgImFkZHJlc3MiLCB7InN0cmVldF9hZGRyZXNzIjogIjEyMyBNYWluIFN0IiwgImxvY2FsaXR5IjogIkFueXRvd24iLCAicmVnaW9uIjogIkFueXN0YXRlIiwgImNvdW50cnkiOiAiVVMifV0";
+const unsigned = "eyJ0eXAiOiJ2YytzZC1qd3QiLCJhbGciOiJFUzI1NiIsImtpZCI6ImIxODZlYTBjMTkyNTc5MzA5N2JmMDFiOGEyODlhNDVmIiwidHJ1c3RfY2hhaW4iOlsiTkVoUmRFUnBZbmxIWTNNNVdsZFdUV1oyYVVobSAuLi4iLCJleUpoYkdjaU9pSlNVekkxTmlJc0ltdHBaQ0k2IC4uLiIsIklrSllkbVp5Ykc1b1FVMTFTRkl3TjJGcVZXMUIgLi4uIl19.eyJpc3MiOiJodHRwczovL2V4YW1wbGUuY29tL2lzc3VlciIsInN1YiI6Ik56YkxzWGg4dURDY2Q3bm9XWEZaQWZIa3hac1JHQzlYcy4uLiIsImp0aSI6InVybjp1dWlkOjZjNWMwYTQ5LWI1ODktNDMxZC1iYWU3LTIxOTEyMmE5ZWMyYyIsImlhdCI6MTU0MTQ5MzcyNCwiZXhwIjoxNTQxNDkzNzI0LCJzdGF0dXMiOiJodHRwczovL2V4YW1wbGUuY29tL3N0YXR1cyIsImNuZiI6eyJqd2siOnsia3R5IjoiUlNBIiwidXNlIjoic2lnIiwibiI6IjFUYS1zRSIsImUiOiJBUUFCIiwia2lkIjoiWWhORlMzWW5DOXRqaUNhaXZoV0xWVUozQXh3R0d6Xzk4dVJGYXFNRUVzIn19LCJ0eXBlIjoiUGVyc29uSWRlbnRpZmljYXRpb25EYXRhIiwidmVyaWZpZWRfY2xhaW1zIjp7InZlcmlmaWNhdGlvbiI6eyJfc2QiOlsiSnpZakg0c3ZsaUgwUjNQeUVNZmVadTZKdDY5dTVxZWhabzdGN0VQWWxTRSJdLCJ0cnVzdF9mcmFtZXdvcmsiOiJlaWRhcyIsImFzc3VyYW5jZV9sZXZlbCI6ImhpZ2gifSwiY2xhaW1zIjp7Il9zZCI6WyIwOXZLckpNT2x5VFdNMHNqcHVfcGRPQlZCUTJNMXkzS2hwSDUxNW5Ya3BZIiwiMnJzakdiYUMwa3k4bVQwcEpyUGlvV1RxMF9kYXcxc1g3NnBvVWxnQ3diSSIsIkVrTzhkaFcwZEhFSmJ2VUhsRV9WQ2V1Qzl1UkVMT2llTFpoaDdYYlVUdEEiLCJJbER6SUtlaVpkRHdwcXBLNlpmYnlwaEZ2ejVGZ25XYS1zTjZ3cVFYQ2l3IiwiUG9yRmJwS3VWdTZ4eW1KYWd2a0ZzRlhBYlJvYzJKR2xBVUEyQkE0bzdjSSIsIlRHZjRvTGJnd2Q1SlFhSHlLVlFaVTlVZEdFMHc1cnREc3JaemZVYW9tTG8iLCJqZHJURThZY2JZNEVpZnVnaWhpQWVfQlBla3hKUVpJQ2VpVVF3WTlRcXhJIiwianN1OXlWdWx3UVFsaEZsTV8zSmx6TWFTRnpnbGhRRzBEcGZheVF3TFVLNCJdfX0sIl9zZF9hbGciOiJzaGEtMjU2In0";
+const signature = "8wwSHCd47wCgzRYXvvPTTRXGS-hk9V8jRzy7WSjRBTZxSHxJkGOSWwBVAA-kpJ-IvQS7699aLWxIMqAvr34sOA";
+const signed = `${unsigned}.${signature}`;
+const tokenizedDisclosures = ["WyIyR0xDNDJzS1F2ZUNmR2ZyeU5STjl3IiwgImdpdmVuX25hbWUiLCAiSm9obiJd", "WyJlbHVWNU9nM2dTTklJOEVZbnN4QV9BIiwgImZhbWlseV9uYW1lIiwgIkRvZSJd", "WyI2SWo3dE0tYTVpVlBHYm9TNXRtdlZBIiwgImVtYWlsIiwgImpvaG5kb2VAZXhhbXBsZS5jb20iXQ", "WyJlSThaV205UW5LUHBOUGVOZW5IZGhRIiwgInBob25lX251bWJlciIsICIrMS0yMDItNTU1LTAxMDEiXQ", "WyJBSngtMDk1VlBycFR0TjRRTU9xUk9BIiwgImJpcnRoZGF0ZSIsICIxOTQwLTAxLTAxIl0", "WyJQYzMzSk0yTGNoY1VfbEhnZ3ZfdWZRIiwgImlzX292ZXJfMTgiLCB0cnVlXQ", "WyJHMDJOU3JRZmpGWFE3SW8wOXN5YWpBIiwgImlzX292ZXJfMjEiLCB0cnVlXQ", "WyJsa2x4RjVqTVlsR1RQVW92TU5JdkNBIiwgImlzX292ZXJfNjUiLCB0cnVlXQ", "WyJRZ19PNjR6cUF4ZTQxMmExMDhpcm9BIiwgImFkZHJlc3MiLCB7InN0cmVldF9hZGRyZXNzIjogIjEyMyBNYWluIFN0IiwgImxvY2FsaXR5IjogIkFueXRvd24iLCAicmVnaW9uIjogIkFueXN0YXRlIiwgImNvdW50cnkiOiAiVVMifV0"];
