@pagopa/io-react-native-wallet 2.5.1 → 3.0.0

package/lib/module/trust/build-chain.js

@@ -1,238 +0,0 @@
-import { BuildTrustChainError, FederationListParseError, MissingFederationFetchEndpointError, RelyingPartyNotAuthorizedError, TrustAnchorKidMissingError } from "./errors";
-import { decode, verify } from "./utils";
-import { CredentialIssuerEntityConfiguration, EntityConfiguration, EntityStatement, FederationListResponse, RelyingPartyEntityConfiguration, TrustAnchorEntityConfiguration, WalletProviderEntityConfiguration } from "./types";
-import { hasStatusOrThrow } from "../utils/misc";
-import { decode as decodeJwt } from "@pagopa/io-react-native-jwt";
-
-/**
- * Fetch and parse the entity configuration document for a given federation entity.
- * This is an inner method to serve public interfaces.
- *
- * To add another entity configuration type (example: Foo entity type):
- *  - create its zod schema and type by inherit from the base type (example: FooEntityConfiguration = BaseEntityConfiguration.and(...))
- *  - add such type to EntityConfiguration union
- *  - add an overload to this function
- *  - create a public function which use such type (example: getFooEntityConfiguration = (url, options) => Promise<FooEntityConfiguration>)
- *
- * @param entityBaseUrl The base url of the entity.
- * @param schema The expected schema of the entity configuration, according to the kind of entity we are fetching from.
- * @param options An optional object with additional options.
- * @param options.appFetch An optional instance of the http client to be used.
- * @returns The parsed entity configuration object
- * @throws {IoWalletError} If the http request fails
- * @throws Parse error if the document is not in the expected shape.
- */
-
-async function fetchAndParseEntityConfiguration(entityBaseUrl, schema) {
-  let {
-    appFetch = fetch
-  } = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : {};
-  const responseText = await getSignedEntityConfiguration(entityBaseUrl, {
-    appFetch
-  });
-  const responseJwt = decodeJwt(responseText);
-  return schema.parse({
-    header: responseJwt.protectedHeader,
-    payload: responseJwt.payload
-  });
-}
-export const getWalletProviderEntityConfiguration = (entityBaseUrl, options) => fetchAndParseEntityConfiguration(entityBaseUrl, WalletProviderEntityConfiguration, options);
-export const getCredentialIssuerEntityConfiguration = (entityBaseUrl, options) => fetchAndParseEntityConfiguration(entityBaseUrl, CredentialIssuerEntityConfiguration, options);
-export const getTrustAnchorEntityConfiguration = (entityBaseUrl, options) => fetchAndParseEntityConfiguration(entityBaseUrl, TrustAnchorEntityConfiguration, options);
-export const getRelyingPartyEntityConfiguration = (entityBaseUrl, options) => fetchAndParseEntityConfiguration(entityBaseUrl, RelyingPartyEntityConfiguration, options);
-export const getEntityConfiguration = (entityBaseUrl, options) => fetchAndParseEntityConfiguration(entityBaseUrl, EntityConfiguration, options);
-
-/**
- * Fetch and parse the entity statement document for a given federation entity.
- *
- * @param accreditationBodyBaseUrl The base url of the accreditation body which holds and signs the required entity statement
- * @param subordinatedEntityBaseUrl The url that identifies the subordinate entity
- * @param appFetch An optional instance of the http client to be used.
- * @returns The parsed entity configuration object
- * @throws {IoWalletError} If the http request fails
- */
-export async function getEntityStatement(accreditationBodyBaseUrl, subordinatedEntityBaseUrl) {
-  let {
-    appFetch = fetch
-  } = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : {};
-  const responseText = await getSignedEntityStatement(accreditationBodyBaseUrl, subordinatedEntityBaseUrl, {
-    appFetch
-  });
-  const responseJwt = decodeJwt(responseText);
-  return EntityStatement.parse({
-    header: responseJwt.protectedHeader,
-    payload: responseJwt.payload
-  });
-}
-
-/**
- * Fetch the signed entity configuration token for an entity
- *
- * @param entityBaseUrl The url of the entity to fetch
- * @param appFetch (optional) fetch api implementation
- * @returns The signed Entity Configuration token
- */
-export async function getSignedEntityConfiguration(entityBaseUrl) {
-  let {
-    appFetch = fetch
-  } = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};
-  const wellKnownUrl = `${entityBaseUrl}/.well-known/openid-federation`;
-  return await appFetch(wellKnownUrl, {
-    method: "GET"
-  }).then(hasStatusOrThrow(200)).then(res => res.text());
-}
-
-/**
- * Fetch the entity statement document for a given federation entity.
- *
- * @param federationFetchEndpoint The exact endpoint provided by the parent EC's metadata.
- * @param subordinatedEntityBaseUrl The url that identifies the subordinate entity.
- * @param appFetch An optional instance of the http client to be used.
- * @returns The signed entity statement token.
- * @throws {IoWalletError} If the http request fails.
- */
-export async function getSignedEntityStatement(federationFetchEndpoint, subordinatedEntityBaseUrl) {
-  let {
-    appFetch = fetch
-  } = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : {};
-  const url = new URL(federationFetchEndpoint);
-  url.searchParams.set("sub", subordinatedEntityBaseUrl);
-  return await appFetch(url.toString(), {
-    method: "GET"
-  }).then(hasStatusOrThrow(200)).then(res => res.text());
-}
-
-/**
- * Fetch the federation list document from a given endpoint.
- *
- * @param federationListEndpoint The URL of the federation list endpoint.
- * @param appFetch An optional instance of the http client to be used.
- * @returns The federation list as an array of strings.
- * @throws {IoWalletError} If the HTTP request fails.
- * @throws {FederationError} If the result is not in the expected format.
- */
-export async function getFederationList(federationListEndpoint) {
-  let {
-    appFetch = fetch
-  } = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};
-  return await appFetch(federationListEndpoint, {
-    method: "GET"
-  }).then(hasStatusOrThrow(200)).then(res => res.json()).then(json => {
-    const result = FederationListResponse.safeParse(json);
-    if (!result.success) {
-      throw new FederationListParseError(`Invalid federation list format received from ${federationListEndpoint}. Error: ${result.error.message}`, {
-        url: federationListEndpoint,
-        parseError: result.error.toString()
-      });
-    }
-    return result.data;
-  });
-}
-
-/**
- * Build a not-verified trust chain for a given Relying Party (RP) entity.
- *
- * @param relyingPartyEntityBaseUrl The base URL of the RP entity
- * @param trustAnchorConfig The entity configuration of the known trust anchor.
- * @param appFetch An optional instance of the http client to be used.
- * @returns A list of signed tokens that represent the trust chain, in the order of the chain (from the RP to the Trust Anchor)
- * @throws {FederationError} When an element of the chain fails to parse or other build steps fail.
- */
-export async function buildTrustChain(relyingPartyEntityBaseUrl, trustAnchorConfig) {
-  let appFetch = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : fetch;
-  // 1: Verify if the RP is authorized by the Trust Anchor's federation list
-  // Extract the Trust Anchor's signing key and federation_list_endpoint
-  // (we assume the TA has only one key, as per spec)
-  const trustAnchorKey = trustAnchorConfig.payload.jwks.keys[0];
-  if (!trustAnchorKey) {
-    throw new BuildTrustChainError("Cannot verify trust anchor: missing signing key in entity configuration.");
-  }
-  const federationListEndpoint = trustAnchorConfig.payload.metadata.federation_entity.federation_list_endpoint;
-  if (federationListEndpoint) {
-    const federationList = await getFederationList(federationListEndpoint, {
-      appFetch
-    });
-    if (!federationList.includes(relyingPartyEntityBaseUrl)) {
-      throw new RelyingPartyNotAuthorizedError("Relying Party entity base URL is not authorized by the Trust Anchor's federation list.", {
-        relyingPartyUrl: relyingPartyEntityBaseUrl,
-        federationListEndpoint
-      });
-    }
-  }
-
-  // 1: Recursively gather the trust chain from the RP up to the Trust Anchor
-  const trustChain = await gatherTrustChain(relyingPartyEntityBaseUrl, appFetch);
-  // 2: Trust Anchor signature verification
-  const chainTrustAnchorJwt = trustChain[trustChain.length - 1];
-  if (!chainTrustAnchorJwt) {
-    throw new BuildTrustChainError("Cannot verify trust anchor: missing entity configuration in gathered chain.", {
-      relyingPartyUrl: relyingPartyEntityBaseUrl
-    });
-  }
-  if (!trustAnchorKey.kid) {
-    throw new TrustAnchorKidMissingError();
-  }
-  await verify(chainTrustAnchorJwt, trustAnchorKey.kid, [trustAnchorKey]);
-  return trustChain;
-}
-
-/**
- * Recursively gather the trust chain for an entity and all its superiors.