+const sdJwt = {
+  header: {
+    typ: "vc+sd-jwt",
+    alg: "ES256",
+    kid: "b186ea0c1925793097bf01b8a289a45f",
+    trust_chain: ["NEhRdERpYnlHY3M5WldWTWZ2aUhm ...", "eyJhbGciOiJSUzI1NiIsImtpZCI6 ...", "IkJYdmZybG5oQU11SFIwN2FqVW1B ..."]
+  },
+  payload: {
+    iss: "https://example.com/issuer",
+    sub: "NzbLsXh8uDCcd7noWXFZAfHkxZsRGC9Xs...",
+    jti: "urn:uuid:6c5c0a49-b589-431d-bae7-219122a9ec2c",
+    iat: 1541493724,
+    exp: 1541493724,
+    status: "https://example.com/status",
+    cnf: {
+      jwk: {
+        kty: "RSA",
+        use: "sig",
+        n: "1Ta-sE",
+        e: "AQAB",
+        kid: "YhNFS3YnC9tjiCaivhWLVUJ3AxwGGz_98uRFaqMEEs"
+      }
+    },
+    type: "PersonIdentificationData",
+    verified_claims: {
+      verification: {
+        _sd: ["JzYjH4svliH0R3PyEMfeZu6Jt69u5qehZo7F7EPYlSE"],
+        trust_framework: "eidas",
+        assurance_level: "high"
+      },
+      claims: {
+        _sd: ["09vKrJMOlyTWM0sjpu_pdOBVBQ2M1y3KhpH515nXkpY", "2rsjGbaC0ky8mT0pJrPioWTq0_daw1sX76poUlgCwbI", "EkO8dhW0dHEJbvUHlE_VCeuC9uRELOieLZhh7XbUTtA", "IlDzIKeiZdDwpqpK6ZfbyphFvz5FgnWa-sN6wqQXCiw", "PorFbpKuVu6xymJagvkFsFXAbRoc2JGlAUA2BA4o7cI", "TGf4oLbgwd5JQaHyKVQZU9UdGE0w5rtDsrZzfUaomLo", "jdrTE8YcbY4EifugihiAe_BPekxJQZICeiUQwY9QqxI", "jsu9yVulwQQlhFlM_3JlzMaSFzglhQG0DpfayQwLUK4"]
+      }
+    },
+    _sd_alg: "sha-256"
+  }
+};
+
+// In the very same order than tokenizedDisclosures
+const disclosures = [["2GLC42sKQveCfGfryNRN9w", "given_name", "John"], ["eluV5Og3gSNII8EYnsxA_A", "family_name", "Doe"], ["6Ij7tM-a5iVPGboS5tmvVA", "email", "johndoe@example.com"], ["eI8ZWm9QnKPpNPeNenHdhQ", "phone_number", "+1-202-555-0101"], ["AJx-095VPrpTtN4QMOqROA", "birthdate", "1940-01-01"], ["Pc33JM2LchcU_lHggv_ufQ", "is_over_18", true], ["G02NSrQfjFXQ7Io09syajA", "is_over_21", true], ["lklxF5jMYlGTPUovMNIvCA", "is_over_65", true], ["Qg_O64zqAxe412a108iroA", "address", {
+  street_address: "123 Main St",
+  locality: "Anytown",
+  region: "Anystate",
+  country: "US"
+}]];
+it("Ensures example data correctness", () => {
+  expect(JSON.parse(decodeBase64(encodeBase64(JSON.stringify(sdJwt.header))))).toEqual(sdJwt.header);
+  expect([signed, ...tokenizedDisclosures].join("~")).toBe(token);
+});
+describe("decode", () => {
+  it("should decode a valid token", () => {
+    const result = decode(token, SdJwt4VC);
+    expect(result).toEqual({
+      sdJwt,
+      disclosures: disclosures.map((decoded, i) => ({
+        decoded,
+        encoded: tokenizedDisclosures[i]
+      }))
+    });
+  });
+});