- * @param entityBaseUrl The base URL of the entity for which to gather the chain.
- * @param appFetch An optional instance of the http client to be used.
- * @param isLeaf Whether the current entity is the leaf of the chain.
- * @returns A full ordered list of JWTs (ECs and ESs) forming the trust chain.
- * @throws {FederationError} If any of the fetched documents fail to parse or other errors occur during the gathering process.
- */
-async function gatherTrustChain(entityBaseUrl, appFetch) {
-  let isLeaf = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : true;
-  const chain = [];
-
-  // Fetch self-signed EC (only needed for the leaf)
-  const entityECJwt = await getSignedEntityConfiguration(entityBaseUrl, {
-    appFetch
-  });
-  const entityEC = EntityConfiguration.parse(decode(entityECJwt));
-  if (isLeaf) {
-    // Only push EC for the leaf
-    chain.push(entityECJwt);
-  }
-
-  // Find authority_hints (parent, if any)
-  const authorityHints = entityEC.payload.authority_hints ?? [];
-  if (authorityHints.length === 0) {
-    // This is the Trust Anchor (no parent)
-    if (!isLeaf) {
-      chain.push(entityECJwt);
-    }
-    return chain;
-  }
-  const parentEntityBaseUrl = authorityHints[0];
-
-  // Fetch parent EC
-  const parentECJwt = await getSignedEntityConfiguration(parentEntityBaseUrl, {
-    appFetch
-  });
-  const parentEC = EntityConfiguration.parse(decode(parentECJwt));
-  // Fetch ES
-  const federationFetchEndpoint = parentEC.payload.metadata.federation_entity.federation_fetch_endpoint;
-  if (!federationFetchEndpoint) {
-    throw new MissingFederationFetchEndpointError(`Missing federation_fetch_endpoint in parent's (${parentEntityBaseUrl}) configuration when gathering chain for ${entityBaseUrl}.`, {
-      entityBaseUrl,
-      missingInEntityUrl: parentEntityBaseUrl
-    });
-  }
-  const entityStatementJwt = await getSignedEntityStatement(federationFetchEndpoint, entityBaseUrl, {
-    appFetch
-  });
-  // Validate the ES
-  EntityStatement.parse(decode(entityStatementJwt));
-
-  // Push this ES into the chain
-  chain.push(entityStatementJwt);
-
-  // Recurse into the parent
-  const parentChain = await gatherTrustChain(parentEntityBaseUrl, appFetch, false);
-  return chain.concat(parentChain);
-}
-//# sourceMappingURL=build-chain.js.map

package/lib/module/trust/build-chain.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["BuildTrustChainError","FederationListParseError","MissingFederationFetchEndpointError","RelyingPartyNotAuthorizedError","TrustAnchorKidMissingError","decode","verify","CredentialIssuerEntityConfiguration","EntityConfiguration","EntityStatement","FederationListResponse","RelyingPartyEntityConfiguration","TrustAnchorEntityConfiguration","WalletProviderEntityConfiguration","hasStatusOrThrow","decodeJwt","fetchAndParseEntityConfiguration","entityBaseUrl","schema","appFetch","fetch","arguments","length","undefined","responseText","getSignedEntityConfiguration","responseJwt","parse","header","protectedHeader","payload","getWalletProviderEntityConfiguration","options","getCredentialIssuerEntityConfiguration","getTrustAnchorEntityConfiguration","getRelyingPartyEntityConfiguration","getEntityConfiguration","getEntityStatement","accreditationBodyBaseUrl","subordinatedEntityBaseUrl","getSignedEntityStatement","wellKnownUrl","method","then","res","text","federationFetchEndpoint","url","URL","searchParams","set","toString","getFederationList","federationListEndpoint","json","result","safeParse","success","error","message","parseError","data","buildTrustChain","relyingPartyEntityBaseUrl","trustAnchorConfig","trustAnchorKey","jwks","keys","metadata","federation_entity","federation_list_endpoint","federationList","includes","relyingPartyUrl","trustChain","gatherTrustChain","chainTrustAnchorJwt","kid","isLeaf","chain","entityECJwt","entityEC","push","authorityHints","authority_hints","parentEntityBaseUrl","parentECJwt","parentEC","federation_fetch_endpoint","missingInEntityUrl","entityStatementJwt","parentChain","concat"],"sourceRoot":"../../../src","sources":["trust/build-chain.ts"],"mappings":"AAAA,SACEA,oBAAoB,EACpBC,wBAAwB,EACxBC,mCAAmC,EACnCC,8BAA8B,EAC9BC,0BAA0B,QACrB,UAAU;AACjB,SAASC,MAAM,EAAEC,MAAM,QAAQ,SAAS;AACxC,SACEC,mCAAmC,EACnCC,mBAAmB,EACnBC,eAAe,EACfC,sBAAsB,EACtBC,+BAA+B,EAC/BC,8BAA8B,EAC9BC,iCAAiC,QAC5B,SAAS;AAChB,SAASC,gBAAgB,QAAQ,eAAe;AAChD,SAAST,MAAM,IAAIU,SAAS,QAAQ,6BAA6B;;AAEjE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAoCA,eAAeC,gCAAgCA,CAC7CC,aAAqB,EACrBC,MAK8B,EAM9B;EAAA,IALA;IACEC,QAAQ,GAAGC;EAGb,CAAC,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;EAEN,MAAMG,YAAY,GAAG,MAAMC,4BAA4B,CAACR,aAAa,EAAE;IACrEE;EACF,CAAC,CAAC;EAEF,MAAMO,WAAW,GAAGX,SAAS,CAACS,YAAY,CAAC;EAC3C,OAAON,MAAM,CAACS,KAAK,CAAC;IAClBC,MAAM,EAAEF,WAAW,CAACG,eAAe;IACnCC,OAAO,EAAEJ,WAAW,CAACI;EACvB,CAAC,CAAC;AACJ;AAEA,OAAO,MAAMC,oCAAoC,GAAGA,CAClDd,aAAqE,EACrEe,OAAgE,KAEhEhB,gCAAgC,CAC9BC,aAAa,EACbJ,iCAAiC,EACjCmB,OACF,CAAC;AAEH,OAAO,MAAMC,sCAAsC,GAAGA,CACpDhB,aAAqE,EACrEe,OAAgE,KAEhEhB,gCAAgC,CAC9BC,aAAa,EACbV,mCAAmC,EACnCyB,OACF,CAAC;AAEH,OAAO,MAAME,iCAAiC,GAAGA,CAC/CjB,aAAqE,EACrEe,OAAgE,KAEhEhB,gCAAgC,CAC9BC,aAAa,EACbL,8BAA8B,EAC9BoB,OACF,CAAC;AAEH,OAAO,MAAMG,kCAAkC,GAAGA,CAChDlB,aAAqE,EACrEe,OAAgE,KAEhEhB,gCAAgC,CAC9BC,aAAa,EACbN,+BAA+B,EAC/BqB,OACF,CAAC;AAEH,OAAO,MAAMI,sBAAsB,GAAGA,CACpCnB,aAAqE,EACrEe,OAAgE,KAEhEhB,gCAAgC,CAACC,aAAa,EAAET,mBAAmB,EAAEwB,OAAO,CAAC;;AAE/E;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeK,kBAAkBA,CACtCC,wBAAgC,EAChCC,yBAAiC,EAMjC;EAAA,IALA;IACEpB,QAAQ,GAAGC;EAGb,CAAC,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;EAEN,MAAMG,YAAY,GAAG,MAAMgB,wBAAwB,CACjDF,wBAAwB,EACxBC,yBAAyB,EACzB;IACEpB;EACF,CACF,CAAC;EAED,MAAMO,WAAW,GAAGX,SAAS,CAACS,YAAY,CAAC;EAC3C,OAAOf,eAAe,CAACkB,KAAK,CAAC;IAC3BC,MAAM,EAAEF,WAAW,CAACG,eAAe;IACnCC,OAAO,EAAEJ,WAAW,CAACI;EACvB,CAAC,CAAC;AACJ;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeL,4BAA4BA,CAChDR,aAAqB,EAMJ;EAAA,IALjB;IACEE,QAAQ,GAAGC;EAGb,CAAC,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;EAEN,MAAMoB,YAAY,GAAI,GAAExB,aAAc,gCAA+B;EAErE,OAAO,MAAME,QAAQ,CAACsB,YAAY,EAAE;IAClCC,MAAM,EAAE;EACV,CAAC,CAAC,CACCC,IAAI,CAAC7B,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAC3B6B,IAAI,CAAEC,GAAG,IAAKA,GAAG,CAACC,IAAI,CAAC,CAAC,CAAC;AAC9B;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeL,wBAAwBA,CAC5CM,uBAA+B,EAC/BP,yBAAiC,EAMjC;EAAA,IALA;IACEpB,QAAQ,GAAGC;EAGb,CAAC,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;EAEN,MAAM0B,GAAG,GAAG,IAAIC,GAAG,CAACF,uBAAuB,CAAC;EAC5CC,GAAG,CAACE,YAAY,CAACC,GAAG,CAAC,KAAK,EAAEX,yBAAyB,CAAC;EAEtD,OAAO,MAAMpB,QAAQ,CAAC4B,GAAG,CAACI,QAAQ,CAAC,CAAC,EAAE;IACpCT,MAAM,EAAE;EACV,CAAC,CAAC,CACCC,IAAI,CAAC7B,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAC3B6B,IAAI,CAAEC,GAAG,IAAKA,GAAG,CAACC,IAAI,CAAC,CAAC,CAAC;AAC9B;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeO,iBAAiBA,CACrCC,sBAA8B,EAMX;EAAA,IALnB;IACElC,QAAQ,GAAGC;EAGb,CAAC,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;EAEN,OAAO,MAAMF,QAAQ,CAACkC,sBAAsB,EAAE;IAC5CX,MAAM,EAAE;EACV,CAAC,CAAC,CACCC,IAAI,CAAC7B,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAC3B6B,IAAI,CAAEC,GAAG,IAAKA,GAAG,CAACU,IAAI,CAAC,CAAC,CAAC,CACzBX,IAAI,CAAEW,IAAI,IAAK;IACd,MAAMC,MAAM,GAAG7C,sBAAsB,CAAC8C,SAAS,CAACF,IAAI,CAAC;IACrD,IAAI,CAACC,MAAM,CAACE,OAAO,EAAE;MACnB,MAAM,IAAIxD,wBAAwB,CAC/B,gDAA+CoD,sBAAuB,YAAWE,MAAM,CAACG,KAAK,CAACC,OAAQ,EAAC,EACxG;QAAEZ,GAAG,EAAEM,sBAAsB;QAAEO,UAAU,EAAEL,MAAM,CAACG,KAAK,CAACP,QAAQ,CAAC;MAAE,CACrE,CAAC;IACH;IACA,OAAOI,MAAM,CAACM,IAAI;EACpB,CAAC,CAAC;AACN;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeC,eAAeA,CACnCC,yBAAiC,EACjCC,iBAAiD,EAE9B;EAAA,IADnB7C,QAA8B,GAAAE,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAGD,KAAK;EAEtC;EACA;EACA;EACA,MAAM6C,cAAc,GAAGD,iBAAiB,CAAClC,OAAO,CAACoC,IAAI,CAACC,IAAI,CAAC,CAAC,CAAC;EAE7D,IAAI,CAACF,cAAc,EAAE;IACnB,MAAM,IAAIjE,oBAAoB,CAC5B,0EACF,CAAC;EACH;EAEA,MAAMqD,sBAAsB,GAC1BW,iBAAiB,CAAClC,OAAO,CAACsC,QAAQ,CAACC,iBAAiB,CACjDC,wBAAwB;EAE7B,IAAIjB,sBAAsB,EAAE;IAC1B,MAAMkB,cAAc,GAAG,MAAMnB,iBAAiB,CAACC,sBAAsB,EAAE;MACrElC;IACF,CAAC,CAAC;IAEF,IAAI,CAACoD,cAAc,CAACC,QAAQ,CAACT,yBAAyB,CAAC,EAAE;MACvD,MAAM,IAAI5D,8BAA8B,CACtC,wFAAwF,EACxF;QAAEsE,eAAe,EAAEV,yBAAyB;QAAEV;MAAuB,CACvE,CAAC;IACH;EACF;;EAEA;EACA,MAAMqB,UAAU,GAAG,MAAMC,gBAAgB,CACvCZ,yBAAyB,EACzB5C,QACF,CAAC;EACD;EACA,MAAMyD,mBAAmB,GAAGF,UAAU,CAACA,UAAU,CAACpD,MAAM,GAAG,CAAC,CAAC;EAC7D,IAAI,CAACsD,mBAAmB,EAAE;IACxB,MAAM,IAAI5E,oBAAoB,CAC5B,6EAA6E,EAC7E;MAAEyE,eAAe,EAAEV;IAA0B,CAC/C,CAAC;EACH;EAEA,IAAI,CAACE,cAAc,CAACY,GAAG,EAAE;IACvB,MAAM,IAAIzE,0BAA0B,CAAC,CAAC;EACxC;EAEA,MAAME,MAAM,CAACsE,mBAAmB,EAAEX,cAAc,CAACY,GAAG,EAAE,CAACZ,cAAc,CAAC,CAAC;EAEvE,OAAOS,UAAU;AACnB;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAeC,gBAAgBA,CAC7B1D,aAAqB,EACrBE,QAA8B,EAEX;EAAA,IADnB2D,MAAe,GAAAzD,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,IAAI;EAEtB,MAAM0D,KAAe,GAAG,EAAE;;EAE1B;EACA,MAAMC,WAAW,GAAG,MAAMvD,4BAA4B,CAACR,aAAa,EAAE;IACpEE;EACF,CAAC,CAAC;EACF,MAAM8D,QAAQ,GAAGzE,mBAAmB,CAACmB,KAAK,CAACtB,MAAM,CAAC2E,WAAW,CAAC,CAAC;EAC/D,IAAIF,MAAM,EAAE;IACV;IACAC,KAAK,CAACG,IAAI,CAACF,WAAW,CAAC;EACzB;;EAEA;EACA,MAAMG,cAAc,GAAGF,QAAQ,CAACnD,OAAO,CAACsD,eAAe,IAAI,EAAE;EAC7D,IAAID,cAAc,CAAC7D,MAAM,KAAK,CAAC,EAAE;IAC/B;IACA,IAAI,CAACwD,MAAM,EAAE;MACXC,KAAK,CAACG,IAAI,CAACF,WAAW,CAAC;IACzB;IACA,OAAOD,KAAK;EACd;EACA,MAAMM,mBAAmB,GAAGF,cAAc,CAAC,CAAC,CAAE;;EAE9C;EACA,MAAMG,WAAW,GAAG,MAAM7D,4BAA4B,CAAC4D,mBAAmB,EAAE;IAC1ElE;EACF,CAAC,CAAC;EACF,MAAMoE,QAAQ,GAAG/E,mBAAmB,CAACmB,KAAK,CAACtB,MAAM,CAACiF,WAAW,CAAC,CAAC;EAC/D;EACA,MAAMxC,uBAAuB,GAC3ByC,QAAQ,CAACzD,OAAO,CAACsC,QAAQ,CAACC,iBAAiB,CAACmB,yBAAyB;EACvE,IAAI,CAAC1C,uBAAuB,EAAE;IAC5B,MAAM,IAAI5C,mCAAmC,CAC1C,kDAAiDmF,mBAAoB,4CAA2CpE,aAAc,GAAE,EACjI;MAAEA,aAAa;MAAEwE,kBAAkB,EAAEJ;IAAoB,CAC3D,CAAC;EACH;EACA,MAAMK,kBAAkB,GAAG,MAAMlD,wBAAwB,CACvDM,uBAAuB,EACvB7B,aAAa,EACb;IAAEE;EAAS,CACb,CAAC;EACD;EACAV,eAAe,CAACkB,KAAK,CAACtB,MAAM,CAACqF,kBAAkB,CAAC,CAAC;;EAEjD;EACAX,KAAK,CAACG,IAAI,CAACQ,kBAAkB,CAAC;;EAE9B;EACA,MAAMC,WAAW,GAAG,MAAMhB,gBAAgB,CACxCU,mBAAmB,EACnBlE,QAAQ,EACR,KACF,CAAC;EAED,OAAO4D,KAAK,CAACa,MAAM,CAACD,WAAW,CAAC;AAClC"}

package/lib/module/trust/errors.js

@@ -1,116 +0,0 @@
-import { IoWalletError, serializeAttrs } from "../utils/errors";
-// Ensure this path is correct
-/**
- * Base class for all federation-specific errors.