+describe("disclose", () => {
+  it("should encode a valid sdjwt (one claim)", async () => {
+    const result = await disclose(token, ["given_name"]);
+    const expected = {
+      token: `${signed}~WyIyR0xDNDJzS1F2ZUNmR2ZyeU5STjl3IiwgImdpdmVuX25hbWUiLCAiSm9obiJd`,
+      paths: [{
+        claim: "given_name",
+        path: "verified_claims.claims._sd[7]"
+      }]
+    };
+    expect(result).toEqual(expected);
+  });
+  it("should encode a valid sdjwt (no claims)", async () => {
+    const result = await disclose(token, []);
+    const expected = {
+      token: `${signed}`,
+      paths: []
+    };
+    expect(result).toEqual(expected);
+  });
+  it("should encode a valid sdjwt (multiple claims)", async () => {
+    const result = await disclose(token, ["given_name", "email"]);
+    const expected = {
+      token: `${signed}~WyIyR0xDNDJzS1F2ZUNmR2ZyeU5STjl3IiwgImdpdmVuX25hbWUiLCAiSm9obiJd~WyI2SWo3dE0tYTVpVlBHYm9TNXRtdlZBIiwgImVtYWlsIiwgImpvaG5kb2VAZXhhbXBsZS5jb20iXQ`,
+      paths: [{
+        claim: "given_name",
+        path: "verified_claims.claims._sd[7]"
+      }, {
+        claim: "email",
+        path: "verified_claims.verification._sd[0]"
+      }]
+    };
+    expect(result).toEqual(expected);
+  });
+  it("should fail on unknown claim", async () => {
+    const fn = async () => disclose(token, ["unknown"]);
+    await expect(fn()).rejects.toEqual(expect.any(Error));
+  });
+});
+//# sourceMappingURL=index.test.js.map

package/lib/module/sd-jwt/__test__/index.test.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["decode","disclose","encodeBase64","decodeBase64","SdJwt4VC","token","unsigned","signature","signed","tokenizedDisclosures","sdJwt","header","typ","alg","kid","trust_chain","payload","iss","sub","jti","iat","exp","status","cnf","jwk","kty","use","n","e","type","verified_claims","verification","_sd","trust_framework","assurance_level","claims","_sd_alg","disclosures","street_address","locality","region","country","it","expect","JSON","parse","stringify","toEqual","join","toBe","describe","result","map","decoded","i","encoded","expected","paths","claim","path","fn","rejects","any","Error"],"sourceRoot":"../../../../src","sources":["sd-jwt/__test__/index.test.ts"],"mappings":"AAAA,SAASA,MAAM,EAAEC,QAAQ,QAAQ,UAAU;AAE3C,SAASC,YAAY,EAAEC,YAAY,QAAQ,6BAA6B;AACxE,SAASC,QAAQ,QAAQ,UAAU;;AAEnC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMC,KAAK,GACT,kvEAAkvE;AAEpvE,MAAMC,QAAQ,GACZ,87CAA87C;AAEh8C,MAAMC,SAAS,GACb,wFAAwF;AAE1F,MAAMC,MAAM,GAAI,GAAEF,QAAS,IAAGC,SAAU,EAAC;AAEzC,MAAME,oBAAoB,GAAG,CAC3B