- */
-export class FederationError extends IoWalletError {
-  constructor(message, details) {
-    super(details ? serializeAttrs({
-      message,
-      ...details
-    }) : message);
-    this.name = this.constructor.name;
-    this.details = details;
-  }
-}
-
-/**
- * Error thrown when a trust chain is unexpectedly empty.
- */
-export class TrustChainEmptyError extends FederationError {
-  code = "ERR_FED_TRUST_CHAIN_EMPTY";
-  constructor() {
-    let message = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : "Trust chain cannot be empty.";
-    super(message, undefined);
-  }
-}
-
-/**
- * Error thrown when a token is unexpectedly missing from a trust chain during processing.
- */
-export class TrustChainTokenMissingError extends FederationError {
-  code = "ERR_FED_TRUST_CHAIN_TOKEN_MISSING";
-  constructor(message, details) {
-    super(message, details);
-  }
-}
-
-/**
- * Error thrown when renewing a trust chain fails.
- * This class itself might be used or could be considered a more general renewal error.
- */
-export class TrustChainRenewalError extends FederationError {
-  code = "ERR_FED_TRUST_CHAIN_RENEWAL_FAILED";
-  constructor(message, details) {
-    super(message, details);
-  }
-}
-export class FederationListParseError extends FederationError {
-  code = "ERR_FED_FEDERATION_LIST_PARSE_FAILED";
-  constructor(message, details) {
-    super(message, details);
-  }
-}
-
-/**
- * General error thrown during the trust chain building process.
- */
-export class BuildTrustChainError extends FederationError {
-  code = "ERR_FED_BUILD_TRUST_CHAIN_FAILED";
-  constructor(message, details) {
-    super(message, details);
-  }
-}
-
-/**
- * Error thrown when the Trust Anchor's key is missing a 'kid'.
- */
-export class TrustAnchorKidMissingError extends FederationError {
-  code = "ERR_FED_TRUST_ANCHOR_KID_MISSING";
-  constructor() {
-    let message = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : "Missing 'kid' in provided Trust Anchor key.";
-    super(message, undefined);
-  }
-}
-
-/**
- * Error thrown if the Relying Party is not found in the Trust Anchor's federation list.
- */
-export class RelyingPartyNotAuthorizedError extends FederationError {
-  code = "ERR_FED_RELYING_PARTY_NOT_AUTHORIZED";
-  constructor(message, details) {
-    super(message, details);
-  }
-}
-
-/**
- * Error thrown when a 'federation_fetch_endpoint' is missing in an entity's configuration.
- */
-export class MissingFederationFetchEndpointError extends FederationError {
-  code = "ERR_FED_MISSING_FEDERATION_FETCH_ENDPOINT";
-  constructor(message, details) {
-    super(message, details);
-  }
-}
-
-/**
- * Error thrown when the X.509 certificate chain is missing in an entity's configuration.
- */
-export class MissingX509CertsError extends FederationError {
-  code = "ERR_FED_MISSING_X509_CERTS";
-  constructor(message) {
-    super(message, undefined);
-  }
-}
-
-/**
- * Error thrown when an X.509 certificate validation fails.
- * This is used to indicate issues with the certificate chain or signature verification.
- */
-export class X509ValidationError extends FederationError {
-  code = "ERR_FED_X509_VALIDATION_FAILED";
-  constructor(message, details) {
-    super(message, details);
-  }
-}
-//# sourceMappingURL=errors.js.map

package/lib/module/trust/errors.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["IoWalletError","serializeAttrs","FederationError","constructor","message","details","name","TrustChainEmptyError","code","arguments","length","undefined","TrustChainTokenMissingError","TrustChainRenewalError","FederationListParseError","BuildTrustChainError","TrustAnchorKidMissingError","RelyingPartyNotAuthorizedError","MissingFederationFetchEndpointError","MissingX509CertsError","X509ValidationError"],"sourceRoot":"../../../src","sources":["trust/errors.ts"],"mappings":"AAAA,SAASA,aAAa,EAAEC,cAAc,QAAQ,iBAAiB;AACoB;AAEnF;AACA;AACA;AACA,OAAO,MAAMC,eAAe,SAASF,aAAa,CAAC;EAEjDG,WAAWA,CAACC,OAAe,EAAEC,OAAiC,EAAE;IAC9D,KAAK,CAACA,OAAO,GAAGJ,cAAc,CAAC;MAAEG,OAAO;MAAE,GAAGC;IAAQ,CAAC,CAAC,GAAGD,OAAO,CAAC;IAClE,IAAI,CAACE,IAAI,GAAG,IAAI,CAACH,WAAW,CAACG,IAAI;IACjC,IAAI,CAACD,OAAO,GAAGA,OAAO;EACxB;AACF;;AAEA;AACA;AACA;AACA,OAAO,MAAME,oBAAoB,SAASL,eAAe,CAAC;EACxDM,IAAI,GAAG,2BAA2B;EAClCL,WAAWA,CAAA,EAA2C;IAAA,IAA1CC,OAAO,GAAAK,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,8BAA8B;IAClD,KAAK,CAACL,OAAO,EAAEO,SAAS,CAAC;EAC3B;AACF;;AAEA;AACA;AACA;AACA,OAAO,MAAMC,2BAA2B,SAASV,eAAe,CAAC;EAC/DM,IAAI,GAAG,mCAAmC;EAC1CL,WAAWA,CAACC,OAAe,EAAEC,OAA4B,EAAE;IACzD,KAAK,CAACD,OAAO,EAAEC,OAAO,CAAC;EACzB;AACF;;AAEA;AACA;AACA;AACA;AACA,OAAO,MAAMQ,sBAAsB,SAASX,eAAe,CAAC;EAC1DM,IAAI,GAAG,oCAAoC;EAC3CL,WAAWA,CACTC,OAAe,EACfC,OAA8D,EAC9D;IACA,KAAK,CAACD,OAAO,EAAEC,OAAO,CAAC;EACzB;AACF;AAEA,OAAO,MAAMS,wBAAwB,SAASZ,eAAe,CAAC;EAC5DM,IAAI,GAAG,sCAAsC;EAC7CL,WAAWA,CAACC,OAAe,EAAEC,OAA6C,EAAE;IAC1E,KAAK,CAACD,OAAO,EAAEC,OAAO,CAAC;EACzB;AACF;;AAEA;AACA;AACA;AACA,OAAO,MAAMU,oBAAoB,SAASb,eAAe,CAAC;EACxDM,IAAI,GAAG,kCAAkC;EACzCL,WAAWA,CACTC,OAAe,EACfC,OAIC,EACD;IACA,KAAK,CAACD,OAAO,EAAEC,OAAO,CAAC;EACzB;AACF;;AAEA;AACA;AACA;AACA,OAAO,MAAMW,0BAA0B,SAASd,eAAe,CAAC;EAC9DM,IAAI,GAAG,kCAAkC;EACzCL,WAAWA,CAAA,EAA0D;IAAA,IAAzDC,OAAO,GAAAK,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,6CAA6C;IACjE,KAAK,CAACL,OAAO,EAAEO,SAAS,CAAC;EAC3B;AACF;;AAEA;AACA;AACA;AACA,OAAO,MAAMM,8BAA8B,SAASf,eAAe,CAAC;EAClEM,IAAI,GAAG,sCAAsC;EAC7CL,WAAWA,CACTC,OAAe,EACfC,OAAqE,EACrE;IACA,KAAK,CAACD,OAAO,EAAEC,OAAO,CAAC;EACzB;AACF;;AAEA;AACA;AACA;AACA,OAAO,MAAMa,mCAAmC,SAAShB,eAAe,CAAC;EACvEM,IAAI,GAAG,2CAA2C;EAClDL,WAAWA,CACTC,OAAe,EACfC,OAA8D,EAC9D;IACA,KAAK,CAACD,OAAO,EAAEC,OAAO,CAAC;EACzB;AACF;;AAEA;AACA;AACA;AACA,OAAO,MAAMc,qBAAqB,SAASjB,eAAe,CAAC;EACzDM,IAAI,GAAG,4BAA4B;EACnCL,WAAWA,CAACC,OAAe,EAAE;IAC3B,KAAK,CAACA,OAAO,EAAEO,SAAS,CAAC;EAC3B;AACF;;AAEA;AACA;AACA;AACA;AACA,OAAO,MAAMS,mBAAmB,SAASlB,eAAe,CAAC;EACvDM,IAAI,GAAG,gCAAgC;EACvCL,WAAWA,CACTC,OAAe,EACfC,OAMC,EACD;IACA,KAAK,CAACD,OAAO,EAAEC,OAAO,CAAC;EACzB;AACF"}

package/lib/module/trust/types.js

@@ -1,221 +0,0 @@
-import { UnixTime } from "../sd-jwt/types";
-import { JWK } from "../utils/jwk";
-import * as z from "zod";