,kEAAkE,EAClE,kEAAkE,EAClE,gFAAgF,EAChF,oFAAoF,EACpF,yEAAyE,EACzE,gEAAgE,EAChE,gEAAgE,EAChE,gEAAgE,EAChE,qLAAqL,CACtL;AAED,MAAMC,KAAK,GAAG;EACZC,MAAM,EAAE;IACNC,GAAG,EAAE,WAAW;IAChBC,GAAG,EAAE,OAAO;IACZC,GAAG,EAAE,kCAAkC;IACvCC,WAAW,EAAE,CACX,kCAAkC,EAClC,kCAAkC,EAClC,kCAAkC;EAEtC,CAAC;EACDC,OAAO,EAAE;IACPC,GAAG,EAAE,4BAA4B;IACjCC,GAAG,EAAE,sCAAsC;IAC3CC,GAAG,EAAE,+CAA+C;IACpDC,GAAG,EAAE,UAAU;IACfC,GAAG,EAAE,UAAU;IACfC,MAAM,EAAE,4BAA4B;IACpCC,GAAG,EAAE;MACHC,GAAG,EAAE;QACHC,GAAG,EAAE,KAAK;QACVC,GAAG,EAAE,KAAK;QACVC,CAAC,EAAE,QAAQ;QACXC,CAAC,EAAE,MAAM;QACTd,GAAG,EAAE;MACP;IACF,CAAC;IACDe,IAAI,EAAE,0BAA0B;IAChCC,eAAe,EAAE;MACfC,YAAY,EAAE;QACZC,GAAG,EAAE,CAAC,6CAA6C,CAAC;QACpDC,eAAe,EAAE,OAAO;QACxBC,eAAe,EAAE;MACnB,CAAC;MACDC,MAAM,EAAE;QACNH,GAAG,EAAE,CACH,6CAA6C,EAC7C,6CAA6C,EAC7C,6CAA6C,EAC7C,6CAA6C,EAC7C,6CAA6C,EAC7C,6CAA6C,EAC7C,6CAA6C,EAC7C,6CAA6C;MAEjD;IACF,CAAC;IACDI,OAAO,EAAE;EACX;AACF,CAAC;;AAED;AACA,MAAMC,WAAW,GAAG,CAClB,CAAC,wBAAwB,EAAE,YAAY,EAAE,MAAM,CAAC,EAChD,CAAC,wBAAwB,EAAE,aAAa,EAAE,KAAK,CAAC,EAChD,CAAC,wBAAwB,EAAE,OAAO,EAAE,qBAAqB,CAAC,EAC1D,CAAC,wBAAwB,EAAE,cAAc,EAAE,iBAAiB,CAAC,EAC7D,CAAC,wBAAwB,EAAE,WAAW,EAAE,YAAY,CAAC,EACrD,CAAC,wBAAwB,EAAE,YAAY,EAAE,IAAI,CAAC,EAC9C,CAAC,wBAAwB,EAAE,YAAY,EAAE,IAAI,CAAC,EAC9C,CAAC,wBAAwB,EAAE,YAAY,EAAE,IAAI,CAAC,EAC9C,CACE,wBAAwB,EACxB,SAAS,EACT;EACEC,cAAc,EAAE,aAAa;EAC7BC,QAAQ,EAAE,SAAS;EACnBC,MAAM,EAAE,UAAU;EAClBC,OAAO,EAAE;AACX,CAAC,CACF,CACF;AACDC,EAAE,CAAC,kCAAkC,EAAE,MAAM;EAC3CC,MAAM,CACJC,IAAI,CAACC,KAAK,CAAC1C,YAAY,CAACD,YAAY,CAAC0C,IAAI,CAACE,SAAS,CAACpC,KAAK,CAACC,MAAM,CAAC,CAAC,CAAC,CACrE,CAAC,CAACoC,OAAO,CAACrC,KAAK,CAACC,MAAM,CAAC;EACvBgC,MAAM,CAAC,CAACnC,MAAM,EAAE,GAAGC,oBAAoB,CAAC,CAACuC,IAAI,CAAC,GAAG,CAAC,CAAC,CAACC,IAAI,CAAC5C,KAAK,CAAC;AACjE,CAAC,CAAC;AAEF6C,QAAQ,CAAC,QAAQ,EAAE,MAAM;EACvBR,EAAE,CAAC,6BAA6B,EAAE,MAAM;IACtC,MAAMS,MAAM,GAAGnD,MAAM,CAACK,KAAK,EAAED,QAAQ,CAAC;IACtCuC,MAAM,CAACQ,MAAM,CAAC,CAACJ,OAAO,CAAC;MACrBrC,KAAK;MACL2B,WAAW,EAAEA,WAAW,CAACe,GAAG,CAAC,CAACC,OAAO,EAAEC,CAAC,MAAM;QAC5CD,OAAO;QACPE,OAAO,EAAE9C,oBAAoB,CAAC6C,CAAC;MACjC,CAAC,CAAC;IACJ,CAAC,CAAC;EACJ,CAAC,CAAC;AACJ,CAAC,CAAC;AAEFJ,QAAQ,CAAC,UAAU,EAAE,MAAM;EACzBR,EAAE,CAAC,yCAAyC,EAAE,YAAY;IACxD,MAAMS,MAAM,GAAG,MAAMlD,QAAQ,CAACI,KAAK,EAAE,CAAC,YAAY,CAAC,CAAC;IACpD,MAAMmD,QAAQ,GAAG;MACfnD,KAAK,EAAG,GAAEG,MAAO,mEAAkE;MACnFiD,KAAK,EAAE,CAAC;QAAEC,KAAK,EAAE,YAAY;QAAEC,IAAI,EAAE;MAAgC,CAAC;IACxE,CAAC;IAEDhB,MAAM,CAACQ,MAAM,CAAC,CAACJ,OAAO,CAACS,QAAQ,CAAC;EAClC,CAAC,CAAC;EAEFd,EAAE,CAAC,yCAAyC,EAAE,YAAY;IACxD,MAAMS,MAAM,GAAG,MAAMlD,QAAQ,CAACI,KAAK,EAAE,EAAE,CAAC;IACxC,MAAMmD,QAAQ,GAAG;MAAEnD,KAAK,EAAG,GAAEG,MAAO,EAAC;MAAEiD,KAAK,EAAE;IAAG,CAAC;IAElDd,MAAM,CAACQ,MAAM,CAAC,CAACJ,OAAO,CAACS,QAAQ,CAAC;EAClC,CAAC,CAAC;EAEFd,EAAE,CAAC,+CAA+C,EAAE,YAAY;IAC9D,MAAMS,MAAM,GAAG,MAAMlD,QAAQ,CAACI,KAAK,EAAE,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAC7D,MAAMmD,QAAQ,GAAG;MACfnD,KAAK,EAAG,GAAEG,MAAO,kJAAiJ;MAClKiD,KAAK,EAAE,CACL;QACEC,KAAK,EAAE,YAAY;QACnBC,IAAI,EAAE;MACR,CAAC,EACD;QACED,KAAK,EAAE,OAAO;QACdC,IAAI,EAAE;MACR,CAAC;IAEL,CAAC;IAEDhB,MAAM,CAACQ,MAAM,CAAC,CAACJ,OAAO,CAACS,QAAQ,CAAC;EAClC,CAAC,CAAC;EAEFd,EAAE,CAAC,8BAA8B,EAAE,YAAY;IAC7C,MAAMkB,EAAE,GAAG,MAAAA,CAAA,KAAY3D,QAAQ,CAACI,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC;IAEnD,MAAMsC,MAAM,CAACiB,EAAE,CAAC,CAAC,CAAC,CAACC,OAAO,CAACd,OAAO,CAACJ,MAAM,CAACmB,GAAG,CAACC,KAAK,CAAC,CAAC;EACvD,CAAC,CAAC;AACJ,CAAC,CAAC"}

package/lib/module/sd-jwt/index.js

@@ -1,8 +1,18 @@
 import { decode as decodeJwt } from "@pagopa/io-react-native-jwt";
 import { verify as verifyJwt } from "@pagopa/io-react-native-jwt";
+import { sha256ToBase64 } from "@pagopa/io-react-native-jwt";
 import { decodeBase64 } from "@pagopa/io-react-native-jwt";
-import { Disclosure } from "./types";
+import { Disclosure, SdJwt4VC } from "./types";
 import { verifyDisclosure } from "./verifier";
+import { ClaimsNotFoundBetweenDislosures, ClaimsNotFoundInToken } from "../utils/errors";
+const decodeDisclosure = encoded => {
+  const decoded = Disclosure.parse(JSON.parse(decodeBase64(encoded)));
+  return {
+    decoded,
+    encoded
+  };
+};
+
 /**
  * Decode a given SD-JWT with Disclosures to get the parsed SD-JWT object they define.
  * It ensures provided data is in a valid shape.
@@ -35,13 +45,80 @@ export const decode = (token, schema) => {
   // get disclosures as list of triples
   // validate each triple
   // throw a validation error if at least one fails to parse
-  const disclosures = rawDisclosures.map(decodeBase64).map(e => JSON.parse(e)).map(e => Disclosure.parse(e));
+  const disclosures = rawDisclosures.map(decodeDisclosure);
   return {
     sdJwt,
     disclosures
   };
 };
 
+/**
+ * Select disclosures from a given SD-JWT with Disclosures.
+ * Claims relate with disclosures by their name.
+ *
+ * @function
+ * @param token The encoded token that represents a valid sd-jwt for verifiable credentials
+ * @param claims The list of claims to be disclosed
+ *
+ * @throws {ClaimsNotFoundBetweenDislosures} When one or more claims does not relate to any discloure.
+ * @throws {ClaimsNotFoundInToken} When one or more claims are not contained in the SD-JWT token.