-import { PresentationDefinition } from "../credential/presentation/types";
-export const TrustMark = z.object({
-  id: z.string(),
-  trust_mark: z.string()
-});
-const RelyingPartyMetadata = z.object({
-  application_type: z.string().optional(),
-  client_id: z.string().optional(),
-  client_name: z.string().optional(),
-  jwks: z.object({
-    keys: z.array(JWK)
-  }),
-  contacts: z.array(z.string()).optional(),
-  presentation_definition: PresentationDefinition.optional(),
-  request_uris: z.array(z.string()).optional(),
-  authorization_signed_response_alg: z.string().optional(),
-  authorization_encrypted_response_alg: z.string().optional(),
-  authorization_encrypted_response_enc: z.string().optional()
-});
-
-// Display metadata for a credential, used by the issuer to
-// instruct the Wallet Solution on how to render the credential correctly
-const CredentialDisplayMetadata = z.object({
-  name: z.string(),
-  locale: z.string()
-});
-
-// Metadata for displaying issuer information
-
-const CredentialIssuerDisplayMetadata = z.object({
-  name: z.string(),
-  locale: z.string()
-});
-const ClaimsMetadata = z.object({
-  path: z.array(z.union([z.string(), z.number(), z.null()])),
-  // https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-15.html#name-claims-path-pointer
-  display: z.array(CredentialDisplayMetadata)
-});
-const IssuanceErrorSupported = z.object({
-  display: z.array(z.object({
-    title: z.string(),
-    description: z.string(),
-    locale: z.string()
-  }))
-});
-
-// Metadata for a credential which is supported by an Issuer
-
-const SupportedCredentialMetadata = z.intersection(z.discriminatedUnion("format", [z.object({
-  format: z.literal("dc+sd-jwt"),
-  vct: z.string()
-}), z.object({
-  format: z.literal("mso_mdoc"),
-  doctype: z.string()
-})]), z.object({
-  scope: z.string(),
-  display: z.array(CredentialDisplayMetadata),
-  claims: z.array(ClaimsMetadata),
-  cryptographic_binding_methods_supported: z.array(z.string()),
-  credential_signing_alg_values_supported: z.array(z.string()),
-  authentic_source: z.string().optional(),
-  issuance_errors_supported: z.record(IssuanceErrorSupported).optional()
-}));
-
-/**
- * Supported formats for credentials issued by the Issuer API 1.0,
- * compliant with IT-Wallet technical specifications 1.0.
- */
-
-export const EntityStatement = z.object({
-  header: z.object({
-    typ: z.literal("entity-statement+jwt"),
-    alg: z.string(),
-    kid: z.string()
-  }),
-  payload: z.object({
-    iss: z.string(),
-    sub: z.string(),
-    jwks: z.object({
-      keys: z.array(JWK)
-    }),
-    trust_marks: z.array(TrustMark).optional(),
-    iat: z.number(),
-    exp: z.number()
-  })
-});
-export const EntityConfigurationHeader = z.object({
-  typ: z.literal("entity-statement+jwt"),
-  alg: z.string(),
-  kid: z.string()
-});
-
-/**
- * @see https://openid.net/specs/openid-federation-1_0-41.html
- */
-const FederationEntityMetadata = z.object({
-  federation_fetch_endpoint: z.string().optional(),
-  federation_list_endpoint: z.string().optional(),
-  federation_resolve_endpoint: z.string().optional(),
-  federation_trust_mark_status_endpoint: z.string().optional(),
-  federation_trust_mark_list_endpoint: z.string().optional(),
-  federation_trust_mark_endpoint: z.string().optional(),
-  federation_historical_keys_endpoint: z.string().optional(),
-  endpoint_auth_signing_alg_values_supported: z.string().optional(),
-  organization_name: z.string().optional(),
-  homepage_uri: z.string().optional(),
-  policy_uri: z.string().optional(),
-  logo_uri: z.string().optional(),
-  contacts: z.array(z.string()).optional()
-}).passthrough();
-
-// Structure common to every Entity Configuration document
-const BaseEntityConfiguration = z.object({
-  header: EntityConfigurationHeader,
-  payload: z.object({
-    iss: z.string(),
-    sub: z.string(),
-    iat: UnixTime,
-    exp: UnixTime,
-    authority_hints: z.array(z.string()).optional(),
-    metadata: z.object({
-      federation_entity: FederationEntityMetadata
-    }).passthrough(),
-    jwks: z.object({
-      keys: z.array(JWK)
-    })
-  }).passthrough()
-});
-
-// Entity configuration for a Trust Anchor (it has no specific metadata section)
-
-export const TrustAnchorEntityConfiguration = BaseEntityConfiguration;
-
-// Entity configuration for a Credential Issuer
-
-export const CredentialIssuerEntityConfiguration = BaseEntityConfiguration.and(z.object({
-  payload: z.object({
-    jwks: z.object({
-      keys: z.array(JWK)
-    }),
-    metadata: z.object({
-      openid_credential_issuer: z.object({
-        credential_issuer: z.string(),
-        credential_endpoint: z.string(),
-        revocation_endpoint: z.string().optional(),
-        nonce_endpoint: z.string(),
-        status_attestation_endpoint: z.string(),
-        display: z.array(CredentialIssuerDisplayMetadata),
-        credential_configurations_supported: z.record(SupportedCredentialMetadata),
-        jwks: z.object({
-          keys: z.array(JWK)
-        }),
-        trust_frameworks_supported: z.array(z.string()),
-        evidence_supported: z.array(z.string())
-      }),
-      oauth_authorization_server: z.object({
-        authorization_endpoint: z.string(),
-        pushed_authorization_request_endpoint: z.string(),
-        token_endpoint: z.string(),
-        client_registration_types_supported: z.array(z.string()),
-        code_challenge_methods_supported: z.array(z.string()),
-        acr_values_supported: z.array(z.string()),
-        grant_types_supported: z.array(z.string()),
-        issuer: z.string(),
-        jwks: z.object({
-          keys: z.array(JWK)
-        }),
-        scopes_supported: z.array(z.string()),
-        response_modes_supported: z.array(z.string()),
-        token_endpoint_auth_methods_supported: z.array(z.string()),
-        token_endpoint_auth_signing_alg_values_supported: z.array(z.string()),
-        request_object_signing_alg_values_supported: z.array(z.string())
-      }),
-      /**
-       * Credential Issuers act as Relying Party when they require the presentation of other credentials.
-       * This does not apply for PID issuance, which requires CIE authz.
-       */
-      openid_credential_verifier: RelyingPartyMetadata.optional()
-    })
-  })
-}));
-
-// Entity configuration for a Relying Party
-
-export const RelyingPartyEntityConfiguration = BaseEntityConfiguration.and(z.object({
-  payload: z.object({
-    metadata: z.object({
-      openid_credential_verifier: RelyingPartyMetadata
-    })
-  })
-}));
-
-// Entity configuration for a Wallet Provider
-
-export const WalletProviderEntityConfiguration = BaseEntityConfiguration.and(z.object({
-  payload: z.object({
-    metadata: z.object({
-      wallet_provider: z.object({
-        token_endpoint: z.string(),
-        aal_values_supported: z.array(z.string()).optional(),
-        grant_types_supported: z.array(z.string()),
-        token_endpoint_auth_methods_supported: z.array(z.string()),
-        token_endpoint_auth_signing_alg_values_supported: z.array(z.string()),
-        jwks: z.object({
-          keys: z.array(JWK)
-        })
-      }).passthrough()
-    })
-  })
-}));
-
-// Maps any entity configuration by the union of every possible shapes
-
-export const EntityConfiguration = z.union([WalletProviderEntityConfiguration, CredentialIssuerEntityConfiguration, TrustAnchorEntityConfiguration, RelyingPartyEntityConfiguration], {
-  description: "Any kind of Entity Configuration allowed in the ecosystem"
-});
-export const FederationListResponse = z.array(z.string());
-//# sourceMappingURL=types.js.map

package/lib/module/trust/types.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["UnixTime","JWK","z","PresentationDefinition","TrustMark","object","id","string","trust_mark","RelyingPartyMetadata","application_type","optional","client_id","client_name","jwks","keys","array","contacts","presentation_definition","request_uris","authorization_signed_response_alg","authorization_encrypted_response_alg","authorization_encrypted_response_enc","CredentialDisplayMetadata","name","locale","CredentialIssuerDisplayMetadata","ClaimsMetadata","path","union","number","null","display","IssuanceErrorSupported","title","description","SupportedCredentialMetadata","intersection","discriminatedUnion","format","literal","vct","doctype","scope","claims","cryptographic_binding_methods_supported","credential_signing_alg_values_supported","authentic_source","issuance_errors_supported","record","EntityStatement","header","typ","alg","kid","payload","iss","sub","trust_marks","iat","exp","EntityConfigurationHeader","FederationEntityMetadata","federation_fetch_endpoint","federation_list_endpoint","federation_resolve_endpoint","federation_trust_mark_status_endpoint","federation_trust_mark_list_endpoint","federation_trust_mark_endpoint","federation_historical_keys_endpoint","endpoint_auth_signing_alg_values_supported","organization_name","homepage_uri","policy_uri","logo_uri","passthrough","BaseEntityConfiguration","authority_hints","metadata","federation_entity","TrustAnchorEntityConfiguration","CredentialIssuerEntityConfiguration","and","openid_credential_issuer","credential_issuer","credential_endpoint","revocation_endpoint","nonce_endpoint","status_attestation_endpoint","credential_configurations_supported","trust_frameworks_supported","evidence_supported","oauth_authorization_server","authorization_endpoint","pushed_authorization_request_endpoint","token_endpoint","client_registration_types_supported","code_challenge_methods_supported","acr_values_supported","grant_types_supported","issuer","scopes_supported","response_modes_supported","token_endpoint_auth_methods_supported","token_endpoint_auth_signing_alg_values_supported","request_object_signing_alg_values_supported","openid_credential_verifier","RelyingPartyEntityConfiguration","WalletProviderEntityConfiguration","wallet_provider","aal_values_supported","EntityConfiguration","FederationListResponse"],"sourceRoot":"../../../src","sources":["trust/types.ts"],"mappings":"AAAA,SAASA,QAAQ,QAAQ,iBAAiB;AAC1C,SAASC,GAAG,QAAQ,cAAc;AAClC,OAAO,KAAKC,CAAC,MAAM,KAAK;AACxB,SAASC,sBAAsB,QAAQ,kCAAkC;AAEzE,OAAO,MAAMC,SAAS,GAAGF,CAAC,CAACG,MAAM,CAAC;EAAEC,EAAE,EAAEJ,CAAC,CAACK,MAAM,CAAC,CAAC;EAAEC,UAAU,EAAEN,CAAC,CAACK,MAAM,CAAC;AAAE,CAAC,CAAC;AAG7E,MAAME,oBAAoB,GAAGP,CAAC,CAACG,MAAM,CAAC;EACpCK,gBAAgB,EAAER,CAAC,CAACK,MAAM,CAAC,CAAC,CAACI,QAAQ,CAAC,CAAC;EACvCC,SAAS,EAAEV,CAAC,CAACK,MAAM,CAAC,CAAC,CAACI,QAAQ,CAAC,CAAC;EAChCE,WAAW,EAAEX,CAAC,CAACK,MAAM,CAAC,CAAC,CAACI,QAAQ,CAAC,CAAC;EAClCG,IAAI,EAAEZ,CAAC,CAACG,MAAM,CAAC;IAAEU,IAAI,EAAEb,CAAC,CAACc,KAAK,CAACf,GAAG;EAAE,CAAC,CAAC;EACtCgB,QAAQ,EAAEf,CAAC,CAACc,KAAK,CAACd,CAAC,CAACK,MAAM,CAAC,CAAC,CAAC,CAACI,QAAQ,CAAC,CAAC;EACxCO,uBAAuB,EAAEf,sBAAsB,CAACQ,QAAQ,CAAC,CAAC;EAC1DQ,YAAY,EAAEjB,CAAC,CAACc,KAAK,CAACd,CAAC,CAACK,MAAM,CAAC,CAAC,CAAC,CAACI,QAAQ,CAAC,CAAC;EAC5CS,iCAAiC,EAAElB,CAAC,CAACK,MAAM,CAAC,CAAC,CAACI,QAAQ,CAAC,CAAC;EACxDU,oCAAoC,EAAEnB,CAAC,CAACK,MAAM,CAAC,CAAC,CAACI,QAAQ,CAAC,CAAC;EAC3DW,oCAAoC,EAAEpB,CAAC,CAACK,MAAM,CAAC,CAAC,CAACI,QAAQ,CAAC;AAC5D,CAAC,CAAC;;AAEF;AACA;AAEA,MAAMY,yBAAyB,GAAGrB,CAAC,CAACG,MAAM,CAAC;EACzCmB,IAAI,EAAEtB,CAAC,CAACK,MAAM,CAAC,CAAC;EAChBkB,MAAM,EAAEvB,CAAC,CAACK,MAAM,CAAC;AACnB,CAAC,CAAC;;AAEF;;AAIA,MAAMmB,+BAA+B,GAAGxB,CAAC,CAACG,MAAM,CAAC;EAC/CmB,IAAI,EAAEtB,CAAC,CAACK,MAAM,CAAC,CAAC;EAChBkB,MAAM,EAAEvB,CAAC,CAACK,MAAM,CAAC;AACnB,CAAC,CAAC;AAGF,MAAMoB,cAAc,GAAGzB,CAAC,CAACG,MAAM,CAAC;EAC9BuB,IAAI,EAAE1B,CAAC,CAACc,KAAK,CAACd,CAAC,CAAC2B,KAAK,CAAC,CAAC3B,CAAC,CAACK,MAAM,CAAC,CAAC,EAAEL,CAAC,CAAC4B,MAAM,CAAC,CAAC,EAAE5B,CAAC,CAAC6B,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;EAAE;EAC5DC,OAAO,EAAE9B,CAAC,CAACc,KAAK,CAACO,yBAAyB;AAC5C,CAAC,CAAC;AAGF,MAAMU,sBAAsB,GAAG/B,CAAC,CAACG,MAAM,CAAC;EACtC2B,OAAO,EAAE9B,CAAC,CAACc,KAAK,CACdd,CAAC,CAACG,MAAM,CAAC;IACP6B,KAAK,EAAEhC,CAAC,CAACK,MAAM,CAAC,CAAC;IACjB4B,WAAW,EAAEjC,CAAC,CAACK,MAAM,CAAC,CAAC;IACvBkB,MAAM,EAAEvB,CAAC,CAACK,MAAM,CAAC;EACnB,CAAC,CACH;AACF,CAAC,CAAC;;AAEF;;AAEA,MAAM6B,2BAA2B,GAAGlC,CAAC,CAACmC,YAAY,CAChDnC,CAAC,CAACoC,kBAAkB,CAAC,QAAQ,EAAE,CAC7BpC,CAAC,CAACG,MAAM,CAAC;EAAEkC,MAAM,EAAErC,CAAC,CAACsC,OAAO,CAAC,WAAW,CAAC;EAAEC,GAAG,EAAEvC,CAAC,CAACK,MAAM,CAAC;AAAE,CAAC,CAAC,EAC7DL,CAAC,CAACG,MAAM,CAAC;EAAEkC,MAAM,EAAErC,CAAC,CAACsC,OAAO,CAAC,UAAU,CAAC;EAAEE,OAAO,EAAExC,CAAC,CAACK,MAAM,CAAC;AAAE,CAAC,CAAC,CACjE,CAAC,EACFL,CAAC,CAACG,MAAM,CAAC;EACPsC,KAAK,EAAEzC,CAAC,CAACK,MAAM,CAAC,CAAC;EACjByB,OAAO,EAAE9B,CAAC,CAACc,KAAK,CAACO,yBAAyB,CAAC;EAC3CqB,MAAM,EAAE1C,CAAC,CAACc,KAAK,CAACW,cAAc,CAAC;EAC/BkB,uCAAuC,EAAE3C,CAAC,CAACc,KAAK,CAACd,CAAC,CAACK,MAAM,CAAC,CAAC,CAAC;EAC5DuC,uCAAuC,EAAE5C,CAAC,CAACc,KAAK,CAACd,CAAC,CAACK,MAAM,CAAC,CAAC,CAAC;EAC5DwC,gBAAgB,EAAE7C,CAAC,CAACK,MAAM,CAAC,CAAC,CAACI,QAAQ,CAAC,CAAC;EACvCqC,yBAAyB,EAAE9C,CAAC,CAAC+C,MAAM,CAAChB,sBAAsB,CAAC,CAACtB,QAAQ,CAAC;AACvE,CAAC,CACH,CAAC;;AAED;AACA;AACA;AACA;;AAMA,OAAO,MAAMuC,eAAe,GAAGhD,CAAC,CAACG,MAAM,CAAC;EACtC8C,MAAM,EAAEjD,CAAC,CAACG,MAAM,CAAC;IACf+C,GAAG,EAAElD,CAAC,CAACsC,OAAO,CAAC,sBAAsB,CAAC;IACtCa,GAAG,EAAEnD,CAAC,CAACK,MAAM,CAAC,CAAC;IACf+C,GAAG,EAAEpD,CAAC,CAACK,MAAM,CAAC;EAChB,CAAC,CAAC;EACFgD,OAAO,EAAErD,CAAC,CAACG,MAAM,CAAC;IAChBmD,GAAG,EAAEtD,CAAC,CAACK,MAAM,CAAC,CAAC;IACfkD,GAAG,EAAEvD,CAAC,CAACK,MAAM,CAAC,CAAC;IACfO,IAAI,EAAEZ,CAAC,CAACG,MAAM,CAAC;MAAEU,IAAI,EAAEb,CAAC,CAACc,KAAK,CAACf,GAAG;IAAE,CAAC,CAAC;IACtCyD,WAAW,EAAExD,CAAC,CAACc,KAAK,CAACZ,SAAS,CAAC,CAACO,QAAQ,CAAC,CAAC;IAC1CgD,GAAG,EAAEzD,CAAC,CAAC4B,MAAM,CAAC,CAAC;IACf8B,GAAG,EAAE1D,CAAC,CAAC4B,MAAM,CAAC;EAChB,CAAC;AACH,CAAC,CAAC;AAKF,OAAO,MAAM+B,yBAAyB,GAAG3D,CAAC,CAACG,MAAM,CAAC;EAChD+C,GAAG,EAAElD,CAAC,CAACsC,OAAO,CAAC,sBAAsB,CAAC;EACtCa,GAAG,EAAEnD,CAAC,CAACK,MAAM,CAAC,CAAC;EACf+C,GAAG,EAAEpD,CAAC,CAACK,MAAM,CAAC;AAChB,CAAC,CAAC;;AAEF;AACA;AACA;AACA,MAAMuD,wBAAwB,GAAG5D,CAAC,CAC/BG,MAAM,CAAC;EACN0D,yBAAyB,EAAE7D,CAAC,CAACK,MAAM,CAAC,CAAC,CAACI,QAAQ,CAAC,CAAC;EAChDqD,wBAAwB,EAAE9D,CAAC,CAACK,MAAM,CAAC,CAAC,CAACI,QAAQ,CAAC,CAAC;EAC/CsD,2BAA2B,EAAE/D,CAAC,CAACK,MAAM,CAAC,CAAC,CAACI,QAAQ,CAAC,CAAC;EAClDuD,qCAAqC,EAAEhE,CAAC,CAACK,MAAM,CAAC,CAAC,CAACI,QAAQ,CAAC,CAAC;EAC5DwD,mCAAmC,EAAEjE,CAAC,CAACK,MAAM,CAAC,CAAC,CAACI,QAAQ,CAAC,CAAC;EAC1DyD,8BAA8B,EAAElE,CAAC,CAACK,MAAM,CAAC,CAAC,CAACI,QAAQ,CAAC,CAAC;EACrD0D,mCAAmC,EAAEnE,CAAC,CAACK,MAAM,CAAC,CAAC,CAACI,QAAQ,CAAC,CAAC;EAC1D2D,0CAA0C,EAAEpE,CAAC,CAACK,MAAM,CAAC,CAAC,CAACI,QAAQ,CAAC,CAAC;EACjE4D,iBAAiB,EAAErE,CAAC,CAACK,MAAM,CAAC,CAAC,CAACI,QAAQ,CAAC,CAAC;EACxC6D,YAAY,EAAEtE,CAAC,CAACK,MAAM,CAAC,CAAC,CAACI,QAAQ,CAAC,CAAC;EACnC8D,UAAU,EAAEvE,CAAC,CAACK,MAAM,CAAC,CAAC,CAACI,QAAQ,CAAC,CAAC;EACjC+D,QAAQ,EAAExE,CAAC,CAACK,MAAM,CAAC,CAAC,CAACI,QAAQ,CAAC,CAAC;EAC/BM,QAAQ,EAAEf,CAAC,CAACc,KAAK,CAACd,CAAC,CAACK,MAAM,CAAC,CAAC,CAAC,CAACI,QAAQ,CAAC;AACzC,CAAC,CAAC,CACDgE,WAAW,CAAC,CAAC;;AAEhB;AACA,MAAMC,uBAAuB,GAAG1E,CAAC,CAACG,MAAM,CAAC;EACvC8C,MAAM,EAAEU,yBAAyB;EACjCN,OAAO,EAAErD,CAAC,CACPG,MAAM,CAAC;IACNmD,GAAG,EAAEtD,CAAC,CAACK,MAAM,CAAC,CAAC;IACfkD,GAAG,EAAEvD,CAAC,CAACK,MAAM,CAAC,CAAC;IACfoD,GAAG,EAAE3D,QAAQ;IACb4D,GAAG,EAAE5D,QAAQ;IACb6E,eAAe,EAAE3E,CAAC,CAACc,KAAK,CAACd,CAAC,CAACK,MAAM,CAAC,CAAC,CAAC,CAACI,QAAQ,CAAC,CAAC;IAC/CmE,QAAQ,EAAE5E,CAAC,CACRG,MAAM,CAAC;MACN0E,iBAAiB,EAAEjB;IACrB,CAAC,CAAC,CACDa,WAAW,CAAC,CAAC;IAChB7D,IAAI,EAAEZ,CAAC,CAACG,MAAM,CAAC;MACbU,IAAI,EAAEb,CAAC,CAACc,KAAK,CAACf,GAAG;IACnB,CAAC;EACH,CAAC,CAAC,CACD0E,WAAW,CAAC;AACjB,CAAC,CAAC;;AAEF;;AAIA,OAAO,MAAMK,8BAA8B,GAAGJ,uBAAuB;;AAErE;;AAIA,OAAO,MAAMK,mCAAmC,GAAGL,uBAAuB,CAACM,GAAG,CAC5EhF,CAAC,CAACG,MAAM,CAAC;EACPkD,OAAO,EAAErD,CAAC,CAACG,MAAM,CAAC;IAChBS,IAAI,EAAEZ,CAAC,CAACG,MAAM,CAAC;MAAEU,IAAI,EAAEb,CAAC,CAACc,KAAK,CAACf,GAAG;IAAE,CAAC,CAAC;IACtC6E,QAAQ,EAAE5E,CAAC,CAACG,MAAM,CAAC;MACjB8E,wBAAwB,EAAEjF,CAAC,CAACG,MAAM,CAAC;QACjC+E,iBAAiB,EAAElF,CAAC,CAACK,MAAM,CAAC,CAAC;QAC7B8E,mBAAmB,EAAEnF,CAAC,CAACK,MAAM,CAAC,CAAC;QAC/B+E,mBAAmB,EAAEpF,CAAC,CAACK,MAAM,CAAC,CAAC,CAACI,QAAQ,CAAC,CAAC;QAC1C4E,cAAc,EAAErF,CAAC,CAACK,MAAM,CAAC,CAAC;QAC1BiF,2BAA2B,EAAEtF,CAAC,CAACK,MAAM,CAAC,CAAC;QACvCyB,OAAO,EAAE9B,CAAC,CAACc,KAAK,CAACU,+BAA+B,CAAC;QACjD+D,mCAAmC,EAAEvF,CAAC,CAAC+C,MAAM,CAC3Cb,2BACF,CAAC;QACDtB,IAAI,EAAEZ,CAAC,CAACG,MAAM,CAAC;UAAEU,IAAI,EAAEb,CAAC,CAACc,KAAK,CAACf,GAAG;QAAE,CAAC,CAAC;QACtCyF,0BAA0B,EAAExF,CAAC,CAACc,KAAK,CAACd,CAAC,CAACK,MAAM,CAAC,CAAC,CAAC;QAC/CoF,kBAAkB,EAAEzF,CAAC,CAACc,KAAK,CAACd,CAAC,CAACK,MAAM,CAAC,CAAC;MACxC,CAAC,CAAC;MACFqF,0BAA0B,EAAE1F,CAAC,CAACG,MAAM,CAAC;QACnCwF,sBAAsB,EAAE3F,CAAC,CAACK,MAAM,CAAC,CAAC;QAClCuF,qCAAqC,EAAE5F,CAAC,CAACK,MAAM,CAAC,CAAC;QACjDwF,cAAc,EAAE7F,CAAC,CAACK,MAAM,CAAC,CAAC;QAC1ByF,mCAAmC,EAAE9F,CAAC,CAACc,KAAK,CAACd,CAAC,CAACK,MAAM,CAAC,CAAC,CAAC;QACxD0F,gCAAgC,EAAE/F,CAAC,CAACc,KAAK,CAACd,CAAC,CAACK,MAAM,CAAC,CAAC,CAAC;QACrD2F,oBAAoB,EAAEhG,CAAC,CAACc,KAAK,CAACd,CAAC,CAACK,MAAM,CAAC,CAAC,CAAC;QACzC4F,qBAAqB,EAAEjG,CAAC,CAACc,KAAK,CAACd,CAAC,CAACK,MAAM,CAAC,CAAC,CAAC;QAC1C6F,MAAM,EAAElG,CAAC,CAACK,MAAM,CAAC,CAAC;QAClBO,IAAI,EAAEZ,CAAC,CAACG,MAAM,CAAC;UAAEU,IAAI,EAAEb,CAAC,CAACc,KAAK,CAACf,GAAG;QAAE,CAAC,CAAC;QACtCoG,gBAAgB,EAAEnG,CAAC,CAACc,KAAK,CAACd,CAAC,CAACK,MAAM,CAAC,CAAC,CAAC;QACrC+F,wBAAwB,EAAEpG,CAAC,CAACc,KAAK,CAACd,CAAC,CAACK,MAAM,CAAC,CAAC,CAAC;QAC7CgG,qCAAqC,EAAErG,CAAC,CAACc,KAAK,CAACd,CAAC,CAACK,MAAM,CAAC,CAAC,CAAC;QAC1DiG,gDAAgD,EAAEtG,CAAC,CAACc,KAAK,CAACd,CAAC,CAACK,MAAM,CAAC,CAAC,CAAC;QACrEkG,2CAA2C,EAAEvG,CAAC,CAACc,KAAK,CAACd,CAAC,CAACK,MAAM,CAAC,CAAC;MACjE,CAAC,CAAC;MACF;AACR;AACA;AACA;MACQmG,0BAA0B,EAAEjG,oBAAoB,CAACE,QAAQ,CAAC;IAC5D,CAAC;EACH,CAAC;AACH,CAAC,CACH,CAAC;;AAED;;AAIA,OAAO,MAAMgG,+BAA+B,GAAG/B,uBAAuB,CAACM,GAAG,CACxEhF,CAAC,CAACG,MAAM,CAAC;EACPkD,OAAO,EAAErD,CAAC,CAACG,MAAM,CAAC;IAChByE,QAAQ,EAAE5E,CAAC,CAACG,MAAM,CAAC;MACjBqG,0BAA0B,EAAEjG;IAC9B,CAAC;EACH,CAAC;AACH,CAAC,CACH,CAAC;;AAED;;AAIA,OAAO,MAAMmG,iCAAiC,GAAGhC,uBAAuB,CAACM,GAAG,CAC1EhF,CAAC,CAACG,MAAM,CAAC;EACPkD,OAAO,EAAErD,CAAC,CAACG,MAAM,CAAC;IAChByE,QAAQ,EAAE5E,CAAC,CAACG,MAAM,CAAC;MACjBwG,eAAe,EAAE3G,CAAC,CACfG,MAAM,CAAC;QACN0F,cAAc,EAAE7F,CAAC,CAACK,MAAM,CAAC,CAAC;QAC1BuG,oBAAoB,EAAE5G,CAAC,CAACc,KAAK,CAACd,CAAC,CAACK,MAAM,CAAC,CAAC,CAAC,CAACI,QAAQ,CAAC,CAAC;QACpDwF,qBAAqB,EAAEjG,CAAC,CAACc,KAAK,CAACd,CAAC,CAACK,MAAM,CAAC,CAAC,CAAC;QAC1CgG,qCAAqC,EAAErG,CAAC,CAACc,KAAK,CAACd,CAAC,CAACK,MAAM,CAAC,CAAC,CAAC;QAC1DiG,gDAAgD,EAAEtG,CAAC,CAACc,KAAK,CACvDd,CAAC,CAACK,MAAM,CAAC,CACX,CAAC;QACDO,IAAI,EAAEZ,CAAC,CAACG,MAAM,CAAC;UAAEU,IAAI,EAAEb,CAAC,CAACc,KAAK,CAACf,GAAG;QAAE,CAAC;MACvC,CAAC,CAAC,CACD0E,WAAW,CAAC;IACjB,CAAC;EACH,CAAC;AACH,CAAC,CACH,CAAC;;AAED;;AAEA,OAAO,MAAMoC,mBAAmB,GAAG7G,CAAC,CAAC2B,KAAK,CACxC,CACE+E,iCAAiC,EACjC3B,mCAAmC,EACnCD,8BAA8B,EAC9B2B,+BAA+B,CAChC,EACD;EACExE,WAAW,EAAE;AACf,CACF,CAAC;AAED,OAAO,MAAM6E,sBAAsB,GAAG9G,CAAC,CAACc,KAAK,CAACd,CAAC,CAACK,MAAM,CAAC,CAAC,CAAC"}