+ * @returns The encoded token with only the requested disclosures, along with the path each claim can be found on the SD-JWT token
+ *
+ */
+export const disclose = async (token, claims) => {
+  const [rawSdJwt, ...rawDisclosures] = token.split("~");
+  const {
+    sdJwt,
+    disclosures
+  } = decode(token, SdJwt4VC);
+
+  // for each claim, return the path on which they are located in the SD-JWT token
+  const paths = await Promise.all(claims.map(async claim => {
+    const disclosure = disclosures.find(_ref => {
+      let {
+        decoded: [, name]
+      } = _ref;
+      return name === claim;
+    });
+
+    // check every claim represents a known disclosure
+    if (!disclosure) {
+      throw new ClaimsNotFoundBetweenDislosures(claim);
+    }
+    const hash = await sha256ToBase64(disclosure.encoded);
+
+    // _sd is defined in verified_claims.claims and verified_claims.verification
+    // we must look into both
+    if (sdJwt.payload.verified_claims.claims._sd.includes(hash)) {
+      const index = sdJwt.payload.verified_claims.claims._sd.indexOf(hash);
+      return {
+        claim,
+        path: `verified_claims.claims._sd[${index}]`
+      };
+    } else if (sdJwt.payload.verified_claims.verification._sd.includes(hash)) {
+      const index = sdJwt.payload.verified_claims.verification._sd.indexOf(hash);
+      return {
+        claim,
+        path: `verified_claims.verification._sd[${index}]`
+      };
+    }
+    throw new ClaimsNotFoundInToken(claim);
+  }));
+  const filteredDisclosures = rawDisclosures.filter(d => {
+    const {
+      decoded: [, name]
+    } = decodeDisclosure(d);
+    return claims.includes(name);
+  });
+
+  // compose the final disclosed token
+  const disclosedToken = [rawSdJwt, ...filteredDisclosures].join("~");
+  return {
+    token: disclosedToken,
+    paths
+  };
+};
+
 /**
  * Verify a given SD-JWT with Disclosures
  * Same as {@link decode} plus:
@@ -69,6 +146,9 @@ export const verify = async (token, publicKey, schema) => {
   //Check disclosures in sd-jwt
   const claims = [...decoded.sdJwt.payload.verified_claims.verification._sd, ...decoded.sdJwt.payload.verified_claims.claims._sd];
   await Promise.all(decoded.disclosures.map(async disclosure => await verifyDisclosure(disclosure, claims)));
-  return decoded;
+  return {
+    sdJwt: decoded.sdJwt,
+    disclosures: decoded.disclosures.map(d => d.decoded)
+  };
 };
 //# sourceMappingURL=index.js.map

package/lib/module/sd-jwt/index.js.map

@@ -1 +1 @@
-{"version":3,"names":["decode","decodeJwt","verify","verifyJwt","decodeBase64","Disclosure","verifyDisclosure","token","schema","slice","rawSdJwt","rawDisclosures","split","decodedJwt","sdJwt","parse","header","protectedHeader","payload","disclosures","map","e","JSON","publicKey","decoded","claims","verified_claims","verification","_sd","Promise","all","disclosure"],"sourceRoot":"../../../src","sources":["sd-jwt/index.ts"],"mappings":"AAEA,SAASA,MAAM,IAAIC,SAAS,QAAQ,6BAA6B;AACjE,SAASC,MAAM,IAAIC,SAAS,QAAQ,6BAA6B;AAEjE,SAASC,YAAY,QAAQ,6BAA6B;AAC1D,SAASC,UAAU,QAAQ,SAAS;AACpC,SAASC,gBAAgB,QAAQ,YAAY;AAG7C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMN,MAAM,GAAGA,CACpBO,KAAa,EACbC,MAAS,KAC4C;EACrD;EACA,IAAID,KAAK,CAACE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE;IAC3BF,KAAK,GAAGA,KAAK,CAACE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;EAC5B;EACA,MAAM,CAACC,QAAQ,GAAG,EAAE,EAAE,GAAGC,cAAc,CAAC,GAAGJ,KAAK,CAACK,KAAK,CAAC,GAAG,CAAC;;EAE3D;EACA;EACA,MAAMC,UAAU,GAAGZ,SAAS,CAACS,QAAQ,CAAC;EACtC,MAAMI,KAAK,GAAGN,MAAM,CAACO,KAAK,CAAC;IACzBC,MAAM,EAAEH,UAAU,CAACI,eAAe;IAClCC,OAAO,EAAEL,UAAU,CAACK;EACtB,CAAC,CAAC;;EAEF;EACA;EACA;EACA,MAAMC,WAAW,GAAGR,cAAc,CAC/BS,GAAG,CAAChB,YAAY,CAAC,CACjBgB,GAAG,CAAEC,CAAC,IAAKC,IAAI,CAACP,KAAK,CAACM,CAAC,CAAC,CAAC,CACzBD,GAAG,CAAEC,CAAC,IAAKhB,UAAU,CAACU,KAAK,CAACM,CAAC,CAAC,CAAC;EAElC,OAAO;IAAEP,KAAK;IAAEK;EAAY,CAAC;AAC/B,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMjB,MAAM,GAAG,MAAAA,CACpBK,KAAa,EACbgB,SAAc,EACdf,MAAS,KACqD;EAC9D;EACA,MAAM,CAACE,QAAQ,GAAG,EAAE,CAAC,GAAGH,KAAK,CAACK,KAAK,CAAC,GAAG,CAAC;EACxC,MAAMY,OAAO,GAAGxB,MAAM,CAACO,KAAK,EAAEC,MAAM,CAAC;;EAErC;EACA,MAAML,SAAS,CAACO,QAAQ,EAAEa,SAAS,CAAC;;EAEpC;EACA,MAAME,MAAM,GAAG,CACb,GAAGD,OAAO,CAACV,KAAK,CAACI,OAAO,CAACQ,eAAe,CAACC,YAAY,CAACC,GAAG,EACzD,GAAGJ,OAAO,CAACV,KAAK,CAACI,OAAO,CAACQ,eAAe,CAACD,MAAM,CAACG,GAAG,CACpD;EAED,MAAMC,OAAO,CAACC,GAAG,CACfN,OAAO,CAACL,WAAW,CAACC,GAAG,CACrB,MAAOW,UAAU,IAAK,MAAMzB,gBAAgB,CAACyB,UAAU,EAAEN,MAAM,CACjE,CACF,CAAC;EAED,OAAOD,OAAO;AAChB,CAAC"}
+{"version":3,"names":["decode","decodeJwt","verify","verifyJwt","sha256ToBase64","decodeBase64","Disclosure","SdJwt4VC","verifyDisclosure","ClaimsNotFoundBetweenDislosures","ClaimsNotFoundInToken","decodeDisclosure","encoded","decoded","parse","JSON","token","schema","slice","rawSdJwt","rawDisclosures","split","decodedJwt","sdJwt","header","protectedHeader","payload","disclosures","map","disclose","claims","paths","Promise","all","claim","disclosure","find","_ref","name","hash","verified_claims","_sd","includes","index","indexOf","path","verification","filteredDisclosures","filter","d","disclosedToken","join","publicKey"],"sourceRoot":"../../../src","sources":["sd-jwt/index.ts"],"mappings":"AAEA,SAASA,MAAM,IAAIC,SAAS,QAAQ,6BAA6B;AACjE,SAASC,MAAM,IAAIC,SAAS,QAAQ,6BAA6B;AACjE,SAASC,cAAc,QAAQ,6BAA6B;AAE5D,SAASC,YAAY,QAAQ,6BAA6B;AAC1D,SAASC,UAAU,EAAEC,QAAQ,QAAoC,SAAS;AAC1E,SAASC,gBAAgB,QAAQ,YAAY;AAE7C,SACEC,+BAA+B,EAC/BC,qBAAqB,QAChB,iBAAiB;AAExB,MAAMC,gBAAgB,GAAIC,OAAe,IAA4B;EACnE,MAAMC,OAAO,GAAGP,UAAU,CAACQ,KAAK,CAACC,IAAI,CAACD,KAAK,CAACT,YAAY,CAACO,OAAO,CAAC,CAAC,CAAC;EACnE,OAAO;IAAEC,OAAO;IAAED;EAAQ,CAAC;AAC7B,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMZ,MAAM,GAAGA,CACpBgB,KAAa,EACbC,MAAS,KAIN;EACH;EACA,IAAID,KAAK,CAACE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE;IAC3BF,KAAK,GAAGA,KAAK,CAACE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;EAC5B;EACA,MAAM,CAACC,QAAQ,GAAG,EAAE,EAAE,GAAGC,cAAc,CAAC,GAAGJ,KAAK,CAACK,KAAK,CAAC,GAAG,CAAC;;EAE3D;EACA;EACA,MAAMC,UAAU,GAAGrB,SAAS,CAACkB,QAAQ,CAAC;EACtC,MAAMI,KAAK,GAAGN,MAAM,CAACH,KAAK,CAAC;IACzBU,MAAM,EAAEF,UAAU,CAACG,eAAe;IAClCC,OAAO,EAAEJ,UAAU,CAACI;EACtB,CAAC,CAAC;;EAEF;EACA;EACA;EACA,MAAMC,WAAW,GAAGP,cAAc,CAACQ,GAAG,CAACjB,gBAAgB,CAAC;EAExD,OAAO;IAAEY,KAAK;IAAEI;EAAY,CAAC;AAC/B,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAME,QAAQ,GAAG,MAAAA,CACtBb,KAAa,EACbc,MAAgB,KACyD;EACzE,MAAM,CAACX,QAAQ,EAAE,GAAGC,cAAc,CAAC,GAAGJ,KAAK,CAACK,KAAK,CAAC,GAAG,CAAC;EACtD,MAAM;IAAEE,KAAK;IAAEI;EAAY,CAAC,GAAG3B,MAAM,CAACgB,KAAK,EAAET,QAAQ,CAAC;;EAEtD;EACA,MAAMwB,KAAK,GAAG,MAAMC,OAAO,CAACC,GAAG,CAC7BH,MAAM,CAACF,GAAG,CAAC,MAAOM,KAAK,IAAK;IAC1B,MAAMC,UAAU,GAAGR,WAAW,CAACS,IAAI,CACjCC,IAAA;MAAA,IAAC;QAAExB,OAAO,EAAE,GAAGyB,IAAI;MAAE,CAAC,GAAAD,IAAA;MAAA,OAAKC,IAAI,KAAKJ,KAAK;IAAA,CAC3C,CAAC;;IAED;IACA,IAAI,CAACC,UAAU,EAAE;MACf,MAAM,IAAI1B,+BAA+B,CAACyB,KAAK,CAAC;IAClD;IAEA,MAAMK,IAAI,GAAG,MAAMnC,cAAc,CAAC+B,UAAU,CAACvB,OAAO,CAAC;;IAErD;IACA;IACA,IAAIW,KAAK,CAACG,OAAO,CAACc,eAAe,CAACV,MAAM,CAACW,GAAG,CAACC,QAAQ,CAACH,IAAI,CAAC,EAAE;MAC3D,MAAMI,KAAK,GAAGpB,KAAK,CAACG,OAAO,CAACc,eAAe,CAACV,MAAM,CAACW,GAAG,CAACG,OAAO,CAACL,IAAI,CAAC;MACpE,OAAO;QAAEL,KAAK;QAAEW,IAAI,EAAG,8BAA6BF,KAAM;MAAG,CAAC;IAChE,CAAC,MAAM,IACLpB,KAAK,CAACG,OAAO,CAACc,eAAe,CAACM,YAAY,CAACL,GAAG,CAACC,QAAQ,CAACH,IAAI,CAAC,EAC7D;MACA,MAAMI,KAAK,GACTpB,KAAK,CAACG,OAAO,CAACc,eAAe,CAACM,YAAY,CAACL,GAAG,CAACG,OAAO,CAACL,IAAI,CAAC;MAC9D,OAAO;QAAEL,KAAK;QAAEW,IAAI,EAAG,oCAAmCF,KAAM;MAAG,CAAC;IACtE;IAEA,MAAM,IAAIjC,qBAAqB,CAACwB,KAAK,CAAC;EACxC,CAAC,CACH,CAAC;EAED,MAAMa,mBAAmB,GAAG3B,cAAc,CAAC4B,MAAM,CAAEC,CAAC,IAAK;IACvD,MAAM;MACJpC,OAAO,EAAE,GAAGyB,IAAI;IAClB,CAAC,GAAG3B,gBAAgB,CAACsC,CAAC,CAAC;IACvB,OAAOnB,MAAM,CAACY,QAAQ,CAACJ,IAAI,CAAC;EAC9B,CAAC,CAAC;;EAEF;EACA,MAAMY,cAAc,GAAG,CAAC/B,QAAQ,EAAE,GAAG4B,mBAAmB,CAAC,CAACI,IAAI,CAAC,GAAG,CAAC;EAEnE,OAAO;IAAEnC,KAAK,EAAEkC,cAAc;IAAEnB;EAAM,CAAC;AACzC,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAM7B,MAAM,GAAG,MAAAA,CACpBc,KAAa,EACboC,SAAc,EACdnC,MAAS,KACqD;EAC9D;EACA,MAAM,CAACE,QAAQ,GAAG,EAAE,CAAC,GAAGH,KAAK,CAACK,KAAK,CAAC,GAAG,CAAC;EACxC,MAAMR,OAAO,GAAGb,MAAM,CAACgB,KAAK,EAAEC,MAAM,CAAC;;EAErC;EACA,MAAMd,SAAS,CAACgB,QAAQ,EAAEiC,SAAS,CAAC;;EAEpC;EACA,MAAMtB,MAAM,GAAG,CACb,GAAGjB,OAAO,CAACU,KAAK,CAACG,OAAO,CAACc,eAAe,CAACM,YAAY,CAACL,GAAG,EACzD,GAAG5B,OAAO,CAACU,KAAK,CAACG,OAAO,CAACc,eAAe,CAACV,MAAM,CAACW,GAAG,CACpD;EAED,MAAMT,OAAO,CAACC,GAAG,CACfpB,OAAO,CAACc,WAAW,CAACC,GAAG,CACrB,MAAOO,UAAU,IAAK,MAAM3B,gBAAgB,CAAC2B,UAAU,EAAEL,MAAM,CACjE,CACF,CAAC;EAED,OAAO;IACLP,KAAK,EAAEV,OAAO,CAACU,KAAK;IACpBI,WAAW,EAAEd,OAAO,CAACc,WAAW,CAACC,GAAG,CAAEqB,CAAC,IAAKA,CAAC,CAACpC,OAAO;EACvD,CAAC;AACH,CAAC"}